Edit tour
Windows
Analysis Report
lrw6UNGsUC.exe
Overview
General Information
| Sample name: | lrw6UNGsUC.exerenamed because original name is a hash value |
| Original sample name: | 0e2ab563262e27e9095c4c1e055d25974c7f8d767de7d97d8943306268a54d33.exe |
| Analysis ID: | 1588989 |
| MD5: | eb23d50af27df1288faf92898cccc3d3 |
| SHA1: | f82e28701d256af04e7728c19dd5329dd23760f2 |
| SHA256: | 0e2ab563262e27e9095c4c1e055d25974c7f8d767de7d97d8943306268a54d33 |
| Tags: | AsyncRATexeuser-adrian__luca |
| Infos: |  |
 | |
Detection
XWorm
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus / Scanner detection for submitted sample
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected AntiVM3
Yara detected XWorm
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Connects to a pastebin service (likely for C&C)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
AV process strings found (often used to terminate AV products)
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match
Classification
- System is w10x64
lrw6UNGsUC.exe (PID: 320 cmdline: "C:\Users\ user\Deskt op\lrw6UNG sUC.exe" MD5: EB23D50AF27DF1288FAF92898CCCC3D3) - lrw6UNGsUC.exe (PID: 6200 cmdline:
"C:\Users\ user\Deskt op\lrw6UNG sUC.exe" MD5: EB23D50AF27DF1288FAF92898CCCC3D3) - lrw6UNGsUC.exe (PID: 616 cmdline:
"C:\Users\ user\Deskt op\lrw6UNG sUC.exe" MD5: EB23D50AF27DF1288FAF92898CCCC3D3)
- cleanup
| Name | Description | Attribution | Blogpost URLs | Link |
|---|---|---|---|---|
| XWorm | Malware with wide range of capabilities ranging from RAT to ransomware. | No Attribution |
{"C2 url": ["https://pastebin.com/raw/UjEMadMV"], "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.2"}| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| MALWARE_Win_AsyncRAT | Detects AsyncRAT | ditekSHen |
| |
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| MALWARE_Win_AsyncRAT | Detects AsyncRAT | ditekSHen |
| |
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| Click to see the 2 entries | ||||
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| rat_win_xworm_v3 | Finds XWorm (version XClient, v3) samples based on characteristic strings | Sekoia.io |
| |
| MALWARE_Win_AsyncRAT | Detects AsyncRAT | ditekSHen |
| |
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| rat_win_xworm_v3 | Finds XWorm (version XClient, v3) samples based on characteristic strings | Sekoia.io |
| |
| Click to see the 10 entries | ||||
⊘No Sigma rule has matched
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2025-01-11T08:10:19.637725+0100 | 2853193 | 1 | Malware Command and Control Activity Detected | 192.168.2.5 | 49989 | 94.154.37.129 | 9071 | TCP |
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | Avira: | ||
| Source: | Malware Configuration Extractor: | ||
| Source: | Virustotal: | Perma Link | ||
| Source: | ReversingLabs: | |||
| Source: | Integrated Neural Analysis Model: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | Static PE information: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
Networking | |
|---|
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | URLs: | ||
| Source: | DNS query: | ||
| Source: | TCP traffic: | ||
| Source: | HTTP traffic detected: | ||
| Source: | IP Address: | ||
| Source: | IP Address: | ||
| Source: | ASN Name: | ||
| Source: | JA3 fingerprint: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | HTTP traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
System Summary | |
|---|
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Process Stats: | ||
| Source: | Code function: | 0_2_0174D3A4 | |
| Source: | Code function: | 0_2_03026698 | |
| Source: | Code function: | 0_2_03020006 | |
| Source: | Code function: | 0_2_03020040 | |
| Source: | Code function: | 0_2_03026688 | |
| Source: | Code function: | 0_2_0302EF28 | |
| Source: | Code function: | 0_2_0302EF38 | |
| Source: | Code function: | 0_2_0770CA4B | |
| Source: | Code function: | 0_2_07708680 | |
| Source: | Code function: | 0_2_0770B0A0 | |
| Source: | Code function: | 0_2_0770B091 | |
| Source: | Code function: | 0_2_0770EFD0 | |
| Source: | Code function: | 0_2_07708EF0 | |
| Source: | Code function: | 0_2_07708EE0 | |
| Source: | Code function: | 0_2_0770AC68 | |
| Source: | Code function: | 0_2_07708AB8 | |
| Source: | Code function: | 4_2_011C6268 | |
| Source: | Code function: | 4_2_011C6F40 | |
| Source: | Code function: | 4_2_011C90A0 | |
| Source: | Code function: | 4_2_011C0C10 | |
| Source: | Code function: | 4_2_011C5F20 | |
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Static PE information: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Static PE information: | ||
| Source: | Classification label: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | Static PE information: | ||
