Edit tour
Windows
Analysis Report
3WQwD4Z4L7.exe
Overview
General Information
| Sample name: | 3WQwD4Z4L7.exerenamed because original name is a hash value |
| Original sample name: | 87c02aa1355d71ca57149b67e2b0a05f1e27785fe72041c81c3dbe9ece73a88b.exe |
| Analysis ID: | 1588112 |
| MD5: | d3b756ea02a2cf77ec1edc7f33f5eadd |
| SHA1: | 7ccff2288c5cf3575c08f2f5568a90eab909c868 |
| SHA256: | 87c02aa1355d71ca57149b67e2b0a05f1e27785fe72041c81c3dbe9ece73a88b |
| Tags: | AsyncRATexeuser-adrian__luca |
| Infos: |   |
 | |
Detection
XWorm
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Found malware configuration
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected AntiVM3
Yara detected XWorm
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
AV process strings found (often used to terminate AV products)
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Creates a window with clipboard capturing capabilities
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: Startup Folder File Write
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match
Classification
- System is w10x64
3WQwD4Z4L7.exe (PID: 7456 cmdline: "C:\Users\ user\Deskt op\3WQwD4Z 4L7.exe" MD5: D3B756EA02A2CF77EC1EDC7F33F5EADD) - 3WQwD4Z4L7.exe (PID: 7624 cmdline:
"C:\Users\ user\Deskt op\3WQwD4Z 4L7.exe" MD5: D3B756EA02A2CF77EC1EDC7F33F5EADD) 
WerFault.exe (PID: 2024 cmdline: C:\Windows \SysWOW64\ WerFault.e xe -u -p 7 624 -s 205 6 MD5: C31336C1EFC2CCB44B4326EA793040F2)
- cleanup
| Name | Description | Attribution | Blogpost URLs | Link |
|---|---|---|---|---|
| XWorm | Malware with wide range of capabilities ranging from RAT to ransomware. | No Attribution |
{"C2 url": ["154.39.0.150"], "Port": 5200, "Aes key": "1987", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.6"}| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| MALWARE_Win_AsyncRAT | Detects AsyncRAT | ditekSHen |
| |
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| MALWARE_Win_AsyncRAT | Detects AsyncRAT | ditekSHen |
| |
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| Click to see the 6 entries | ||||
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| rat_win_xworm_v3 | Finds XWorm (version XClient, v3) samples based on characteristic strings | Sekoia.io |
| |
| MALWARE_Win_AsyncRAT | Detects AsyncRAT | ditekSHen |
| |
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| rat_win_xworm_v3 | Finds XWorm (version XClient, v3) samples based on characteristic strings | Sekoia.io |
| |
| Click to see the 16 entries | ||||
System Summary |   |
|---|
| Source: | Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): | ||
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection | |
|---|
| Source: | Avira: | ||
| Source: | Avira: | ||
| Source: | Malware Configuration Extractor: | ||
| Source: | ReversingLabs: | ||
| Source: | Virustotal: | Perma Link | ||
| Source: | ReversingLabs: | |||
| Source: | Integrated Neural Analysis Model: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Code function: | 0_2_0709588E | |
Networking | |
|---|
| Source: | URLs: | ||
| Source: | TCP traffic: | ||
| Source: | ASN Name: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Window created: | Jump to behavior | ||
System Summary | |
|---|
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Process Stats: | ||
| Source: | Code function: | 0_2_02E8D404 | |
| Source: | Code function: | 0_2_07097780 | |
| Source: | Code function: | 0_2_07091560 | |
| Source: | Code function: | 0_2_07091128 | |
| Source: | Code function: | 0_2_070931A0 | |
| Source: | Code function: | 0_2_070931B0 | |
| Source: | Code function: | 0_2_07093B50 | |
| Source: | Code function: | 0_2_07093B60 | |
| Source: | Code function: | 0_2_070919A8 | |
| Source: | Code function: | 0_2_076096C8 | |
| Source: | Code function: | 0_2_076080A0 | |
| Source: | Code function: | 0_2_07601E7A | |
| Source: | Code function: | 0_2_07602CF8 | |
| Source: | Code function: | 0_2_07600B90 | |
| Source: | Code function: | 0_2_076096B8 | |
| Source: | Code function: | 0_2_07608688 | |
| Source: | Code function: | 0_2_07608698 | |
| Source: | Code function: | 0_2_0760A560 | |
| Source: | Code function: | 0_2_0760A570 | |
| Source: | Code function: | 0_2_07605578 | |
| Source: | Code function: | 0_2_07605588 | |
| Source: | Code function: | 0_2_07601440 | |
| Source: | Code function: | 0_2_07608348 | |
| Source: | Code function: | 0_2_07608358 | |
| Source: | Code function: | 0_2_076053A8 | |
| Source: | Code function: | 0_2_07605398 | |
| Source: | Code function: | 0_2_07605108 | |
| Source: | Code function: | 0_2_07605118 | |
| Source: | Code function: | 0_2_07600040 | |
| Source: | Code function: | 0_2_07600022 | |
| Source: | Code function: | 0_2_07608090 | |
| Source: | Code function: | 0_2_07604F00 | |
| Source: | Code function: | 0_2_07604F10 | |
| Source: | Code function: | 0_2_07609FC8 | |
| Source: | Code function: | 0_2_07609FBA | |
| Source: | Code function: | 0_2_07608E40 | |
| Source: | Code function: | 0_2_07603D08 | |
| Source: | Code function: | 0_2_07603CF8 | |
| Source: | Code function: | 0_2_07602CAD | |
| Source: | Code function: | 0_2_07602C96 | |
| Source: | Code function: | 0_2_07600B76 | |
| Source: | Code function: | 0_2_07600B3D | |
| Source: | Code function: | 0_2_07603AD8 | |
| Source: | Code function: | 0_2_07608A80 | |
| Source: | Code function: | 0_2_07608A90 | |
| Source: | Code function: | 0_2_076018D9 | |
| Source: | Code function: | 2_2_012A4538 | |
| Source: | Code function: | 2_2_012A1360 | |
| Source: | Code function: | 2_2_012A3F40 | |
| Source: | Code function: | 2_2_012A1A0B | |
| Source: | Process created: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Static PE information: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Classification label: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | Static file information: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Virustotal: | ||
| Source: | ReversingLabs: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Key value queried: | Jump to behavior | ||
| Source: | LNK file: | ||
| Source: | Window detected: | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Code function: | 0_2_02E8F2F6 | |
| Source: | Code function: | 0_2_02E8B5DE | |
| Source: | Code function: | 0_2_02E8B586 | |
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
Hooking and other Techniques for Hiding and Protection | |
|---|
| Source: | Icon embedded in binary file: | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
Malware Analysis System Evasion | |
|---|
| Source: | File source: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Process information queried: | Jump to behavior | ||
| Source: | Process queried: | Jump to behavior | ||
| Source: | Process queried: | Jump to behavior | ||
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
HIPS / PFW / Operating System Protection Evasion | |
|---|
| Source: | Memory written: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Key value queried: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
Stealing of Sensitive Information | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
Remote Access Functionality | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | 11 Windows Management Instrumentation | 2 Registry Run Keys / Startup Folder | 111 Process Injection | 11 Masquerading | OS Credential Dumping | 231 Security Software Discovery | Remote Services | 1 Archive Collected Data | 1 Encrypted Channel | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
| Credentials | Domains | Default Accounts | Scheduled Task/Job | 1 DLL Side-Loading | 2 Registry Run Keys / Startup Folder | 1 Disable or Modify Tools | LSASS Memory | 1 Process Discovery | Remote Desktop Protocol | 1 Clipboard Data | 1 Non-Standard Port | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | 1 DLL Side-Loading | 141 Virtualization/Sandbox Evasion | Security Account Manager | 141 Virtualization/Sandbox Evasion | SMB/Windows Admin Shares | Data from Network Shared Drive | 1 Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | 111 Process Injection | NTDS | 1 Application Window Discovery | Distributed Component Object Model | Input Capture | Protocol Impersonation | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | Network Logon Script | 3 Obfuscated Files or Information | LSA Secrets | 1 File and Directory Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
| Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | 2 Software Packing | Cached Domain Credentials | 13 System Information Discovery | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
| DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | 1 DLL Side-Loading | DCSync | Remote System Discovery | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 79% | Virustotal | Browse | ||
| 71% | ReversingLabs | ByteCode-MSIL.Trojan.Nekark | ||
| 100% | Avira | HEUR/AGEN.1305388 | ||
| 100% | Joe Sandbox ML |
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 100% | Avira | HEUR/AGEN.1305388 | ||
| 100% | Joe Sandbox ML | |||
| 71% | ReversingLabs | ByteCode-MSIL.Trojan.Nekark |
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | Avira URL Cloud | safe |
⊘No contacted domains info
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| true |
| unknown |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 154.39.0.150 | unknown | United States | 174 | COGENT-174US | true |
| Joe Sandbox version: | 42.0.0 Malachite |
