Edit tour
Windows
Analysis Report
Payment-Order #24560274 for 8,380 USD.exe
Overview
General Information
| Sample name: | Payment-Order #24560274 for 8,380 USD.exe |
| Analysis ID: | 1585875 |
| MD5: | f19ce6f6790292bbd9b8533d33b1a46f |
| SHA1: | ce057013f389e0f2506f4cd495799d684b0be2a3 |
| SHA256: | 67afda69254336cc140c2fe7474eb6b93c27ec134b07f91a604bee1c15c9135c |
| Tags: | exeuser-adrian__luca |
| Infos: |  |
 | |
Detection
XWorm
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected XWorm
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
AI detected suspicious sample
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Sample uses string decryption to hide its real strings
Writes to foreign memory regions
AV process strings found (often used to terminate AV products)
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality to query locales information (e.g. system language)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected non-DNS traffic on DNS port
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found evasive API chain (date check)
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Yara signature match
Classification
- System is w10x64
Payment-Order #24560274 for 8,380 USD.exe (PID: 5484 cmdline: "C:\Users\ user\Deskt op\Payment -Order #24 560274 for 8,380 USD .exe" MD5: F19CE6F6790292BBD9B8533D33B1A46F) 
conhost.exe (PID: 6232 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
MSBuild.exe (PID: 6224 cmdline: "C:\Window s\Microsof t.NET\Fram ework\v4.0 .30319\msb uild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232) 
WerFault.exe (PID: 3200 cmdline: C:\Windows \SysWOW64\ WerFault.e xe -u -p 6 224 -s 150 8 MD5: C31336C1EFC2CCB44B4326EA793040F2)
- cleanup
| Name | Description | Attribution | Blogpost URLs | Link |
|---|---|---|---|---|
| XWorm | Malware with wide range of capabilities ranging from RAT to ransomware. | No Attribution |
{"C2 url": ["212.23.222.198"], "Port": 7000, "Aes key": "<1234567829>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V3.1"}| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| MALWARE_Win_AsyncRAT | Detects AsyncRAT | ditekSHen |
| |
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| MALWARE_Win_AsyncRAT | Detects AsyncRAT | ditekSHen |
| |
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| Click to see the 3 entries | ||||
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| rat_win_xworm_v3 | Finds XWorm (version XClient, v3) samples based on characteristic strings | Sekoia.io |
| |
| MALWARE_Win_AsyncRAT | Detects AsyncRAT | ditekSHen |
| |
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| rat_win_xworm_v3 | Finds XWorm (version XClient, v3) samples based on characteristic strings | Sekoia.io |
| |
| Click to see the 16 entries | ||||
⊘No Sigma rule has matched
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2025-01-08T12:32:09.836709+0100 | 2859459 | 1 | Malware Command and Control Activity Detected | 192.168.2.9 | 52880 | 212.23.222.198 | 7000 | TCP |
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | Malware Configuration Extractor: | ||
| Source: | Virustotal: | Perma Link | ||
| Source: | ReversingLabs: | |||
| Source: | Integrated Neural Analysis Model: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Code function: | 0_2_00007FF7A6624450 | |
| Source: | Code function: | 0_2_00007FF7A6620200 | |
| Source: | Code function: | 0_2_00007FF7A65B9FC0 | |
| Source: | Code function: | 0_2_00007FF7A65FCC30 | |
| Source: | Code function: | 0_2_00007FF7A65CF9C0 | |
| Source: | Code function: | 0_2_00007FF7A6627A90 | |
| Source: | Code function: | 0_2_00007FF7A65CFAA0 | |
Networking | |
|---|
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | URLs: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | ASN Name: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | DNS traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
System Summary | |
|---|
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Static PE information: | ||
| Source: | Process Stats: | ||
| Source: | Code function: | 0_2_00007FF7A6568830 | |
| Source: | Code function: | 0_2_00007FF7A6559340 | |
| Source: | Code function: | 0_2_00007FF7A6566190 | |
| Source: | Code function: | 0_2_00007FF7A656D16A | |
| Source: | Code function: | 0_2_00007FF7A656DFD0 | |
| Source: | Code function: | 0_2_00007FF7A6570C50 | |
| Source: | Code function: | 0_2_00007FF7A6552750 | |
| Source: | Code function: | 0_2_00007FF7A657C800 | |
| Source: | Code function: | 0_2_00007FF7A65667F0 | |
| Source: | Code function: | 0_2_00007FF7A657A7B0 | |
| Source: | Code function: | 0_2_00007FF7A656A850 | |
| Source: | Code function: | 0_2_00007FF7A65A1910 | |
| Source: | Code function: | 0_2_00007FF7A65788D9 | |
| Source: | Code function: | 0_2_00007FF7A655E8A0 | |
| Source: | Code function: | 0_2_00007FF7A654A8B0 | |
| Source: | Code function: | 0_2_00007FF7A657E540 | |
| Source: | Code function: | 0_2_00007FF7A6561520 | |
| Source: | Code function: | 0_2_00007FF7A6566610 | |
| Source: | Code function: | 0_2_00007FF7A65735C0 | |
| Source: | Code function: | 0_2_00007FF7A6563640 | |
| Source: | Code function: | 0_2_00007FF7A656B6B0 | |
| Source: | Code function: | 0_2_00007FF7A6574390 | |
| Source: | Code function: | 0_2_00007FF7A6560360 | |
| Source: | Code function: | 0_2_00007FF7A6572370 | |
| Source: | Code function: | 0_2_00007FF7A657D320 | |
| Source: | Code function: | 0_2_00007FF7A65483C4 | |
| Source: | Code function: | 0_2_00007FF7A65F3480 | |
| Source: | Code function: | 0_2_00007FF7A6550470 | |
| Source: | Code function: | 0_2_00007FF7A6571470 | |
| Source: | Code function: | 0_2_00007FF7A656A420 | |
| Source: | Code function: | 0_2_00007FF7A6549430 | |
| Source: | Code function: | 0_2_00007FF7A657B4F0 | |
| Source: | Code function: | 0_2_00007FF7A65644D0 | |
| Source: | Code function: | 0_2_00007FF7A657B180 | |
| Source: | Code function: | 0_2_00007FF7A6565200 | |
| Source: | Code function: | 0_2_00007FF7A6581200 | |
| Source: | Code function: | 0_2_00007FF7A6568200 | |
| Source: | Code function: | 0_2_00007FF7A65791B0 | |
| Source: | Code function: | 0_2_00007FF7A657F280 | |
| Source: | Code function: | 0_2_00007FF7A661E240 | |
| Source: | Code function: | 0_2_00007FF7A6548220 | |
| Source: | Code function: | 0_2_00007FF7A65752E0 | |
| Source: | Code function: | 0_2_00007FF7A65792CE | |
| Source: | Code function: | 0_2_00007FF7A6573F60 | |
| Source: | Code function: | 0_2_00007FF7A655EFE0 | |
| Source: | Code function: | 0_2_00007FF7A66100E0 | |
| Source: | Code function: | 0_2_00007FF7A65580D0 | |
| Source: | Code function: | 0_2_00007FF7A6562D30 | |
| Source: | Code function: | 0_2_00007FF7A656FDD0 | |
| Source: | Code function: | 0_2_00007FF7A657BEA0 | |
| Source: | Code function: | 0_2_00007FF7A656FB40 | |
| Source: | Code function: | 0_2_00007FF7A6607BA0 | |
| Source: | Code function: | 0_2_00007FF7A657BBA0 | |
| Source: | Code function: | 0_2_00007FF7A6577C79 | |
| Source: | Code function: | 0_2_00007FF7A6575C20 | |
| Source: | Code function: | 0_2_00007FF7A6564CD9 | |
| Source: | Code function: | 0_2_00007FF7A657F960 | |
| Source: | Code function: | 0_2_00007FF7A6551A00 | |
| Source: | Code function: | 0_2_00007FF7A65799C3 | |
| Source: | Code function: | 0_2_00007FF7A6584A40 | |
| Source: | Code function: | 0_2_00007FF7A6546A50 | |
| Source: | Code function: | 0_2_00007FF7A6556A50 | |
| Source: | Code function: | 0_2_00007FF7A6569A50 | |
| Source: | Code function: | 0_2_00007FF7A6602AC0 | |
| Source: | Code function: | 3_2_03155B50 | |
| Source: | Code function: | 3_2_03155280 | |
| Source: | Code function: | 3_2_03150B62 | |
| Source: | Code function: | 3_2_03154F38 | |
| Source: | Code function: | ||
| Source: | Process created: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Classification label: | ||
| Source: | Code function: | 0_2_00007FF7A6551830 | |
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Virustotal: | ||
| Source: | ReversingLabs: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Key value queried: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | Static file information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
Data Obfuscation | |
|---|
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Evasive API call chain: | graph_0-29279 | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | Code function: | 0_2_00007FF7A6551460 | |
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Code function: | 0_2_00007FF7A65AB64C | |
| Source: | Memory allocated: | Jump to behavior | ||
HIPS / PFW / Operating System Protection Evasion | |
|---|
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Code function: | 0_2_00007FF7A65D8FB0 | |
| Source: | Code function: | 0_2_00007FF7A65D9080 | |
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Code function: | 0_2_00007FF7A65AB27C | |
| Source: | Key value queried: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
Stealing of Sensitive Information | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
Remote Access Functionality | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | 1 Windows Management Instrumentation | 1 DLL Side-Loading | 1 Access Token Manipulation | 1 Disable or Modify Tools | OS Credential Dumping | 1 System Time Discovery | Remote Services | 11 Archive Collected Data | 12 Encrypted Channel | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
| Credentials | Domains | Default Accounts | 1 Native API | Boot or Logon Initialization Scripts | 312 Process Injection | 31 Virtualization/Sandbox Evasion | LSASS Memory | 21 Security Software Discovery | Remote Desktop Protocol | Data from Removable Media | 1 Non-Standard Port | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | 1 DLL Side-Loading | 1 Access Token Manipulation | Security Account Manager | 1 Process Discovery | SMB/Windows Admin Shares | Data from Network Shared Drive | 1 Non-Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | 312 Process Injection | NTDS | 31 Virtualization/Sandbox Evasion | Distributed Component Object Model | Input Capture | 12 Application Layer Protocol | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | Network Logon Script | 11 Deobfuscate/Decode Files or Information | LSA Secrets | 1 Application Window Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
| Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | 2 Obfuscated Files or Information | Cached Domain Credentials | 25 System Information Discovery | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
| DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | 2 Software Packing | DCSync | Remote System Discovery | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
| Network Trust Dependencies | Serverless | Drive-by Compromise | Container Orchestration Job | Scheduled Task/Job | Scheduled Task/Job | 1 DLL Side-Loading | Proc Filesystem | System Owner/User Discovery | Cloud Services | Credential API Hooking | Application Layer Protocol | Exfiltration Over Alternative Protocol | Defacement |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 53% | Virustotal | Browse | ||
| 66% | ReversingLabs | Win64.Trojan.XWorm |