| Source: | Static file information: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Virustotal: | ||
| Source: | ReversingLabs: | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Key value queried: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Static PE information: | ||
| Source: | Code function: | 4_2_011C8840 | |
| Source: | Code function: | 4_2_011C58D5 | |
| Source: | Code function: | 4_2_011C13CA | |
| Source: | Code function: | 4_2_011C13DA | |
| Source: | Code function: | 4_2_011C13FA | |
| Source: | Code function: | 4_2_011C13EA | |
| Source: | Code function: | 4_2_011C7E19 | |
| Source: | Static PE information: | ||
| Source: | Registry key monitored for changes: | Jump to behavior | ||
| Source: | Registry key monitored for changes: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
Malware Analysis System Evasion | |
|---|
| Source: | File source: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Process information queried: | Jump to behavior | ||
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
HIPS / PFW / Operating System Protection Evasion | |
|---|
| Source: | Memory written: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Key value queried: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
Stealing of Sensitive Information | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
Remote Access Functionality | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | 11 Windows Management Instrumentation | 1 DLL Side-Loading | 111 Process Injection | 1 Masquerading | OS Credential Dumping | 1 Query Registry | Remote Services | 1 Archive Collected Data | 1 Web Service | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
| Credentials | Domains | Default Accounts | Scheduled Task/Job | Boot or Logon Initialization Scripts | 1 DLL Side-Loading | 1 Disable or Modify Tools | LSASS Memory | 121 Security Software Discovery | Remote Desktop Protocol | Data from Removable Media | 11 Encrypted Channel | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | Logon Script (Windows) | 131 Virtualization/Sandbox Evasion | Security Account Manager | 1 Process Discovery | SMB/Windows Admin Shares | Data from Network Shared Drive | 1 Non-Standard Port | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | 111 Process Injection | NTDS | 131 Virtualization/Sandbox Evasion | Distributed Component Object Model | Input Capture | 1 Ingress Tool Transfer | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | Network Logon Script | 2 Obfuscated Files or Information | LSA Secrets | 1 Application Window Discovery | SSH | Keylogging | 2 Non-Application Layer Protocol | Scheduled Transfer | Data Encrypted for Impact |
| Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | 2 Software Packing | Cached Domain Credentials | 13 System Information Discovery | VNC | GUI Input Capture | 13 Application Layer Protocol | Data Transfer Size Limits | Service Stop |
| DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | 1 Timestomp | DCSync | Remote System Discovery | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
| Network Trust Dependencies | Serverless | Drive-by Compromise | Container Orchestration Job | Scheduled Task/Job | Scheduled Task/Job | 1 DLL Side-Loading | Proc Filesystem | System Owner/User Discovery | Cloud Services | Credential API Hooking | Application Layer Protocol | Exfiltration Over Alternative Protocol | Defacement |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 73% | Virustotal | Browse | ||
| 75% | ReversingLabs | ByteCode-MSIL.Trojan.Remcos | ||
| 100% | Avira | HEUR/AGEN.1309499 | ||
| 100% | Joe Sandbox ML |
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| pastebin.com | 104.20.4.235 | true | false | high |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| false | high |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false | high |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 104.20.4.235 | pastebin.com | United States | 13335 | CLOUDFLARENETUS | false | |
| 94.154.37.129 | unknown | Ukraine | 12695 | DINET-ASRU | true |
| Joe Sandbox version: | 42.0.0 Malachite |
| Analysis ID: | 1588989 |
| Start date and time: | 2025-01-11 08:06:59 +01:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 7m 2s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 7 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | lrw6UNGsUC.exerenamed because original name is a hash value |
| Original Sample Name: | 0e2ab563262e27e9095c4c1e055d25974c7f8d767de7d97d8943306268a54d33.exe |
| Detection: | MAL |
| Classification: | mal100.troj.evad.winEXE@5/1@1/2 |
| EGA Information: |
|
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
- Excluded IPs from analysis (whitelisted): 184.28.90.27, 13.107.246.45, 20.109.210.53
- Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
- Report size getting too big, too many NtOpenKeyEx calls found.