| Analysis ID: | 1588112 |
| Start date and time: | 2025-01-10 21:30:42 +01:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 7m 34s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 11 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | 3WQwD4Z4L7.exerenamed because original name is a hash value |
| Original Sample Name: | 87c02aa1355d71ca57149b67e2b0a05f1e27785fe72041c81c3dbe9ece73a88b.exe |
| Detection: | MAL |
| Classification: | mal100.troj.evad.winEXE@4/7@0/1 |
| EGA Information: |
|
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
- Excluded IPs from analysis (whitelisted): 2.23.242.162, 20.109.210.53, 13.107.246.45, 40.126.32.140
- Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, login.live.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
- Not all processes where analyzed, report is missing behavior information
- Report size exceeded maximum capacity and may have missing behavior information.
- Report size getting too big, too many NtOpenKeyEx calls found.
- Report size getting too big, too many NtQueryValueKey calls found.
- Report size getting too big, too many NtSetInformationFile calls found.
| Time | Type | Description |
|---|---|---|
| 15:31:38 | API Interceptor | |
| 20:31:45 | Autostart |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 154.39.0.150 | Get hash | malicious | XWorm | Browse | ||
| Get hash | malicious | XWorm | Browse |
⊘No context
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| COGENT-174US | Get hash | malicious | FormBook | Browse |
| |
| Get hash | malicious | FormBook | Browse |
| ||
| Get hash | malicious | FormBook | Browse |
| ||
| Get hash | malicious | FormBook | Browse |
| ||
| Get hash | malicious | XWorm | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | FormBook | Browse |
| ||
| Get hash | malicious | FormBook | Browse |
|
⊘No context
⊘No context
| Process: | C:\Windows\SysWOW64\WerFault.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 382554 |
| Entropy (8bit): | 3.6059494461110906 |
| Encrypted: | false |
| SSDEEP: | 3072:I4gMMrb7pFxwyjUgSYpY4uEqhly+ULTgLE+WDP4iOBDaJTEtqP0:I4Eg4pY4qy+KTgwN4VqP |
| MD5: | E2A6251A9FBB9D254FE7714D15E8F800 |
| SHA1: | FC62E3A05A469D94C159E4126AE917893867FAB5 |
| SHA-256: | E8E0AB745D8A5E7E1E026A32D06BDA803A088353955426EA2EA0D17CAC94111A |
| SHA-512: | A31DDB88ECFEEB0D94E65A63419B7D837460E70059561A5AEC4EB33CF7D25AD0FBC7E3FA8AE401AA2167E297CC5AE683558947A491BEB92E9E8F77F7392EB9B6 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Windows\SysWOW64\WerFault.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 6394 |
| Entropy (8bit): | 3.725134507965786 |
| Encrypted: | false |
| SSDEEP: | 96:RSIU6o7wVetbJJA6HI80YZDQE/jjkr5aM4Ub89blbrsfSOvjm:R6l7wVeJJ+6QYZD4prb89bxrsfSO7m |
| MD5: | D7E5EA716ADFF00FA6511008478C5E13 |
| SHA1: | 67B9BD598AF0713704973B226A7C75BECF6D7B86 |
| SHA-256: | E7A30859DC97A9EC7BCD53D6C2D7078EC30FFD97ECD00FF9AB04C1B149219D43 |
| SHA-512: | 098786CF3A1BFEF05E7B1F10BF849D108E28F40900892CB8524B98EA18A300416D3C313B2E024E91E8CB79222008AE5E14D111760C974AE99E19424445A12B61 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Windows\SysWOW64\WerFault.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 4735 |
| Entropy (8bit): | 4.477430615287938 |
| Encrypted: | false |
| SSDEEP: | 48:cvIwWl8zsiJg77aI9fcWpW8VY2Ym8M4JxfFe8e+q8vswI/Dzdecd:uIjfwI7lV7VmJBeKDIbzdPd |
| MD5: | 0AA4EAB65CFEB58577B5A8849C037B73 |
| SHA1: | 7384DC36AABEAC963CC0E06802AA5D043651BC9A |
| SHA-256: | A270A7558B9A452F480DC8091C45AFE15F26BB3DCB3C05470EF25C0B539C5D75 |
| SHA-512: | 380D6CD6E7AE9C153A3B07A70DF0A587C0EAA2D1E2E203119645525BC9ECAF2F8D4B5EDA4B51E9B641C6CD64656A21CAC9617ED309AF711941E6FA0D91954F18 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Users\user\Desktop\3WQwD4Z4L7.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1216 |
| Entropy (8bit): | 5.34331486778365 |
| Encrypted: | false |
| SSDEEP: | 24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ |
| MD5: | 1330C80CAAC9A0FB172F202485E9B1E8 |
| SHA1: | 86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492 |
| SHA-256: | B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560 |
| SHA-512: | 75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2 |
| Malicious: | true |
| Reputation: | high, very likely benign file |
| Preview: |
| Process: | C:\Users\user\Desktop\3WQwD4Z4L7.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 29 |
| Entropy (8bit): | 3.598349098128234 |
| Encrypted: | false |
| SSDEEP: | 3:rRSFYJKXzovNsra:EFYJKDoWra |
| MD5: | 2C11513C4FAB02AEDEE23EC05A2EB3CC |
| SHA1: | 59177C177B2546FBD8EC7688BAD19D08D32640DE |
| SHA-256: | BCF3676333E528171EEE1055302F3863A0C89D9FFE7017EA31CF264E13C8A699 |
| SHA-512: | 08196AFA62650F1808704DCAD9918DA11175CD8792878F63E35F517B4D6CF407AC9E281D9B71A76E4CC1486CAD7079C56B74ECBEDB0A0F0DD4170FB0D30D2BAD |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Notepab.lnk
Download File
| Process: | C:\Users\user\Desktop\3WQwD4Z4L7.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 764 |
| Entropy (8bit): | 5.044090283019445 |
| Encrypted: | false |
| SSDEEP: | 12:84Dt824GQ/WCbdY//vLsFELGKmNblajAspCrHZ2l+dIQIoBmV:840GRk+oFmGbNBmAspC1C+TBm |
| MD5: | 4E9F22F31BA18B33513303C976A9C1B6 |
| SHA1: | 953F42A2E1187E417B053B080EEB8BE33906FCBE |
| SHA-256: | 151BE3C7FC04D39959794B79617AA9E2BA7F58DE8E8FD6BAE5F258E6D6D365E6 |
| SHA-512: | C534A264153D7A1929ADA9F4B3D93D10E977C9BC78712763CF626D301DE97649D6DA3ED2D28A085E7542361BD9390D7434BD75CDA8526985C74335AA4FF892DE |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\3WQwD4Z4L7.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 804352 |
| Entropy (8bit): | 7.408502987627136 |
| Encrypted: | false |
| SSDEEP: | 12288:XjlIpHtMPku+l0CPP3wS6K9oCpYh0wCylHTto7HTY6UdtIxN948dAA:XjlIhSPd+p5ftwCyZtuHQSA |
| MD5: | D3B756EA02A2CF77EC1EDC7F33F5EADD |
| SHA1: | 7CCFF2288C5CF3575C08F2F5568A90EAB909C868 |
| SHA-256: | 87C02AA1355D71CA57149B67E2B0A05F1E27785FE72041C81C3DBE9ECE73A88B |
| SHA-512: | DBC7391A9F588BC161A9CD2E868E716357C88E5CC387575AA47EEC7523F5C7460D8A85ECC9F4F08A300B5D218CF53158158FCBFE49FF3C201E4FB845480658C5 |
| Malicious: | true |
| Antivirus: |
|
| Preview: |
| File type: | |
| Entropy (8bit): | 7.408502987627136 |
| TrID: |
|
| File name: | 3WQwD4Z4L7.exe |
| File size: | 804'352 bytes |
| MD5: | d3b756ea02a2cf77ec1edc7f33f5eadd |
| SHA1: | 7ccff2288c5cf3575c08f2f5568a90eab909c868 |
| SHA256: | 87c02aa1355d71ca57149b67e2b0a05f1e27785fe72041c81c3dbe9ece73a88b |
| SHA512: | dbc7391a9f588bc161a9cd2e868e716357c88e5cc387575aa47eec7523f5c7460d8a85ecc9f4f08a300b5d218cf53158158fcbfe49ff3c201e4fb845480658c5 |
| SSDEEP: | 12288:XjlIpHtMPku+l0CPP3wS6K9oCpYh0wCylHTto7HTY6UdtIxN948dAA:XjlIhSPd+p5ftwCyZtuHQSA |
| TLSH: | 47059ED03B15A710DC6AA9348437DDBB61232A2CAC1878EA3DD97F0B7DA6303551AF47 |
| File Content Preview: | MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...J.Zg..............0.................. ........@.. ....................................@................................ |
 | |
| Icon Hash: | 2eec8e8cb683b9b1 |
| Entrypoint: | 0x4ad7e2 |
| Entrypoint Section: | .text |
| Digitally signed: | false |
| Imagebase: | 0x400000 |
| Subsystem: | windows gui |
| Image File Characteristics: | EXECUTABLE_IMAGE, 32BIT_MACHINE |
| DLL Characteristics: | DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x675A8C4A [Thu Dec 12 07:10:02 2024 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 4 |
| OS Version Minor: | 0 |
| File Version Major: | 4 |
| File Version Minor: | 0 |
| Subsystem Version Major: | 4 |
| Subsystem Version Minor: | 0 |
| Import Hash: | f34d5f2d4577ed6d9ceec516c1f5a744 |
| Instruction |
|---|
| jmp dword ptr [00402000h] |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0xad790 | 0x4f | .text |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0xae000 | 0x18a00 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0xc8000 | 0xc | .reloc |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x2000 | 0x8 | .text |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x2008 | 0x48 | .text |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| .text | 0x2000 | 0xab7e8 | 0xab800 | e5f99886d840dcfc75965c6d0a86ca02 | False | 0.8674095754373178 | data | 7.622833498923812 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .rsrc | 0xae000 | 0x18a00 | 0x18a00 | 58fd92d0203699bfea8703b25af98ecc | False | 0.14490799492385786 | data | 4.280383174499622 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .reloc | 0xc8000 | 0xc | 0x200 | e2b1294ec970c4b1aa87caeed559df2d | False | 0.044921875 | data | 0.10191042566270775 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| RT_ICON | 0xae1d8 | 0x25a8 | Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2834 x 2834 px/m | 0.2649377593360996 | ||
| RT_ICON | 0xb0780 | 0x10a8 | Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2834 x 2834 px/m | 0.3646810506566604 | ||
| RT_ICON | 0xb1828 | 0x468 | Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2834 x 2834 px/m | 0.5549645390070922 | ||
| RT_ICON | 0xb1c90 | 0x4228 | Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 2834 x 2834 px/m | 0.18115257439773264 | ||
| RT_ICON | 0xb5eb8 | 0x10828 | Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 2834 x 2834 px/m | 0.0959718443156276 | ||
| RT_GROUP_ICON | 0xc66e0 | 0x4c | data | 0.7631578947368421 | ||
| RT_GROUP_ICON | 0xc672c | 0x14 | data | 1.05 | ||
| RT_VERSION | 0xc6740 | 0x2c0 | data | 0.4616477272727273 |
| DLL | Import |