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | Avira URL Cloud | safe |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| bg.microsoft.map.fastly.net | 199.232.214.172 | true | false | high | |
| s-part-0017.t-0009.t-msedge.net | 13.107.246.45 | true | false | high | |
| fp2e7a.wpc.phicdn.net | 192.229.221.95 | true | false | high | |
| 241.42.69.40.in-addr.arpa | unknown | unknown | false | high |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| true |
| unknown |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false | high | |||
| false | high |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 212.23.222.198 | unknown | unknown | 12329 | TMRDE | true |
| Joe Sandbox version: | 41.0.0 Charoite |
| Analysis ID: | 1585875 |
| Start date and time: | 2025-01-08 12:29:18 +01:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 7m 55s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 12 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | Payment-Order #24560274 for 8,380 USD.exe |
| Detection: | MAL |
| Classification: | mal100.troj.evad.winEXE@5/5@1/1 |
| EGA Information: |
|
| HCA Information: |
|
| Cookbook Comments: |
|
- Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
- Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
- Excluded IPs from analysis (whitelisted): 4.245.163.56, 199.232.214.172, 192.229.221.95, 13.85.23.206, 20.242.39.171, 40.69.42.241, 172.202.163.200, 4.175.87.197, 40.126.31.73, 40.126.31.69, 20.190.159.2, 40.126.31.67, 40.126.31.71, 20.190.159.4, 20.190.159.64, 20.190.159.75, 52.168.117.173, 13.107.246.45
- Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, prdv4a.aadg.msidentity.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, www.tm.v4.a.prd.aadg.akadns.net, ctldl.windowsupdate.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, ocsp.digicert.com, login.live.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, blobcollector.events.data.trafficmanager.net, sls.update.microsoft.com, azureedge-t-prod.trafficmanager.net, umwatson.events.data.microsoft.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, www.tm.lg.prod.aadmsa.trafficmanager.net
- Execution Graph export aborted for target MSBuild.exe, PID 6224 because it is empty
- Not all processes where analyzed, report is missing behavior information
- Report size exceeded maximum capacity and may have missing behavior information.
- Report size getting too big, too many NtSetInformationFile calls found.
| Time | Type | Description |
|---|---|---|
| 06:30:33 | API Interceptor | |
| 06:34:03 | API Interceptor |
⊘No context
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| s-part-0017.t-0009.t-msedge.net | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Branchlock Obfuscator | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | PureLog Stealer, RHADAMANTHYS, zgRAT | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| fp2e7a.wpc.phicdn.net | Get hash | malicious | PureLog Stealer, RHADAMANTHYS, zgRAT | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | PureLog Stealer, RHADAMANTHYS, zgRAT | Browse |
| ||
| Get hash | malicious | PureLog Stealer, RHADAMANTHYS, zgRAT | Browse |
| ||
| Get hash | malicious | AsyncRAT, GhostRat | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | FormBook | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| bg.microsoft.map.fastly.net | Get hash | malicious | PureLog Stealer, RHADAMANTHYS, zgRAT | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | BlackMoon | Browse |
| ||
| Get hash | malicious | BlackMoon | Browse |
| ||
| Get hash | malicious | PureLog Stealer, RHADAMANTHYS, zgRAT | Browse |
| ||
| Get hash | malicious | AsyncRAT | Browse |
| ||
| Get hash | malicious | Remcos | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | ValleyRAT | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| TMRDE | Get hash | malicious | Mirai | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | AsyncRAT, PureLog Stealer | Browse |
| ||
| Get hash | malicious | AsyncRAT, PureLog Stealer | Browse |
| ||
| Get hash | malicious | Quasar | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Remcos | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
|
⊘No context
⊘No context
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_msbuild.exe_8c87657e7f4436c9bc615563fd86f2ef7eb379e_833cf7ea_edbdef1e-03ce-41a2-802a-63ffe250d54f\Report.wer
Download File
| Process: | C:\Windows\SysWOW64\WerFault.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 65536 |
| Entropy (8bit): | 1.1705584023715618 |
| Encrypted: | false |
| SSDEEP: | 192:w43cOxPp0BU/KaaTHy8wdEmzuiFcOZ24IO8G:XfxyBU/Ka2SrdzuiFcOY4IO8G |
| MD5: | A1594814D31B7A853370B1085698E843 |
| SHA1: | 7879C62C83CFDFC26DF60DE6CFA8B8E54B3EF137 |
| SHA-256: | 7044460E6F452CAB095136A7B202371C77CF3DE4C82B7F57BA715C30FD610717 |
| SHA-512: | 6954E7CA347050D6C3101113540507B8F8B9E007532D2DC9CDF6EC67AC23DA92688C2C68D922F8CB31996EF9C4395D13D105E97570540B5B9B35DB86B56A348E |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Windows\SysWOW64\WerFault.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 279399 |
| Entropy (8bit): | 3.784624608667258 |
| Encrypted: | false |
| SSDEEP: | 3072:bZV8W2fPhAfZc4uEqXyHJLTgNSkX4iWNkBA:bZ0fcZc4uy1Tg4U4i/ |
| MD5: | B15413B030358E948FB838C4A3459F20 |
| SHA1: | 8402CD4B362F90389723D2E03210EDC350284EFE |
| SHA-256: | 1558EC19FE2FEF797286077B26F7ADAECAEBD07AECC6521D1F4070D2C05C8AC0 |
| SHA-512: | 6797DDF7CB31E475334800EC540207EC747FDAE92ECECBD845CAD8074B75C3E21285C449171CF2D9C878F55DE6F07CFB76CD8C14777A92DFB5DD4706784AEC4B |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Windows\SysWOW64\WerFault.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 6386 |
| Entropy (8bit): | 3.7181036902243743 |
| Encrypted: | false |
| SSDEEP: | 96:RSIU6o7wVetbj56876YZhQE/11Y5aM4UR89bA50sf/iOGm:R6l7wVeJj56876YZh4prR89bW0sf/Sm |
| MD5: | 90B724FAF2CECBF9CDE02CC40A36D9D7 |
| SHA1: | CFA5CDB21C0F73352F2F474F1D3AB9CC87CE3A41 |
| SHA-256: | BB43316B5102F143E18EB346A913C67AAADE7487A94BAEA5CED69E786E429AC2 |
| SHA-512: | 62F355EC0C7345D8DC4FCFAC51D4FD3C29ECDEC30D547846247ED461E1F607B35EB97B6BC688A8612494448B881C4F4B390BD442403B779F51B5DA605A93BA4F |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Windows\SysWOW64\WerFault.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 4733 |
| Entropy (8bit): | 4.45829516650132 |
| Encrypted: | false |
| SSDEEP: | 48:cvIwWl8zslJg77aI9V6WpW8VYmYm8M4JXWFC6+q8vNYE/mLNd:uIjf/I7X77VSJ96Kx/mLNd |
| MD5: | 00F96B83617F0986D31EEA6350C7EA6F |
| SHA1: | FD862A8A70D7DA02B34C901549B819726CFDB910 |
| SHA-256: | 90CD988C8F754DB0A53AF788BF6C8A5EA4F957120C762670FFFE30B4786C182A |
| SHA-512: | 4896F033656719EF464CE43BA7D4FF56F462F2E0B22CE73AA529EE082C623DD7FC8DE632B50180241C3C88EE48EF1C808DBE7B6CD5745E3108880C9D6570641C |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Windows\SysWOW64\WerFault.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1835008 |
| Entropy (8bit): | 4.39469109565379 |
| Encrypted: | false |
| SSDEEP: | 6144:hl4fiJoH0ncNXiUjt10qfG/gaocYGBoaUMMhA2NX4WABlBuNACOBSqa:X4vFfMYQUMM6VFYSCU |
| MD5: | 339C0F1C1CA73EB614372B742F020424 |
| SHA1: | B813D0C40DD8DB25E3628E1FBB0908155DA11562 |
| SHA-256: | 66EED41F1B8373DADA4CDA06EE2B8C725140D25500995FBFC64BE3C021EDC9E1 |
| SHA-512: | 3887082EE56215B38C4142F077C8E24790E5C28C6CDA7EB4DAEEDF3DD3CA4CDAFB52D7BFEEED9A31A38FF08AFCD1A799C408002E3869F9311036323FB593B630 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| File type: | |
| Entropy (8bit): | 6.882537072603037 |
| TrID: |
|
| File name: | Payment-Order #24560274 for 8,380 USD.exe |
| File size: | 1'461'760 bytes |
| MD5: | f19ce6f6790292bbd9b8533d33b1a46f |
| SHA1: | ce057013f389e0f2506f4cd495799d684b0be2a3 |
| SHA256: | 67afda69254336cc140c2fe7474eb6b93c27ec134b07f91a604bee1c15c9135c |
| SHA512: | f940a1551c54babc86e47722729f2bc55c7e28c61b39c69e1a7566efde04905a21ee0d8f24dcdf5f4b76599570d612987ff73c896967456d1ab21baf37bec721 |
| SSDEEP: | 24576:PAonTAWtaG9kwX2t684Bnndby1UuFLan9k5TRM7phylfihgdElUIVjDyh:PAodtaG9kS2U84B+FLan9k5TRM9zlPVj |
| TLSH: | A565BE19E3A811FCD527C674CB55A233E6B174560B21A4CB0B99C7452FB3EE26B7B302 |
| File Content Preview: | MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E......E...E...E...D...E...D...E...D/..E..BE...EJ..D...E...E...E...D...E...D...E...E...E...DD..EI..D...EI..D...E............... |
 | |
| Icon Hash: | 00928e8e8686b000 |
| Entrypoint: | 0x14006ac2c |
| Entrypoint Section: | .text |
| Digitally signed: | false |
| Imagebase: | 0x140000000 |
| Subsystem: | windows gui |
| Image File Characteristics: | EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE |
| DLL Characteristics: | HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x66E5ADB8 [Sat Sep 14 15:37:28 2024 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 6 |
| OS Version Minor: | 0 |
| File Version Major: | 6 |
| File Version Minor: | 0 |
| Subsystem Version Major: | 6 |
| Subsystem Version Minor: | 0 |
| Import Hash: | 22a65106d3d84ea74d966fa0424a5a0c |
| Instruction |
|---|
| dec eax |
| sub esp, 28h |
| call 00007F1118E8B83Ch |
| dec eax |
| add esp, 28h |
| jmp 00007F1118E8B067h |
| int3 |
| int3 |
| jmp 00007F1118E8BBB8h |
| int3 |
| int3 |
| int3 |
| dec eax |
| sub esp, 28h |
| call 00007F1118E8BBB4h |
| jmp 00007F1118E8B1F4h |
| xor eax, eax |
| dec eax |
| add esp, 28h |
| ret |
| int3 |
| int3 |
| jmp 00007F1118E8B1DCh |
| int3 |
| int3 |
| int3 |
| dec eax |
| sub esp, 28h |
| dec ebp |
| mov eax, dword ptr [ecx+38h] |
| dec eax |
| mov ecx, edx |
| dec ecx |
| mov edx, ecx |
| call 00007F1118E8B202h |
| mov eax, 00000001h |
| dec eax |
| add esp, 28h |
| ret |
| int3 |
| int3 |
| int3 |
| inc eax |
| push ebx |
| inc ebp |
| mov ebx, dword ptr [eax] |
| dec eax |
| mov ebx, edx |
| inc ecx |
| and ebx, FFFFFFF8h |
| dec esp |
| mov ecx, ecx |
| inc ecx |
| test byte ptr [eax], 00000004h |
| dec esp |
| mov edx, ecx |
| je 00007F1118E8B205h |
| inc ecx |
| mov eax, dword ptr [eax+08h] |
| dec ebp |
| arpl word ptr [eax+04h], dx |
| neg eax |
| dec esp |
| add edx, ecx |
| dec eax |
| arpl ax, cx |
| dec esp |
| and edx, ecx |
| dec ecx |
| arpl bx, ax |
| dec edx |
| mov edx, dword ptr [eax+edx] |
| dec eax |
| mov eax, dword ptr [ebx+10h] |
| mov ecx, dword ptr [eax+08h] |
| dec eax |
| mov eax, dword ptr [ebx+08h] |
| test byte ptr [ecx+eax+03h], 0000000Fh |
| je 00007F1118E8B1FDh |
| movzx eax, byte ptr [ecx+eax+03h] |
| and eax, FFFFFFF0h |
| dec esp |
| add ecx, eax |
| dec esp |
| xor ecx, edx |
| dec ecx |
| mov ecx, ecx |
| pop ebx |
| jmp 00007F1118E8B206h |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| nop word ptr [eax+eax+00000000h] |
| dec eax |
| cmp ecx, dword ptr [00000049h] |