|---|---|
| mscoree.dll | _CorExeMain |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Jan 10, 2025 21:31:44.011161089 CET | 49735 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:31:44.016179085 CET | 5200 | 49735 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:31:44.016287088 CET | 49735 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:31:44.149319887 CET | 49735 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:31:44.154155970 CET | 5200 | 49735 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:31:45.434144974 CET | 5200 | 49735 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:31:45.434205055 CET | 49735 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:31:48.041424036 CET | 49735 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:31:48.042924881 CET | 49736 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:31:48.046354055 CET | 5200 | 49735 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:31:48.047763109 CET | 5200 | 49736 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:31:48.047835112 CET | 49736 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:31:48.067198992 CET | 49736 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:31:48.072124004 CET | 5200 | 49736 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:31:49.453684092 CET | 5200 | 49736 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:31:49.453772068 CET | 49736 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:31:51.900774956 CET | 49736 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:31:51.901616096 CET | 49737 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:31:51.905673981 CET | 5200 | 49736 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:31:51.906541109 CET | 5200 | 49737 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:31:51.906832933 CET | 49737 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:31:51.924295902 CET | 49737 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:31:51.929114103 CET | 5200 | 49737 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:31:53.525479078 CET | 5200 | 49737 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:31:53.525599957 CET | 49737 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:31:53.527049065 CET | 5200 | 49737 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:31:53.529503107 CET | 49737 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:31:56.041498899 CET | 49737 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:31:56.042103052 CET | 49742 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:31:56.046530962 CET | 5200 | 49737 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:31:56.047003984 CET | 5200 | 49742 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:31:56.047099113 CET | 49742 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:31:56.066231012 CET | 49742 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:31:56.071038961 CET | 5200 | 49742 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:31:57.499826908 CET | 5200 | 49742 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:31:57.499923944 CET | 49742 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:01.103250980 CET | 49742 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:01.105519056 CET | 49745 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:01.108081102 CET | 5200 | 49742 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:01.110342026 CET | 5200 | 49745 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:01.112272978 CET | 49745 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:01.178232908 CET | 49745 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:01.183057070 CET | 5200 | 49745 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:02.547163010 CET | 5200 | 49745 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:02.547323942 CET | 49745 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:05.541444063 CET | 49745 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:05.542520046 CET | 49746 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:05.546375990 CET | 5200 | 49745 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:05.547365904 CET | 5200 | 49746 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:05.547506094 CET | 49746 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:05.563922882 CET | 49746 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:05.568837881 CET | 5200 | 49746 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:06.932178974 CET | 5200 | 49746 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:06.932250023 CET | 49746 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:08.572891951 CET | 49746 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:08.573699951 CET | 49747 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:08.577804089 CET | 5200 | 49746 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:08.578502893 CET | 5200 | 49747 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:08.578847885 CET | 49747 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:08.595611095 CET | 49747 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:08.600405931 CET | 5200 | 49747 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:09.963850021 CET | 5200 | 49747 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:09.963932037 CET | 49747 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:13.182019949 CET | 49747 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:13.182813883 CET | 49748 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:13.187046051 CET | 5200 | 49747 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:13.187839031 CET | 5200 | 49748 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:13.187939882 CET | 49748 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:13.203804970 CET | 49748 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:13.208667040 CET | 5200 | 49748 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:14.621314049 CET | 5200 | 49748 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:14.621423006 CET | 49748 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:17.650960922 CET | 49748 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:17.651885033 CET | 49749 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:17.655777931 CET | 5200 | 49748 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:17.656804085 CET | 5200 | 49749 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:17.656864882 CET | 49749 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:17.674601078 CET | 49749 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:17.679466009 CET | 5200 | 49749 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:19.060883045 CET | 5200 | 49749 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:19.061078072 CET | 49749 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:21.119721889 CET | 49749 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:21.121649981 CET | 49750 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:21.124613047 CET | 5200 | 49749 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:21.126488924 CET | 5200 | 49750 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:21.126595020 CET | 49750 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:21.143192053 CET | 49750 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:21.148354053 CET | 5200 | 49750 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:22.532212019 CET | 5200 | 49750 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:22.536757946 CET | 49750 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:24.400851011 CET | 49750 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:24.401640892 CET | 49751 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:24.520332098 CET | 5200 | 49750 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:24.520347118 CET | 5200 | 49751 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:24.520488977 CET | 49751 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:24.536423922 CET | 49751 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:24.541255951 CET | 5200 | 49751 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:25.921247959 CET | 5200 | 49751 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:25.921344042 CET | 49751 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:28.010328054 CET | 49751 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:28.011024952 CET | 49752 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:28.015119076 CET | 5200 | 49751 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:28.015850067 CET | 5200 | 49752 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:28.016050100 CET | 49752 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:28.032941103 CET | 49752 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:28.037792921 CET | 5200 | 49752 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:29.401695013 CET | 5200 | 49752 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:29.406296015 CET | 49752 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:30.932188034 CET | 49752 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:30.933470011 CET | 49753 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:30.937042952 CET | 5200 | 49752 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:30.938271999 CET | 5200 | 49753 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:30.938414097 CET | 49753 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:30.954420090 CET | 49753 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:30.959347010 CET | 5200 | 49753 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:32.323044062 CET | 5200 | 49753 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:32.326189995 CET | 49753 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:32.478905916 CET | 49753 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:32.480480909 CET | 49761 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:32.483774900 CET | 5200 | 49753 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:32.485260963 CET | 5200 | 49761 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:32.488725901 CET | 49761 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:32.504719973 CET | 49761 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:32.510103941 CET | 5200 | 49761 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:33.890470982 CET | 5200 | 49761 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:33.890546083 CET | 49761 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:34.182240963 CET | 49761 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:34.183337927 CET | 49771 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:34.187077999 CET | 5200 | 49761 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:34.188170910 CET | 5200 | 49771 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:34.188245058 CET | 49771 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:34.206454992 CET | 49771 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:34.211568117 CET | 5200 | 49771 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:35.591887951 CET | 5200 | 49771 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:35.591975927 CET | 49771 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:36.151338100 CET | 49771 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:36.153182983 CET | 49778 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:36.156102896 CET | 5200 | 49771 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:36.157928944 CET | 5200 | 49778 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:36.157999039 CET | 49778 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:36.183835030 CET | 49778 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:36.188661098 CET | 5200 | 49778 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:37.574361086 CET | 5200 | 49778 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:37.574423075 CET | 49778 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:38.041418076 CET | 49778 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:38.043026924 CET | 49793 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:38.050201893 CET | 5200 | 49778 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:38.050219059 CET | 5200 | 49793 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:38.050292969 CET | 49793 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:38.070169926 CET | 49793 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:38.075005054 CET | 5200 | 49793 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:39.458796978 CET | 5200 | 49793 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:39.460273981 CET | 49793 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:39.932164907 CET | 49793 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:39.933840036 CET | 49802 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:39.936990023 CET | 5200 | 49793 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:39.938600063 CET | 5200 | 49802 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:39.938771963 CET | 49802 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:39.959117889 CET | 49802 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:39.963865995 CET | 5200 | 49802 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:41.374666929 CET | 5200 | 49802 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:41.374737978 CET | 49802 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:41.432111025 CET | 49802 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:41.433185101 CET | 49811 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:41.437050104 CET | 5200 | 49802 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:41.438044071 CET | 5200 | 49811 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:41.438188076 CET | 49811 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:41.457098007 CET | 49811 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:41.462106943 CET | 5200 | 49811 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:42.843775988 CET | 5200 | 49811 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:42.844008923 CET | 49811 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:43.228935003 CET | 49811 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:43.230901957 CET | 49822 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:43.233716965 CET | 5200 | 49811 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:43.235733032 CET | 5200 | 49822 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:43.235949039 CET | 49822 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:43.278950930 CET | 49822 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:43.283729076 CET | 5200 | 49822 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:45.168796062 CET | 5200 | 49822 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:45.169996977 CET | 5200 | 49822 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:45.170147896 CET | 49822 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:45.171040058 CET | 5200 | 49822 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:45.173346996 CET | 49822 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:45.182416916 CET | 49822 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:45.183144093 CET | 49828 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:45.187189102 CET | 5200 | 49822 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:45.188205957 CET | 5200 | 49828 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:45.188321114 CET | 49828 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:45.205343962 CET | 49828 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:45.210181952 CET | 5200 | 49828 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:46.591228008 CET | 5200 | 49828 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:46.591370106 CET | 49828 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:46.604180098 CET | 49828 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:46.605421066 CET | 49839 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:46.609038115 CET | 5200 | 49828 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:46.610213041 CET | 5200 | 49839 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:46.610481977 CET | 49839 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:46.626142979 CET | 49839 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:46.631397009 CET | 5200 | 49839 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:48.030028105 CET | 5200 | 49839 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:48.030159950 CET | 49839 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:52.635251999 CET | 49839 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:52.637691975 CET | 49876 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:52.640039921 CET | 5200 | 49839 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:52.642474890 CET | 5200 | 49876 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:52.642641068 CET | 49876 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:52.711637020 CET | 49876 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:52.716470957 CET | 5200 | 49876 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:52.732026100 CET | 49876 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:52.736859083 CET | 5200 | 49876 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:54.063539982 CET | 5200 | 49876 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:54.063900948 CET | 49876 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:58.057157993 CET | 49876 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:58.061085939 CET | 49911 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:58.179420948 CET | 5200 | 49876 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:58.179435015 CET | 5200 | 49911 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:58.179544926 CET | 49911 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:58.236435890 CET | 49911 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:58.241321087 CET | 5200 | 49911 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:58.432352066 CET | 49911 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:58.438424110 CET | 5200 | 49911 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:58.447901011 CET | 49911 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:32:58.452697039 CET | 5200 | 49911 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:59.626970053 CET | 5200 | 49911 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:32:59.629596949 CET | 49911 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:03.620196104 CET | 49911 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:03.621612072 CET | 49947 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:03.625046968 CET | 5200 | 49911 