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x17f3c0 | 0x5c | .rdata |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0x17f41c | 0xf0 | .rdata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x19c000 | 0x812c | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x18f000 | 0xcdec | .pdata |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x1a5000 | 0x5b8 | .reloc |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0x165ae0 | 0x54 | .rdata |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0x165d00 | 0x28 | .rdata |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x1659a0 | 0x140 | .rdata |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x11a000 | 0x6a0 | .rdata |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x6f188 | 0x6f200 | 16824105689e93571b28f6d652acf3f1 | False | 0.45466728768278963 | data | 6.6338226603175485 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .managed | 0x71000 | 0x77a28 | 0x77c00 | 459fe8e4d0429964edfb07e39e66b232 | False | 0.46850331093423797 | data | 6.473781869755907 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| hydrated | 0xe9000 | 0x30498 | 0x0 | d41d8cd98f00b204e9800998ecf8427e | False | 0 | empty | 0.0 | IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .rdata | 0x11a000 | 0x66c6a | 0x66e00 | 19d69919d9ea837ef6351baa0211b72d | False | 0.4881032616950182 | data | 6.702703489018048 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .data | 0x181000 | 0xd5a8 | 0x1800 | 9d5075bd44b367f703d8e922b003398a | False | 0.2294921875 | data | 3.190641782829915 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .pdata | 0x18f000 | 0xcdec | 0xce00 | 638451eb673a6cdf25f666b19f1b8bb4 | False | 0.49419751213592233 | data | 6.064103613023274 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .rsrc | 0x19c000 | 0x812c | 0x8200 | 3691b0aede7b180237704710c2d65dbb | False | 0.97109375 | data | 7.953193437636764 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .reloc | 0x1a5000 | 0x5b8 | 0x600 | adcf9b9e4d3994d1018ad464f4f1db74 | False | 0.5826822916666666 | data | 5.215191968056739 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| BINARY | 0x19c130 | 0x7a84 | data | 1.000510139012881 | ||
| RT_VERSION | 0x1a3bb4 | 0x38c | PGP symmetric key encrypted data - Plaintext or unencrypted data | 0.3579295154185022 | ||
| RT_MANIFEST | 0x1a3f40 | 0x1ea | XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators | 0.5489795918367347 |
| DLL | Import |
|---|---|
| ADVAPI32.dll | RegOpenKeyExW, RegQueryValueExW, RegSetValueExW, RegCloseKey, OpenProcessToken, LookupPrivilegeValueW, AdjustTokenPrivileges, RegEnumValueW |
| bcrypt.dll | BCryptCloseAlgorithmProvider, BCryptGenerateSymmetricKey, BCryptDestroyKey, BCryptOpenAlgorithmProvider, BCryptGenRandom |
| KERNEL32.dll | TlsFree, TlsSetValue, TlsGetValue, TlsAlloc, InitializeCriticalSectionAndSpinCount, EncodePointer, GetConsoleWindow, FreeConsole, AllocConsole, SetLastError, GetLastError, LocalFree, CloseHandle, ExitProcess, GetTickCount64, FormatMessageW, K32EnumProcessModulesEx, IsWow64Process, GetExitCodeProcess, OpenProcess, K32EnumProcesses, K32GetModuleInformation, K32GetModuleBaseNameW, K32GetModuleFileNameExW, GetProcessId, DuplicateHandle, GetCurrentProcess, CloseThreadpoolIo, GetCurrentProcessId, MultiByteToWideChar, GetStdHandle, RaiseFailFastException, GetCalendarInfoEx, CompareStringOrdinal, CompareStringEx, FindNLSStringEx, GetLocaleInfoEx, ResolveLocaleName, FindStringOrdinal, GetCurrentThread, Sleep, DeleteCriticalSection, EnterCriticalSection, SleepConditionVariableCS, LeaveCriticalSection, WakeConditionVariable, QueryPerformanceCounter, InitializeCriticalSection, InitializeConditionVariable, WaitForMultipleObjectsEx, QueryPerformanceFrequency, GetFullPathNameW, GetLongPathNameW, WideCharToMultiByte, LocalAlloc, GetConsoleOutputCP, GetProcAddress, LocaleNameToLCID, LCMapStringEx, EnumTimeFormatsEx, EnumCalendarInfoExEx, CreateFileW, CreateThreadpoolIo, StartThreadpoolIo, CancelThreadpoolIo, DeleteFileW, DeviceIoControl, ExpandEnvironmentStringsW, FindClose, FindFirstFileExW, FlushFileBuffers, FreeLibrary, GetFileAttributesExW, GetFileInformationByHandleEx, GetFileType, GetModuleFileNameW, GetOverlappedResult, LoadLibraryExW, ReadFile, SetFileInformationByHandle, SetThreadErrorMode, GetThreadPriority, SetThreadPriority, WriteFile, GetCurrentProcessorNumberEx, SetEvent, CreateEventExW, GetEnvironmentVariableW, FlushProcessWriteBuffers, WaitForSingleObjectEx, RtlVirtualUnwind, RtlCaptureContext, RtlRestoreContext, AddVectoredExceptionHandler, FlsAlloc, FlsGetValue, FlsSetValue, CreateEventW, TerminateProcess, SwitchToThread, CreateThread, GetCurrentThreadId, SuspendThread, ResumeThread, GetThreadContext, SetThreadContext, FlushInstructionCache, VirtualAlloc, VirtualProtect, VirtualFree, QueryInformationJobObject, GetModuleHandleW, GetModuleHandleExW, GetProcessAffinityMask, InitializeContext, GetEnabledXStateFeatures, SetXStateFeaturesMask, InitializeCriticalSectionEx, VirtualQuery, GetSystemTimeAsFileTime, ResetEvent, DebugBreak, WaitForSingleObject, SleepEx, GlobalMemoryStatusEx, GetSystemInfo, GetLogicalProcessorInformation, GetLogicalProcessorInformationEx, GetLargePageMinimum, VirtualUnlock, VirtualAllocExNuma, IsProcessInJob, GetNumaHighestNodeNumber, GetProcessGroupAffinity, K32GetProcessMemoryInfo, RaiseException, RtlPcToFileHeader, RtlUnwindEx, IsProcessorFeaturePresent, SetUnhandledExceptionFilter, UnhandledExceptionFilter, IsDebuggerPresent, RtlLookupFunctionEntry, InitializeSListHead |
| ole32.dll | CoGetApartmentType, CoTaskMemAlloc, CoUninitialize, CoInitializeEx, CoTaskMemFree, CoWaitForMultipleHandles |
| api-ms-win-crt-heap-l1-1-0.dll | malloc, free, _callnewh, calloc, _set_new_mode |
| api-ms-win-crt-math-l1-1-0.dll | __setusermatherr |
| api-ms-win-crt-string-l1-1-0.dll | strcmp, _stricmp, strcpy_s, strncpy_s, wcsncmp |
| api-ms-win-crt-convert-l1-1-0.dll | strtoull |
| api-ms-win-crt-runtime-l1-1-0.dll | __p___wargv, _cexit, exit, terminate, _crt_atexit, _register_onexit_function, _initialize_onexit_table, __p___argc, _exit, abort, _initterm_e, _c_exit, _register_thread_local_exe_atexit_callback, _seh_filter_exe, _set_app_type, _initterm, _configure_wide_argv, _initialize_wide_environment, _get_initial_wide_environment |
| api-ms-win-crt-stdio-l1-1-0.dll | __stdio_common_vsprintf_s, __stdio_common_vfprintf, __p__commode, _set_fmode, __stdio_common_vsscanf, __acrt_iob_func |
| api-ms-win-crt-locale-l1-1-0.dll | _configthreadlocale |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | SID | Signature | Severity | Source IP | Source Port | Dest IP | Dest Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2025-01-08T12:30:44.571447+0100 | 2859460 | ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound | 1 | 192.168.2.9 | 49705 | 212.23.222.198 | 7000 | TCP |
| 2025-01-08T12:32:09.836709+0100 | 2859459 | ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound | 1 | 192.168.2.9 | 52880 | 212.23.222.198 | 7000 | TCP |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Jan 8, 2025 12:30:24.959216118 CET | 49676 | 443 | 192.168.2.9 | 23.206.229.209 |
| Jan 8, 2025 12:30:24.959697962 CET | 49675 | 443 | 192.168.2.9 | 23.206.229.209 |
| Jan 8, 2025 12:30:25.224812031 CET | 49674 | 443 | 192.168.2.9 | 23.206.229.209 |
| Jan 8, 2025 12:30:26.568576097 CET | 49677 | 443 | 192.168.2.9 | 20.189.173.11 |
| Jan 8, 2025 12:30:33.879668951 CET | 49705 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:30:33.884488106 CET | 7000 | 49705 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:30:33.884726048 CET | 49705 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:30:34.001555920 CET | 49705 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:30:34.007337093 CET | 7000 | 49705 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:30:34.568581104 CET | 49676 | 443 | 192.168.2.9 | 23.206.229.209 |
| Jan 8, 2025 12:30:34.568586111 CET | 49675 | 443 | 192.168.2.9 | 23.206.229.209 |
| Jan 8, 2025 12:30:34.834148884 CET | 49674 | 443 | 192.168.2.9 | 23.206.229.209 |
| Jan 8, 2025 12:30:36.470118046 CET | 443 | 49704 | 23.206.229.209 | 192.168.2.9 |
| Jan 8, 2025 12:30:36.470308065 CET | 49704 | 443 | 192.168.2.9 | 23.206.229.209 |
| Jan 8, 2025 12:30:44.571446896 CET | 49705 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:30:44.576209068 CET | 7000 | 49705 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:30:55.162787914 CET | 49705 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:30:55.167644024 CET | 7000 | 49705 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:30:55.251075983 CET | 7000 | 49705 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:30:55.251151085 CET | 49705 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:30:55.928132057 CET | 49705 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:30:55.928993940 CET | 49712 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:30:55.932950974 CET | 7000 | 49705 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:30:55.933800936 CET | 7000 | 49712 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:30:55.933898926 CET | 49712 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:30:55.957762957 CET | 49712 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:30:55.962589979 CET | 7000 | 49712 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:30:59.983284950 CET | 52736 | 53 | 192.168.2.9 | 162.159.36.2 |
| Jan 8, 2025 12:30:59.988101959 CET | 53 | 52736 | 162.159.36.2 | 192.168.2.9 |
| Jan 8, 2025 12:30:59.988188028 CET | 52736 | 53 | 192.168.2.9 | 162.159.36.2 |
| Jan 8, 2025 12:30:59.988259077 CET | 52736 | 53 | 192.168.2.9 | 162.159.36.2 |
| Jan 8, 2025 12:30:59.993037939 CET | 53 | 52736 | 162.159.36.2 | 192.168.2.9 |
| Jan 8, 2025 12:31:00.450556993 CET | 53 | 52736 | 162.159.36.2 | 192.168.2.9 |
| Jan 8, 2025 12:31:00.490413904 CET | 52736 | 53 | 192.168.2.9 | 162.159.36.2 |
| Jan 8, 2025 12:31:00.738907099 CET | 52736 | 53 | 192.168.2.9 | 162.159.36.2 |
| Jan 8, 2025 12:31:00.743887901 CET | 53 | 52736 | 162.159.36.2 | 192.168.2.9 |
| Jan 8, 2025 12:31:00.743949890 CET | 52736 | 53 | 192.168.2.9 | 162.159.36.2 |