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:33:03.626480103 CET | 5200 | 49947 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:33:03.626606941 CET | 49947 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:03.739393950 CET | 49947 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:03.744200945 CET | 5200 | 49947 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:33:04.151176929 CET | 49947 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:04.156040907 CET | 5200 | 49947 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:33:04.276654959 CET | 49947 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:04.281553030 CET | 5200 | 49947 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:33:04.338567019 CET | 49947 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:04.343470097 CET | 5200 | 49947 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:33:04.354228020 CET | 49947 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:04.359163046 CET | 5200 | 49947 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:33:05.027529001 CET | 5200 | 49947 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:33:05.027843952 CET | 49947 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:09.386526108 CET | 49947 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:09.388668060 CET | 49987 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:09.391516924 CET | 5200 | 49947 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:33:09.393516064 CET | 5200 | 49987 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:33:09.394073963 CET | 49987 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:09.495548964 CET | 49987 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:09.500421047 CET | 5200 | 49987 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:33:10.777558088 CET | 5200 | 49987 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:33:10.778234959 CET | 49987 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:14.697745085 CET | 49987 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:14.700131893 CET | 50016 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:14.703356981 CET | 5200 | 49987 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:33:14.704989910 CET | 5200 | 50016 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:33:14.705302954 CET | 50016 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:14.778523922 CET | 50016 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:14.784444094 CET | 5200 | 50016 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:33:15.965953112 CET | 50016 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:15.970756054 CET | 5200 | 50016 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:33:16.125356913 CET | 5200 | 50016 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:33:16.125499964 CET | 50016 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:21.047406912 CET | 50016 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:21.054160118 CET | 5200 | 50016 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:33:21.058216095 CET | 50034 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:21.065277100 CET | 5200 | 50034 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:33:21.066226959 CET | 50034 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:21.382209063 CET | 50034 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:21.387002945 CET | 5200 | 50034 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:33:21.620060921 CET | 50034 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:21.624912977 CET | 5200 | 50034 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:33:21.791639090 CET | 50034 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:21.796417952 CET | 5200 | 50034 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:33:21.932301044 CET | 50034 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:21.937108040 CET | 5200 | 50034 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:33:21.947936058 CET | 50034 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:21.952745914 CET | 5200 | 50034 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:33:22.517956972 CET | 5200 | 50034 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:33:22.518027067 CET | 50034 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:26.948040962 CET | 50034 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:26.949774027 CET | 50035 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:26.952946901 CET | 5200 | 50034 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:33:26.954581976 CET | 5200 | 50035 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:33:26.954643965 CET | 50035 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:27.130208015 CET | 50035 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:27.494683981 CET | 50035 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:28.006429911 CET | 5200 | 50035 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:33:28.006445885 CET | 5200 | 50035 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:33:28.340679884 CET | 5200 | 50035 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:33:28.340786934 CET | 50035 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:32.197711945 CET | 50035 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:32.200546026 CET | 50036 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:32.202591896 CET | 5200 | 50035 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:33:32.205410004 CET | 5200 | 50036 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:33:32.205492020 CET | 50036 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:32.243019104 CET | 50036 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:32.425786018 CET | 5200 | 50036 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:33:33.590329885 CET | 5200 | 50036 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:33:33.594341993 CET | 50036 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:37.260366917 CET | 50036 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:37.261929035 CET | 50037 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:37.265258074 CET | 5200 | 50036 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:33:37.266757011 CET | 5200 | 50037 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:33:37.266944885 CET | 50037 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:37.509207010 CET | 50037 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:37.514170885 CET | 5200 | 50037 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:33:38.483659983 CET | 50037 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:38.488598108 CET | 5200 | 50037 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:33:38.703099012 CET | 5200 | 50037 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:33:38.703206062 CET | 50037 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:42.744846106 CET | 50037 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:42.747137070 CET | 50038 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:42.749742985 CET | 5200 | 50037 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:33:42.752026081 CET | 5200 | 50038 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:33:42.752104998 CET | 50038 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:42.791568041 CET | 50038 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:42.796659946 CET | 5200 | 50038 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:33:44.155360937 CET | 5200 | 50038 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:33:44.155431986 CET | 50038 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:47.869680882 CET | 50038 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:47.872302055 CET | 50039 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:47.876307011 CET | 5200 | 50038 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:33:47.878808975 CET | 5200 | 50039 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:33:47.880415916 CET | 50039 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:47.950103998 CET | 50039 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:47.955152035 CET | 5200 | 50039 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:33:48.166776896 CET | 50039 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:48.171663046 CET | 5200 | 50039 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:33:48.198050022 CET | 50039 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:48.203655005 CET | 5200 | 50039 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:33:48.229306936 CET | 50039 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:48.234170914 CET | 5200 | 50039 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:33:48.401272058 CET | 50039 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:48.406338930 CET | 5200 | 50039 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:33:48.416997910 CET | 50039 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:48.421924114 CET | 5200 | 50039 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:33:48.526305914 CET | 50039 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:48.531217098 CET | 5200 | 50039 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:33:48.744961977 CET | 50039 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:48.749924898 CET | 5200 | 50039 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:33:49.306372881 CET | 5200 | 50039 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:33:49.310390949 CET | 50039 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:53.744719028 CET | 50039 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:53.749638081 CET | 5200 | 50039 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:33:53.751338959 CET | 50040 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:53.756212950 CET | 5200 | 50040 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:33:53.756623030 CET | 50040 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:53.822619915 CET | 50040 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:53.827461958 CET | 5200 | 50040 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:33:55.153467894 CET | 5200 | 50040 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:33:55.153565884 CET | 50040 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:59.088536024 CET | 50040 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:59.091352940 CET | 50041 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:59.093591928 CET | 5200 | 50040 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:33:59.096318960 CET | 5200 | 50041 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:33:59.096473932 CET | 50041 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:59.234359026 CET | 50041 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:33:59.239168882 CET | 5200 | 50041 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:00.502798080 CET | 5200 | 50041 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:00.502895117 CET | 50041 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:04.494832039 CET | 50041 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:04.498440981 CET | 50042 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:04.500011921 CET | 5200 | 50041 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:04.503384113 CET | 5200 | 50042 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:04.503524065 CET | 50042 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:04.539063931 CET | 50042 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:04.544166088 CET | 5200 | 50042 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:05.907906055 CET | 5200 | 50042 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:05.907984018 CET | 50042 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:09.557763100 CET | 50042 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:09.560854912 CET | 50043 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:09.562695980 CET | 5200 | 50042 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:09.565803051 CET | 5200 | 50043 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:09.565865040 CET | 50043 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:09.617470026 CET | 50043 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:09.622536898 CET | 5200 | 50043 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:09.682446957 CET | 50043 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:09.687405109 CET | 5200 | 50043 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:09.698165894 CET | 50043 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:09.703167915 CET | 5200 | 50043 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:09.745237112 CET | 50043 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:09.750250101 CET | 5200 | 50043 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:09.760574102 CET | 50043 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:09.765655994 CET | 5200 | 50043 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:09.791708946 CET | 50043 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:09.796670914 CET | 5200 | 50043 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:10.026264906 CET | 50043 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:10.031244040 CET | 5200 | 50043 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:10.041810036 CET | 50043 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:10.046710968 CET | 5200 | 50043 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:10.950778961 CET | 5200 | 50043 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:10.950902939 CET | 50043 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:15.166861057 CET | 50043 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:15.168653965 CET | 50044 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:15.171674013 CET | 5200 | 50043 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:15.174727917 CET | 5200 | 50044 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:15.174797058 CET | 50044 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:15.218893051 CET | 50044 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:15.225169897 CET | 5200 | 50044 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:15.260720968 CET | 50044 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:15.265599966 CET | 5200 | 50044 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:15.276462078 CET | 50044 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:15.281330109 CET | 5200 | 50044 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:16.595428944 CET | 5200 | 50044 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:16.595513105 CET | 50044 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:20.291594982 CET | 50044 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:20.293189049 CET | 50045 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:20.296386003 CET | 5200 | 50044 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:20.298103094 CET | 5200 | 50045 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:20.298238993 CET | 50045 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:20.383816004 CET | 50045 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:20.388993979 CET | 5200 | 50045 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:20.573107004 CET | 50045 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:20.578025103 CET | 5200 | 50045 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:21.741364002 CET | 5200 | 50045 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:21.741457939 CET | 50045 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:25.620029926 CET | 50045 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:25.623269081 CET | 50046 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:25.624893904 CET | 5200 | 50045 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:25.628149033 CET | 5200 | 50046 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:25.628211975 CET | 50046 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:25.672350883 CET | 50046 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:25.677239895 CET | 5200 | 50046 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:25.729566097 CET | 50046 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:25.734471083 CET | 5200 | 50046 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:27.033001900 CET | 5200 | 50046 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:27.033107996 CET | 50046 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:31.104214907 CET | 50046 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:31.105273962 CET | 50047 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:31.109148026 CET | 5200 | 50046 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:31.110116005 CET | 5200 | 50047 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:31.110282898 CET | 50047 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:31.155270100 CET | 50047 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:31.160381079 CET | 5200 | 50047 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:32.528989077 CET | 5200 | 50047 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:32.530479908 CET | 50047 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:36.292380095 CET | 50047 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:36.293792963 CET | 50048 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:36.297277927 CET | 5200 | 50047 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:36.298713923 CET | 5200 | 50048 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:36.298952103 CET | 50048 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:36.404750109 CET | 50048 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:36.409630060 CET | 5200 | 50048 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:37.705462933 CET | 5200 | 50048 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:37.705518961 CET | 50048 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:41.511147976 CET | 50048 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:41.512679100 CET | 50049 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:41.517153025 CET | 5200 | 50048 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:41.517744064 CET | 5200 | 50049 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:41.517818928 CET | 50049 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:41.604285955 CET | 50049 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:41.609117985 CET | 5200 | 50049 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:42.182508945 CET | 50049 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:42.187433958 CET | 5200 | 50049 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:42.698420048 CET | 50049 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:42.703404903 