| Jan 8, 2025 12:31:06.193911076 CET | 49712 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:31:06.198697090 CET | 7000 | 49712 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:31:16.444004059 CET | 49712 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:31:16.448872089 CET | 7000 | 49712 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:31:17.318567991 CET | 7000 | 49712 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:31:17.318706989 CET | 49712 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:31:18.802973032 CET | 49712 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:31:18.803575993 CET | 52741 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:31:18.807804108 CET | 7000 | 49712 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:31:18.808418989 CET | 7000 | 52741 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:31:18.808507919 CET | 52741 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:31:18.832483053 CET | 52741 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:31:18.837272882 CET | 7000 | 52741 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:31:31.240783930 CET | 52741 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:31:31.245831013 CET | 7000 | 52741 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:31:40.175231934 CET | 7000 | 52741 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:31:40.175306082 CET | 52741 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:31:42.878282070 CET | 52741 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:31:42.880913019 CET | 52743 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:31:42.883155107 CET | 7000 | 52741 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:31:42.885740042 CET | 7000 | 52743 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:31:42.885817051 CET | 52743 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:31:42.917424917 CET | 52743 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:31:42.922298908 CET | 7000 | 52743 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:31:43.209418058 CET | 52743 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:31:43.214243889 CET | 7000 | 52743 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:31:43.357990026 CET | 52743 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:31:43.362837076 CET | 7000 | 52743 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:31:44.543999910 CET | 52743 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:31:44.548844099 CET | 7000 | 52743 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:31:48.498982906 CET | 52743 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:31:48.503760099 CET | 7000 | 52743 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:31:49.180511951 CET | 52743 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:31:49.185298920 CET | 7000 | 52743 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:31:49.405648947 CET | 52743 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:31:49.410550117 CET | 7000 | 52743 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:31:51.359107971 CET | 52743 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:31:51.363893032 CET | 7000 | 52743 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:31:51.539068937 CET | 52743 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:31:51.543872118 CET | 7000 | 52743 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:31:52.969865084 CET | 52743 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:31:52.974695921 CET | 7000 | 52743 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:31:54.212892056 CET | 52743 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:31:54.217814922 CET | 7000 | 52743 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:31:54.258889914 CET | 52743 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:31:54.263696909 CET | 7000 | 52743 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:31:55.667860985 CET | 52743 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:31:55.672738075 CET | 7000 | 52743 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:31:57.208657980 CET | 52743 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:31:57.213484049 CET | 7000 | 52743 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:31:58.310005903 CET | 52743 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:31:58.314917088 CET | 7000 | 52743 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:31:58.428193092 CET | 52743 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:31:58.433062077 CET | 7000 | 52743 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:31:59.667752028 CET | 52743 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:31:59.672586918 CET | 7000 | 52743 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:00.760358095 CET | 52743 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:00.765157938 CET | 7000 | 52743 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:00.841804981 CET | 52743 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:00.846858978 CET | 7000 | 52743 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:02.071743965 CET | 52743 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:02.076657057 CET | 7000 | 52743 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:02.160181999 CET | 52743 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:02.164995909 CET | 7000 | 52743 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:03.282905102 CET | 52743 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:03.287693024 CET | 7000 | 52743 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:03.515319109 CET | 52743 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:03.520159960 CET | 7000 | 52743 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:03.713530064 CET | 52743 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:03.718374968 CET | 7000 | 52743 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:04.253998041 CET | 7000 | 52743 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:04.256294012 CET | 52743 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:04.741403103 CET | 52743 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:04.742286921 CET | 52880 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:04.746159077 CET | 7000 | 52743 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:04.747122049 CET | 7000 | 52880 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:04.747195005 CET | 52880 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:04.888700962 CET | 52880 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:04.893589020 CET | 7000 | 52880 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:07.753523111 CET | 52880 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:07.758337975 CET | 7000 | 52880 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:08.405492067 CET | 52880 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:08.410250902 CET | 7000 | 52880 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:09.796969891 CET | 52880 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:09.801911116 CET | 7000 | 52880 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:09.836709023 CET | 52880 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:09.841517925 CET | 7000 | 52880 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:10.032489061 CET | 52880 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:10.037271023 CET | 7000 | 52880 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:10.062860966 CET | 52880 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:10.067693949 CET | 7000 | 52880 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:10.129153967 CET | 52880 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:10.133965015 CET | 7000 | 52880 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:11.582779884 CET | 52880 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:11.587583065 CET | 7000 | 52880 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:11.751552105 CET | 52880 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:11.756412029 CET | 7000 | 52880 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:11.860374928 CET | 52880 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:11.865168095 CET | 7000 | 52880 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:12.442210913 CET | 52880 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:12.446954966 CET | 7000 | 52880 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:12.810456991 CET | 52880 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:12.815274000 CET | 7000 | 52880 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:13.440227985 CET | 52880 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:13.557701111 CET | 7000 | 52880 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:14.007711887 CET | 52880 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:14.012846947 CET | 7000 | 52880 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:14.012898922 CET | 52880 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:14.018121958 CET | 7000 | 52880 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:14.421849966 CET | 52880 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:14.429228067 CET | 7000 | 52880 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:14.606235981 CET | 52880 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:14.611109018 CET | 7000 | 52880 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:16.004561901 CET | 52880 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:16.009371042 CET | 7000 | 52880 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:16.070910931 CET | 52880 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:16.075795889 CET | 7000 | 52880 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:16.594610929 CET | 52880 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:16.599499941 CET | 7000 | 52880 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:17.849533081 CET | 52880 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:17.854418993 CET | 7000 | 52880 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:18.401660919 CET | 52880 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:18.409389019 CET | 7000 | 52880 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:18.651658058 CET | 52880 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:18.656497002 CET | 7000 | 52880 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:19.235100985 CET | 52880 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:19.240000010 CET | 7000 | 52880 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:19.354571104 CET | 52880 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:19.359566927 CET | 7000 | 52880 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:19.411915064 CET | 52880 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:19.416781902 CET | 7000 | 52880 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:19.449594975 CET | 52880 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:19.454520941 CET | 7000 | 52880 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:19.547051907 CET | 52880 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:19.551933050 CET | 7000 | 52880 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:19.728564024 CET | 52880 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:19.733465910 CET | 7000 | 52880 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:19.920231104 CET | 52880 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:19.925136089 CET | 7000 | 52880 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:20.117825985 CET | 52880 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:20.122685909 CET | 7000 | 52880 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:20.230923891 CET | 52880 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:20.235809088 CET | 7000 | 52880 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:20.362448931 CET | 52880 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:20.367301941 CET | 7000 | 52880 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:20.859937906 CET | 52880 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:20.864767075 CET | 7000 | 52880 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:21.552659988 CET | 52880 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:21.557432890 CET | 7000 | 52880 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:21.639878988 CET | 52880 