CET | 5200 | 50049 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:42.713604927 CET | 50049 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:42.718394041 CET | 5200 | 50049 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:42.923857927 CET | 5200 | 50049 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:42.923949957 CET | 50049 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:42.926796913 CET | 50049 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:42.927934885 CET | 50050 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:42.931575060 CET | 5200 | 50049 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:42.932715893 CET | 5200 | 50050 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:42.932780981 CET | 50050 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:42.977288008 CET | 50050 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:42.982163906 CET | 5200 | 50050 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:43.057605982 CET | 50050 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:43.063196898 CET | 5200 | 50050 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:43.120388031 CET | 50050 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:43.125363111 CET | 5200 | 50050 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:43.762298107 CET | 50050 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:43.767683983 CET | 5200 | 50050 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:44.353684902 CET | 5200 | 50050 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:44.353749990 CET | 50050 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:48.279428959 CET | 50050 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:48.280863047 CET | 50051 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:48.284235954 CET | 5200 | 50050 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:48.285675049 CET | 5200 | 50051 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:48.285778999 CET | 50051 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:48.349180937 CET | 50051 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:48.353993893 CET | 5200 | 50051 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:49.739953041 CET | 5200 | 50051 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:49.740046024 CET | 50051 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:53.526297092 CET | 50051 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:53.527132034 CET | 50052 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:53.531167984 CET | 5200 | 50051 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:53.532006025 CET | 5200 | 50052 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:53.532191038 CET | 50052 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:53.662319899 CET | 50052 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:53.667176962 CET | 5200 | 50052 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:54.919994116 CET | 5200 | 50052 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:54.920073032 CET | 50052 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:58.714576960 CET | 50052 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:58.718647003 CET | 50053 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:58.719400883 CET | 5200 | 50052 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:58.723459005 CET | 5200 | 50053 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:34:58.723536968 CET | 50053 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:58.760118008 CET | 50053 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:34:58.764904976 CET | 5200 | 50053 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:35:00.128449917 CET | 5200 | 50053 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:35:00.130398989 CET | 50053 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:35:04.045603037 CET | 50053 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:35:04.047445059 CET | 50054 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:35:04.053936958 CET | 5200 | 50053 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:35:04.053953886 CET | 5200 | 50054 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:35:04.054078102 CET | 50054 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:35:04.225145102 CET | 50054 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:35:04.233359098 CET | 5200 | 50054 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:35:05.451806068 CET | 5200 | 50054 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:35:05.451889992 CET | 50054 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:35:09.458354950 CET | 50054 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:35:09.463299990 CET | 5200 | 50054 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:35:09.492197990 CET | 50055 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:35:09.497096062 CET | 5200 | 50055 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:35:09.497199059 CET | 50055 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:35:09.687170029 CET | 50055 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:35:09.692003012 CET | 5200 | 50055 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:35:10.891172886 CET | 5200 | 50055 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:35:10.891232014 CET | 50055 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:35:14.791743040 CET | 50055 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:35:14.795219898 CET | 50056 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:35:14.796597004 CET | 5200 | 50055 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:35:14.800081015 CET | 5200 | 50056 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:35:14.800158024 CET | 50056 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:35:14.852298021 CET | 50056 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:35:14.857227087 CET | 5200 | 50056 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:35:14.901259899 CET | 50056 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:35:14.906065941 CET | 5200 | 50056 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:35:15.057673931 CET | 50056 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:35:15.062655926 CET | 5200 | 50056 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:35:16.205010891 CET | 5200 | 50056 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:35:16.205118895 CET | 50056 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:35:20.057394981 CET | 50056 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:35:20.058852911 CET | 50057 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:35:20.062184095 CET | 5200 | 50056 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:35:20.063673019 CET | 5200 | 50057 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:35:20.063751936 CET | 50057 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:35:20.120598078 CET | 50057 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:35:20.125478029 CET | 5200 | 50057 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:35:20.229569912 CET | 50057 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:35:20.234426975 CET | 5200 | 50057 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:35:20.649614096 CET | 50057 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:35:20.654486895 CET | 5200 | 50057 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:35:21.452459097 CET | 5200 | 50057 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:35:21.452653885 CET | 50057 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:35:25.260498047 CET | 50057 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:35:25.263823032 CET | 50058 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:35:25.265414000 CET | 5200 | 50057 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:35:25.268660069 CET | 5200 | 50058 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:35:25.268837929 CET | 50058 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:35:25.464371920 CET | 50058 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:35:25.469331026 CET | 5200 | 50058 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:35:25.620135069 CET | 50058 | 5200 | 192.168.2.4 | 154.39.0.150 |
| Jan 10, 2025 21:35:25.625199080 CET | 5200 | 50058 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:35:26.674323082 CET | 5200 | 50058 | 154.39.0.150 | 192.168.2.4 |
| Jan 10, 2025 21:35:26.674392939 CET | 50058 | 5200 | 192.168.2.4 | 154.39.0.150 |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
| Target ID: | 0 |
| Start time: | 15:31:37 |
| Start date: | 10/01/2025 |
| Path: | C:\Users\user\Desktop\3WQwD4Z4L7.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0xc50000 |
| File size: | 804'352 bytes |
| MD5 hash: | D3B756EA02A2CF77EC1EDC7F33F5EADD |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Reputation: | low |
| Has exited: | true |
| Target ID: | 2 |
| Start time: | 15:31:38 |
| Start date: | 10/01/2025 |
| Path: | C:\Users\user\Desktop\3WQwD4Z4L7.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0xbd0000 |
| File size: | 804'352 bytes |
| MD5 hash: | D3B756EA02A2CF77EC1EDC7F33F5EADD |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Reputation: | low |
| Has exited: | false |
| Target ID: | 9 |
| Start time: | 15:35:26 |
| Start date: | 10/01/2025 |
| Path: | C:\Windows\SysWOW64\WerFault.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x340000 |