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:21.644607067 CET | 7000 | 52880 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:21.707216978 CET | 52880 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:21.712229013 CET | 7000 | 52880 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:22.060162067 CET | 52880 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:22.064938068 CET | 7000 | 52880 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:24.223192930 CET | 52880 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:24.227969885 CET | 7000 | 52880 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:24.715359926 CET | 52880 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:24.720171928 CET | 7000 | 52880 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:25.426917076 CET | 52880 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:25.431688070 CET | 7000 | 52880 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:25.869055033 CET | 52880 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:25.873876095 CET | 7000 | 52880 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:26.071788073 CET | 52880 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:26.076584101 CET | 7000 | 52880 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:26.096945047 CET | 52880 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:26.101763010 CET | 7000 | 52880 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:26.143121004 CET | 7000 | 52880 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:26.143197060 CET | 52880 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:31.084211111 CET | 52880 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:31.085441113 CET | 53009 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:31.089199066 CET | 7000 | 52880 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:31.090318918 CET | 7000 | 53009 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:31.090394020 CET | 53009 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:31.129831076 CET | 53009 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:31.134685040 CET | 7000 | 53009 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:33.985735893 CET | 53009 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:33.990634918 CET | 7000 | 53009 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:34.042970896 CET | 53009 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:34.047909021 CET | 7000 | 53009 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:34.293309927 CET | 53009 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:34.298201084 CET | 7000 | 53009 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:34.531900883 CET | 53009 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:34.536861897 CET | 7000 | 53009 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:34.553698063 CET | 53009 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:34.558615923 CET | 7000 | 53009 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:34.604895115 CET | 53009 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:34.609755039 CET | 7000 | 53009 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:37.098406076 CET | 53009 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:37.103318930 CET | 7000 | 53009 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:37.418936968 CET | 53009 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:37.425367117 CET | 7000 | 53009 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:38.810987949 CET | 53009 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:38.815881014 CET | 7000 | 53009 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:38.850056887 CET | 53009 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:38.854990959 CET | 7000 | 53009 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:38.895117998 CET | 53009 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:38.901652098 CET | 7000 | 53009 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:39.367816925 CET | 53009 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:39.372708082 CET | 7000 | 53009 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:39.393095970 CET | 53009 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:39.398014069 CET | 7000 | 53009 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:39.424001932 CET | 53009 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:39.429502964 CET | 7000 | 53009 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:40.796758890 CET | 53009 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:40.801641941 CET | 7000 | 53009 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:40.820280075 CET | 53009 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:40.825074911 CET | 7000 | 53009 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:40.891112089 CET | 53009 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:40.896008968 CET | 7000 | 53009 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:41.263784885 CET | 53009 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:41.268631935 CET | 7000 | 53009 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:41.284539938 CET | 53009 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:41.289458990 CET | 7000 | 53009 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:41.437890053 CET | 53009 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:41.442862034 CET | 7000 | 53009 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:41.452894926 CET | 53009 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:41.457808018 CET | 7000 | 53009 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:42.811904907 CET | 53009 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:42.816833973 CET | 7000 | 53009 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:44.783029079 CET | 53009 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:44.919584036 CET | 7000 | 53009 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:45.050352097 CET | 53009 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:45.055140972 CET | 7000 | 53009 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:45.248585939 CET | 53009 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:45.253508091 CET | 7000 | 53009 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:45.320318937 CET | 53009 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:45.325306892 CET | 7000 | 53009 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:45.337245941 CET | 53009 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:45.342123032 CET | 7000 | 53009 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:45.344367981 CET | 53009 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:45.349283934 CET | 7000 | 53009 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:47.592202902 CET | 53009 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:47.597059965 CET | 7000 | 53009 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:49.870326996 CET | 53009 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:49.875191927 CET | 7000 | 53009 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:50.835916996 CET | 53009 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:50.840775013 CET | 7000 | 53009 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:50.985805988 CET | 53009 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:50.990618944 CET | 7000 | 53009 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:51.003515005 CET | 53009 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:51.008327007 CET | 7000 | 53009 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:51.385952950 CET | 53009 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:51.391201019 CET | 7000 | 53009 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:51.428287029 CET | 53009 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:51.433202028 CET | 7000 | 53009 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:51.527560949 CET | 53009 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:51.532427073 CET | 7000 | 53009 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:51.569217920 CET | 53009 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:51.574141979 CET | 7000 | 53009 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:51.661050081 CET | 53009 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:51.745073080 CET | 7000 | 53009 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:51.745160103 CET | 53009 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:51.750053883 CET | 7000 | 53009 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:52.473458052 CET | 7000 | 53009 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:52.474240065 CET | 53009 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:52.849857092 CET | 53009 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:52.852407932 CET | 53010 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:52.854744911 CET | 7000 | 53009 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:52.857330084 CET | 7000 | 53010 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:52.857388973 CET | 53010 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:52.889440060 CET | 53010 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:52.894325972 CET | 7000 | 53010 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:53.036459923 CET | 53010 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:53.041361094 CET | 7000 | 53010 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:53.073162079 CET | 53010 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:53.078119993 CET | 7000 | 53010 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:53.318250895 CET | 53010 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:53.323045969 CET | 7000 | 53010 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:53.381333113 CET | 53010 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:53.386231899 CET | 7000 | 53010 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:53.600028038 CET | 53010 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:53.604938984 CET | 7000 | 53010 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:54.956156969 CET | 53010 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:54.961245060 CET | 7000 | 53010 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:54.979676962 CET | 53010 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:54.984510899 CET | 7000 | 53010 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:56.224930048 CET | 53010 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:56.230424881 CET | 7000 | 53010 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:56.409625053 CET | 53010 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:56.417555094 CET | 7000 | 53010 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:58.734594107 CET | 53010 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:58.739562988 CET | 7000 | 53010 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:58.757685900 CET | 53010 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:58.762605906 CET | 7000 | 53010 