| File size: | 483'680 bytes |
| MD5 hash: | C31336C1EFC2CCB44B4326EA793040F2 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | false |
Execution Graph
| Execution Coverage: | 10.6% |
| Dynamic/Decrypted Code Coverage: | 100% |
| Signature Coverage: | 2.3% |
| Total number of Nodes: | 220 |
| Total number of Limit Nodes: | 11 |
Graph
Function 07602C96 Relevance: 4.1, Strings: 3, Instructions: 317COMMON
Download Yara Rule
Control-flow Graph
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 07602CAD Relevance: 4.1, Strings: 3, Instructions: 314COMMON
Download Yara Rule
Control-flow Graph
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 07602CF8 Relevance: 4.0, Strings: 3, Instructions: 284COMMON
Download Yara Rule
Control-flow Graph
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 07600B3D Relevance: 4.0, Strings: 3, Instructions: 249COMMON
Download Yara Rule
Control-flow Graph
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 07600B76 Relevance: 4.0, Strings: 3, Instructions: 227COMMON
Download Yara Rule
Control-flow Graph
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 07600B90 Relevance: 4.0, Strings: 3, Instructions: 219COMMON
Download Yara Rule
Control-flow Graph
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 076096B8 Relevance: 2.7, Strings: 2, Instructions: 225COMMON
Download Yara Rule
Control-flow Graph
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 076096C8 Relevance: 2.7, Strings: 2, Instructions: 224COMMON
Download Yara Rule
Control-flow Graph
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 07608090 Relevance: 1.4, Strings: 1, Instructions: 179COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 076080A0 Relevance: 1.4, Strings: 1, Instructions: 176COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 07097780 Relevance: .6, Instructions: 591COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 07601E7A Relevance: .1, Instructions: 75COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0709588E Relevance: .0, Instructions: 42COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02E8AE48 Relevance: 1.7, APIs: 1, Instructions: 196COMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02E8590D Relevance: 1.6, APIs: 1, Instructions: 97COMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02E844B0 Relevance: 1.6, APIs: 1, Instructions: 96COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 07093A80 Relevance: 1.6, APIs: 1, Instructions: 65threadCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 07094140 Relevance: 1.6, APIs: 1, Instructions: 65COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02E8B830 Relevance: 1.6, APIs: 1, Instructions: 65COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 07093A88 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 07094148 Relevance: 1.6, APIs: 1, Instructions: 63COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02E8D719 Relevance: 1.6, APIs: 1, Instructions: 62COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 07093F93 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 07607CC0 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 07607CB8 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 07093F98 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 070939D0 Relevance: 1.6, APIs: 1, Instructions: 52threadCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 070939D8 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 07096A08 Relevance: 1.5, APIs: 1, Instructions: 48windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0709638C Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02E8B038 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0178D3D8 Relevance: .1, Instructions: 75COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0179D01C Relevance: .1, Instructions: 72COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0179D1D4 Relevance: .1, Instructions: 72COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0178D3D3 Relevance: .1, Instructions: 56COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0179D1CF Relevance: .1, Instructions: 53COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0179D017 Relevance: .1, Instructions: 53COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0760A570 Relevance: 1.6, Strings: 1, Instructions: 325COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0760A560 Relevance: 1.6, Strings: 1, Instructions: 324COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 07603AD8 Relevance: 1.4, Strings: 1, Instructions: 178COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 076018D9 Relevance: 1.4, Strings: 1, Instructions: 175COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 07608688 Relevance: 1.4, Strings: 1, Instructions: 149COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 07608698 Relevance: 1.4, Strings: 1, Instructions: 149COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 07601440 Relevance: 1.4, Strings: 1, Instructions: 138COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 07608A90 Relevance: 1.4, Strings: 1, Instructions: 123COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 07608A80 Relevance: 1.4, Strings: 1, Instructions: 122COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 07605588 Relevance: 1.4, Strings: 1, Instructions: 114COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 07605578 Relevance: 1.4, Strings: 1, Instructions: 107COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 07091560 Relevance: .3, Instructions: 319COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 07091128 Relevance: .3, Instructions: 314COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 07093B60 Relevance: .3, Instructions: 312COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 070919A8 Relevance: .3, Instructions: 312COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 070931B0 Relevance: .3, Instructions: 312COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02E8D404 Relevance: .3, Instructions: 264COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 07609FC8 Relevance: .3, Instructions: 254COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 07609FBA Relevance: .3, Instructions: 252COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 07603CF8 Relevance: .2, Instructions: 202COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 07603D08 Relevance: .2, Instructions: 196COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 07608E40 Relevance: .2, Instructions: 188COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 07605118 Relevance: .2, Instructions: 173COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 07605108 Relevance: .2, Instructions: 170COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 07604F00 Relevance: .1, Instructions: 145COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 07093B50 Relevance: .1, Instructions: 133COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 070931A0 Relevance: .1, Instructions: 132COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 07608348 Relevance: .1, Instructions: 110COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 076053A8 Relevance: .1, Instructions: 108COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 07608358 Relevance: .1, Instructions: 106COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 07605398 Relevance: .1, Instructions: 106COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 07604F10 Relevance: .1, Instructions: 101COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 07600022 Relevance: .1, Instructions: 71COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 07600040 Relevance: .1, Instructions: 59COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Execution Graph
| Execution Coverage: | 6.7% |
| Dynamic/Decrypted Code Coverage: | 100% |
| Signature Coverage: | 0% |
| Total number of Nodes: | 14 |
| Total number of Limit Nodes: | 2 |
Graph
Function 012AAB2F Relevance: 6.3, APIs: 4, Instructions: 276COMMON
Download Yara Rule
Control-flow Graph
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 012AAD60 Relevance: 6.1, APIs: 4, Instructions: 131threadCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 012AAD70 Relevance: 6.1, APIs: 4, Instructions: 128threadCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 012AAFB8 Relevance: 1.6, APIs: 1, Instructions: 62COMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 012AAFB0 Relevance: 1.6, APIs: 1, Instructions: 62COMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 012A5C58 Relevance: 1.6, APIs: 1, Instructions: 59COMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 012A5C60 Relevance: 1.6, APIs: 1, Instructions: 58COMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 011FD428 Relevance: .1, Instructions: 75COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0120D2B4 Relevance: .1, Instructions: 72COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0120D0FC Relevance: .1, Instructions: 72COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0120D01C Relevance: .1, Instructions: 71COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 011FD423 Relevance: .1, Instructions: 56COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0120D0F7 Relevance: .1, Instructions: 53COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0120D2AF Relevance: .1, Instructions: 53COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0120D017 Relevance: .1, Instructions: 52COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|