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:32:58.898269892 CET | 53010 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:32:58.903242111 CET | 7000 | 53010 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:00.022721052 CET | 53010 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:00.027537107 CET | 7000 | 53010 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:02.423515081 CET | 53010 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:02.428507090 CET | 7000 | 53010 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:04.386661053 CET | 53010 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:04.391638041 CET | 7000 | 53010 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:04.653678894 CET | 53010 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:04.658549070 CET | 7000 | 53010 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:04.832221031 CET | 53010 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:04.837368965 CET | 7000 | 53010 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:05.093055964 CET | 53010 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:05.097946882 CET | 7000 | 53010 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:05.140332937 CET | 53010 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:05.145153046 CET | 7000 | 53010 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:08.369867086 CET | 53010 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:08.374675035 CET | 7000 | 53010 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:09.801034927 CET | 53010 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:09.805845022 CET | 7000 | 53010 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:09.877912998 CET | 53010 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:09.882827044 CET | 7000 | 53010 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:10.251703024 CET | 53010 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:10.256515980 CET | 7000 | 53010 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:10.418582916 CET | 53010 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:10.423391104 CET | 7000 | 53010 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:11.350688934 CET | 53010 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:11.355463982 CET | 7000 | 53010 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:11.649324894 CET | 53010 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:11.654169083 CET | 7000 | 53010 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:13.158427954 CET | 53010 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:13.163197994 CET | 7000 | 53010 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:14.221990108 CET | 7000 | 53010 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:14.222055912 CET | 53010 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:14.896702051 CET | 53010 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:14.899189949 CET | 53011 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:14.901474953 CET | 7000 | 53010 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:14.904001951 CET | 7000 | 53011 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:14.904068947 CET | 53011 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:14.935858011 CET | 53011 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:14.940665007 CET | 7000 | 53011 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:15.172894955 CET | 53011 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:15.177712917 CET | 7000 | 53011 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:15.406878948 CET | 53011 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:15.411794901 CET | 7000 | 53011 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:15.798011065 CET | 53011 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:15.802870035 CET | 7000 | 53011 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:16.280585051 CET | 53011 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:16.285419941 CET | 7000 | 53011 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:16.318700075 CET | 53011 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:16.323523998 CET | 7000 | 53011 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:16.947268963 CET | 53011 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:16.952140093 CET | 7000 | 53011 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:16.953229904 CET | 53011 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:16.959573030 CET | 7000 | 53011 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:17.036242008 CET | 53011 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:17.042947054 CET | 7000 | 53011 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:17.159869909 CET | 53011 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:17.166131973 CET | 7000 | 53011 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:17.288821936 CET | 53011 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:17.295919895 CET | 7000 | 53011 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:19.018933058 CET | 53011 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:19.023760080 CET | 7000 | 53011 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:19.075922966 CET | 53011 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:19.080739021 CET | 7000 | 53011 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:20.889806032 CET | 53011 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:20.894793987 CET | 7000 | 53011 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:20.961569071 CET | 53011 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:20.966413975 CET | 7000 | 53011 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:21.121625900 CET | 53011 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:21.126491070 CET | 7000 | 53011 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:21.277781010 CET | 53011 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:21.282612085 CET | 7000 | 53011 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:21.283644915 CET | 53011 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:21.288414955 CET | 7000 | 53011 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:21.300178051 CET | 53011 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:21.304997921 CET | 7000 | 53011 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:21.333503008 CET | 53011 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:21.338376999 CET | 7000 | 53011 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:21.351181984 CET | 53011 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:21.355945110 CET | 7000 | 53011 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:21.357913971 CET | 53011 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:21.362711906 CET | 7000 | 53011 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:21.722867966 CET | 53011 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:21.727796078 CET | 7000 | 53011 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:23.154604912 CET | 53011 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:23.159373045 CET | 7000 | 53011 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:23.218204021 CET | 53011 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:23.223009109 CET | 7000 | 53011 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:23.298943996 CET | 53011 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:23.303782940 CET | 7000 | 53011 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:23.351573944 CET | 53011 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:23.356467009 CET | 7000 | 53011 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:23.366347075 CET | 53011 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:23.371191978 CET | 7000 | 53011 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:23.735888958 CET | 53011 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:23.740758896 CET | 7000 | 53011 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:25.091726065 CET | 53011 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:25.096662998 CET | 7000 | 53011 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:25.299597979 CET | 53011 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:25.304441929 CET | 7000 | 53011 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:25.746618032 CET | 53011 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:25.751497030 CET | 7000 | 53011 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:26.883829117 CET | 53011 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:26.888637066 CET | 7000 | 53011 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:26.996654987 CET | 53011 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:27.001868963 CET | 7000 | 53011 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:27.188920021 CET | 53011 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:27.193718910 CET | 7000 | 53011 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:27.282322884 CET | 53011 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:27.287195921 CET | 7000 | 53011 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:27.764529943 CET | 53011 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:27.769341946 CET | 7000 | 53011 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:28.227647066 CET | 53011 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:28.232474089 CET | 7000 | 53011 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:28.555671930 CET | 53011 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:28.560530901 CET | 7000 | 53011 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:29.241297007 CET | 53011 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:29.246201992 CET | 7000 | 53011 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:29.247114897 CET | 53011 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:29.251962900 CET | 7000 | 53011 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:29.264545918 CET | 53011 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:29.269366980 CET | 7000 | 53011 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:29.280740976 CET | 53011 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:29.285598040 CET | 7000 | 53011 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:30.178138018 CET | 53011 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:30.183018923 CET | 7000 | 53011 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:30.944922924 CET | 53011 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:30.949753046 CET | 7000 | 53011 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:30.965280056 CET | 53011 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:30.970119953 CET | 7000 | 53011 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:31.058121920 CET | 53011 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:31.063033104 CET | 7000 | 53011 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:31.222270012 CET | 53011 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:31.227144957 CET | 7000 | 53011 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:31.282844067 CET | 53011 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:31.287724972 CET | 7000 | 53011 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:31.338730097 CET | 53011 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:31.343653917 CET | 7000 | 53011 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:31.346652031 CET | 53011 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:31.351572037 CET | 7000 | 53011 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:32.355923891 CET | 53011 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:32.360754967 CET | 7000 | 53011 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:32.932374001 CET | 53011 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:32.937285900 CET | 7000 | 53011 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:33.098788977 CET | 53011 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:33.103652954 CET | 7000 | 53011 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:33.415397882 CET | 53011 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:33.420288086 CET | 7000 | 53011 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:34.998748064 CET | 53011 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:35.003592968 CET | 7000 | 53011 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:35.346869946 CET | 53011 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:35.401034117 CET | 7000 | 53011 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:36.258517981 CET | 7000 | 53011 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:36.258644104 CET | 53011 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:36.304301977 CET | 53011 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:36.304301977 CET | 53012 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:36.309175968 CET | 7000 | 53011 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:36.309191942 CET | 7000 | 53012 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:36.309381962 CET | 53012 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:36.413444996 CET | 53012 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:36.418344975 CET | 7000 | 53012 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:36.595645905 CET | 53012 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:36.601170063 CET | 7000 | 53012 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:37.685658932 CET | 53012 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:37.690453053 CET | 7000 | 53012 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:37.804780006 CET | 53012 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:37.809559107 CET | 7000 | 53012 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:38.917931080 CET | 53012 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:38.922820091 CET | 7000 | 53012 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:39.072731018 CET | 53012 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:39.077645063 CET | 7000 | 53012 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:39.804286003 CET | 53012 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:39.809231043 CET | 7000 | 53012 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:39.825320959 CET | 53012 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:39.832947969 CET | 7000 | 53012 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:39.854420900 CET | 53012 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:39.859255075 CET | 7000 | 53012 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:40.509623051 CET | 53012 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:40.514507055 CET | 7000 | 53012 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:41.712008953 CET | 53012 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:41.716877937 CET | 7000 | 53012 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:41.719518900 CET | 53012 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:41.724284887 CET | 7000 | 53012 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:41.851339102 CET | 53012 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:41.856154919 CET | 7000 | 53012 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:41.885891914 CET | 53012 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:41.890774965 CET | 7000 | 53012 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:42.918999910 CET | 53012 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:42.923835993 CET | 7000 | 53012 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:42.923892021 CET | 53012 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:42.928664923 CET | 7000 | 53012 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:42.958309889 CET | 53012 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:42.963123083 CET | 7000 | 53012 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:43.052707911 CET | 53012 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:43.057495117 CET | 7000 | 53012 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:43.168068886 CET | 53012 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:43.172980070 CET | 7000 | 53012 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:43.173463106 CET | 53012 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:43.178272963 CET | 7000 | 53012 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:43.242898941 CET | 53012 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:43.247652054 CET | 7000 | 53012 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:43.326445103 CET | 53012 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:43.331165075 CET | 7000 | 53012 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:43.687506914 CET | 53012 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:43.692382097 CET | 7000 | 53012 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:43.726304054 CET | 53012 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:33:43.731372118 CET | 7000 | 53012 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:57.681674004 CET | 7000 | 53012 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:33:57.681781054 CET | 53012 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:34:04.128559113 CET | 53012 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:34:04.133330107 CET | 53024 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:34:04.133410931 CET | 7000 | 53012 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:34:04.138225079 CET | 7000 | 53024 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:34:04.138299942 CET | 53024 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:34:04.259932995 CET | 53024 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Jan 8, 2025 12:34:04.264843941 CET | 7000 | 53024 | 212.23.222.198 | 192.168.2.9 |
| Jan 8, 2025 12:34:04.965662003 CET | 53024 | 7000 | 192.168.2.9 | 212.23.222.198 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Jan 8, 2025 12:30:59.982758999 CET | 53 | 50900 | 162.159.36.2 | 192.168.2.9 |
| Jan 8, 2025 12:31:00.749682903 CET | 56819 | 53 | 192.168.2.9 | 1.1.1.1 |
| Jan 8, 2025 12:31:00.756900072 CET | 53 | 56819 | 1.1.1.1 | 192.168.2.9 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Jan 8, 2025 12:31:00.749682903 CET | 192.168.2.9 | 1.1.1.1 | 0x6fe7 | Standard query (0) | PTR (Pointer record) | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Jan 8, 2025 12:30:45.656524897 CET | 1.1.1.1 | 192.168.2.9 | 0x79f1 | No error (0) | 199.232.214.172 | A (IP address) | IN (0x0001) | false | ||
| Jan 8, 2025 12:30:45.656524897 CET | 1.1.1.1 | 192.168.2.9 | 0x79f1 | No error (0) | 199.232.210.172 | A (IP address) | IN (0x0001) | false | ||
| Jan 8, 2025 12:30:46.147207975 CET | 1.1.1.1 | 192.168.2.9 | 0xca30 | No error (0) | fp2e7a.wpc.phicdn.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Jan 8, 2025 12:30:46.147207975 CET | 1.1.1.1 | 192.168.2.9 | 0xca30 | No error (0) | 192.229.221.95 | A (IP address) | IN (0x0001) | false | ||
| Jan 8, 2025 12:30:58.983460903 CET | 1.1.1.1 | 192.168.2.9 | 0x776c | No error (0) | fp2e7a.wpc.phicdn.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Jan 8, 2025 12:30:58.983460903 CET | 1.1.1.1 | 192.168.2.9 | 0x776c | No error (0) | 192.229.221.95 | A (IP address) | IN (0x0001) | false | ||
| Jan 8, 2025 12:31:00.756900072 CET | 1.1.1.1 | 192.168.2.9 | 0x6fe7 | Name error (3) | none | none | PTR (Pointer record) | IN (0x0001) | false | |
| Jan 8, 2025 12:31:42.084014893 CET | 1.1.1.1 | 192.168.2.9 | 0x68fb | No error (0) | s-part-0017.t-0009.t-msedge.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Jan 8, 2025 12:31:42.084014893 CET | 1.1.1.1 | 192.168.2.9 | 0x68fb | No error (0) | 13.107.246.45 | A (IP address) | IN (0x0001) | false |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
| Target ID: | 0 |
| Start time: | 06:30:29 |
| Start date: | 08/01/2025 |
| Path: | C:\Users\user\Desktop\Payment-Order #24560274 for 8,380 USD.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff7a6540000 |
| File size: | 1'461'760 bytes |
| MD5 hash: | F19CE6F6790292BBD9B8533D33B1A46F |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Reputation: | low |
| Has exited: | true |
| Target ID: | 1 |
| Start time: | 06:30:29 |
| Start date: | 08/01/2025 |
| Path: | C:\Windows\System32\conhost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff70f010000 |
| File size: | 862'208 bytes |
| MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 3 |
| Start time: | 06:30:30 |
| Start date: | 08/01/2025 |
| Path: | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0xbb0000 |
| File size: | 262'432 bytes |
| MD5 hash: | 8FDF47E0FF70C40ED3A17014AEEA4232 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Reputation: | high |
| Has exited: | true |
| Target ID: | 10 |
| Start time: | 06:33:43 |
| Start date: | 08/01/2025 |
| Path: | C:\Windows\SysWOW64\WerFault.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0xf50000 |
| File size: | 483'680 bytes |
| MD5 hash: | C31336C1EFC2CCB44B4326EA793040F2 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
Execution Graph
| Execution Coverage: | 5.5% |
| Dynamic/Decrypted Code Coverage: | 0% |
| Signature Coverage: | 24.4% |
| Total number of Nodes: | 998 |
| Total number of Limit Nodes: | 47 |
Graph
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A656D16A Relevance: 9.5, APIs: 4, Strings: 1, Instructions: 763COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A656DFD0 Relevance: .7, Instructions: 685COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A6570C50 Relevance: .3, Instructions: 317COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A656C9B6 Relevance: 16.1, APIs: 4, Strings: 5, Instructions: 393COMMON
Download Yara Rule
Control-flow Graph
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A6551010 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103COMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A654B820 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 90memoryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A6544740 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 108COMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A65454E0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 86sleepCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A6550E30 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132COMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A65AB610 Relevance: 3.0, APIs: 2, Instructions: 21COMMONLIBRARYCODE
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A6551770 Relevance: 1.3, APIs: 1, Instructions: 7COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A6551830 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81memoryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A655EFE0 Relevance: 13.4, APIs: 5, Strings: 2, Instructions: 1181threadCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A6561520 Relevance: 13.1, APIs: 8, Instructions: 1052threadCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A6546A50 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 241COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A65AB27C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A6549430 Relevance: 1.0, Instructions: 971COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A6574390 Relevance: 1.0, Instructions: 955COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A65792CE Relevance: .8, Instructions: 844COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A65788D9 Relevance: .8, Instructions: 829COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A6565200 Relevance: .6, Instructions: 629COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A65752E0 Relevance: .6, Instructions: 619COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A6575C20 Relevance: .6, Instructions: 604COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A657BEA0 Relevance: .6, Instructions: 561COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A6562D30 Relevance: .5, Instructions: 457COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A66100E0 Relevance: .4, Instructions: 428COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A657B4F0 Relevance: .4, Instructions: 424COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A6560360 Relevance: .4, Instructions: 423COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A6568200 Relevance: .4, Instructions: 414COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A6572370 Relevance: .4, Instructions: 392COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A65791B0 Relevance: .3, Instructions: 326COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A6564CD9 Relevance: .3, Instructions: 319COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A65799C3 Relevance: .3, Instructions: 304COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A65667F0 Relevance: .3, Instructions: 299COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A6577C79 Relevance: .3, Instructions: 262COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A656A420 Relevance: .3, Instructions: 258COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A65F3480 Relevance: .3, Instructions: 257COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A6573F60 Relevance: .3, Instructions: 255COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A657F280 Relevance: .3, Instructions: 254COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A657E540 Relevance: .2, Instructions: 220COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A657B180 Relevance: .2, Instructions: 218COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A657BBA0 Relevance: .2, Instructions: 212COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A65A1910 Relevance: .2, Instructions: 209COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A654A8B0 Relevance: .2, Instructions: 206COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A65483C4 Relevance: .2, Instructions: 175COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A656A850 Relevance: .2, Instructions: 171COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A661E240 Relevance: .2, Instructions: 167COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A656FB40 Relevance: .2, Instructions: 166COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A6620200 Relevance: .2, Instructions: 165COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A6563640 Relevance: .2, Instructions: 163COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A657C800 Relevance: .2, Instructions: 160COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A65FCC30 Relevance: .2, Instructions: 160COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A65580D0 Relevance: .1, Instructions: 125COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A6566610 Relevance: .1, Instructions: 123COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A6624450 Relevance: .1, Instructions: 102COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A6602AC0 Relevance: .1, Instructions: 102COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A6571470 Relevance: .1, Instructions: 71COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A6627A90 Relevance: .1, Instructions: 68COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A65CF9C0 Relevance: .0, Instructions: 46COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A65CFAA0 Relevance: .0, Instructions: 25COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A65B9FC0 Relevance: .0, Instructions: 19COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A65A90A0 Relevance: 33.4, APIs: 9, Strings: 10, Instructions: 136COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A654C1A0 Relevance: 24.1, APIs: 8, Strings: 8, Instructions: 101stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A654B3B0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 84libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A6544E90 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 83threadlibraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A6545260 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 50threadCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A6543540 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A65AC658 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF7A654D050 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 03155280 Relevance: .3, Instructions: 281COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 03155B50 Relevance: .3, Instructions: 266COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 03152CB1 Relevance: 1.3, Strings: 1, Instructions: 65COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 03156B6B Relevance: .6, Instructions: 568COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 03155275 Relevance: .3, Instructions: 278COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 03155B44 Relevance: .3, Instructions: 262COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 031508D0 Relevance: .2, Instructions: 182COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 031558C8 Relevance: .2, Instructions: 180COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 031558BC Relevance: .2, Instructions: 179COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 03152A29 Relevance: .2, Instructions: 173COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 03152A38 Relevance: .2, Instructions: 171COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 03151A08 Relevance: .1, Instructions: 145COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 03156710 Relevance: .1, Instructions: 143COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 03156F08 Relevance: .1, Instructions: 137COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 03152D88 Relevance: .1, Instructions: 121COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 031576B0 Relevance: .1, Instructions: 116COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 03156794 Relevance: .1, Instructions: 105COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 031563EC Relevance: .1, Instructions: 103COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 031508BF Relevance: .1, Instructions: 100COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 03153795 Relevance: .1, Instructions: 93COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 031537A0 Relevance: .1, Instructions: 90COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 03150A69 Relevance: .1, Instructions: 88COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 03156921 Relevance: .1, Instructions: 85COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 03151000 Relevance: .1, Instructions: 81COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 03152098 Relevance: .1, Instructions: 78COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0151D224 Relevance: .1, Instructions: 76COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 03150EE9 Relevance: .1, Instructions: 75COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 03151010 Relevance: .1, Instructions: 72COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 03150EF8 Relevance: .1, Instructions: 69COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 03151918 Relevance: .1, Instructions: 61COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 03157820 Relevance: .1, Instructions: 59COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0151D21F Relevance: .1, Instructions: 57COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 03152D78 Relevance: .1, Instructions: 54COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0315099B Relevance: .1, Instructions: 53COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 03156668 Relevance: .1, Instructions: 52COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 03157848 Relevance: .0, Instructions: 48COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0315790A Relevance: .0, Instructions: 44COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 031579A2 Relevance: .0, Instructions: 44COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 03151780 Relevance: .0, Instructions: 42COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 03151959 Relevance: .0, Instructions: 41COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 031579A8 Relevance: .0, Instructions: 41COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 03156441 Relevance: .0, Instructions: 41COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 031565E7 Relevance: .0, Instructions: 36COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 031518A8 Relevance: .0, Instructions: 35COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 03151770 Relevance: .0, Instructions: 34COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 03151996 Relevance: .0, Instructions: 28COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 031518B8 Relevance: .0, Instructions: 27COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 03151660 Relevance: .0, Instructions: 20COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 031519E3 Relevance: .0, Instructions: 11COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 03151751 Relevance: .0, Instructions: 9COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 03151297 Relevance: .0, Instructions: 8COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|