- Report size getting too big, too many NtQueryValueKey calls found.
- Report size getting too big, too many NtReadVirtualMemory calls found.
| Time | Type | Description |
|---|---|---|
| 02:07:56 | API Interceptor |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 104.20.4.235 | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Njrat | Browse |
| ||
| Get hash | malicious | XWorm | Browse |
| ||
| Get hash | malicious | Remcos | Browse |
| ||
| Get hash | malicious | WSHRAT | Browse |
| ||
| 94.154.37.129 | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| pastebin.com | Get hash | malicious | AsyncRAT, StormKitty, WorldWind Stealer | Browse |
| |
| Get hash | malicious | XWorm | Browse |
| ||
| Get hash | malicious | DCRat | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | XWorm | Browse |
| ||
| Get hash | malicious | DCRat | Browse |
| ||
| Get hash | malicious | Xmrig | Browse |
| ||
| Get hash | malicious | DCRat | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| DINET-ASRU | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| CLOUDFLARENETUS | Get hash | malicious | LummaC | Browse |
| |
| Get hash | malicious | FormBook | Browse |
| ||
| Get hash | malicious | MassLogger RAT | Browse |
| ||
| Get hash | malicious | LummaC | Browse |
| ||
| Get hash | malicious | GuLoader, MassLogger RAT | Browse |
| ||
| Get hash | malicious | Snake Keylogger | Browse |
| ||
| Get hash | malicious | MassLogger RAT | Browse |
| ||
| Get hash | malicious | GuLoader, MassLogger RAT | Browse |
| ||
| Get hash | malicious | GuLoader, MassLogger RAT | Browse |
| ||
| Get hash | malicious | GuLoader, MassLogger RAT | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 3b5074b1b5d032e5620f69f9f700ff0e | Get hash | malicious | MassLogger RAT | Browse |
| |
| Get hash | malicious | GuLoader, MassLogger RAT | Browse |
| ||
| Get hash | malicious | MassLogger RAT | Browse |
| ||
| Get hash | malicious | GuLoader, MassLogger RAT | Browse |
| ||
| Get hash | malicious | GuLoader, MassLogger RAT | Browse |
| ||
| Get hash | malicious | GuLoader, MassLogger RAT | Browse |
| ||
| Get hash | malicious | AgentTesla | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | DarkTortilla, Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
|
⊘No context
| Process: | C:\Users\user\Desktop\lrw6UNGsUC.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1216 |
| Entropy (8bit): | 5.34331486778365 |
| Encrypted: | false |
| SSDEEP: | 24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ |
| MD5: | 1330C80CAAC9A0FB172F202485E9B1E8 |
| SHA1: | 86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492 |
| SHA-256: | B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560 |
| SHA-512: | 75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2 |
| Malicious: | true |
| Reputation: | high, very likely benign file |
| Preview: |
| File type: | |
| Entropy (8bit): | 7.582191095085443 |
| TrID: |
|
| File name: | lrw6UNGsUC.exe |
| File size: | 487'936 bytes |
| MD5: | eb23d50af27df1288faf92898cccc3d3 |
| SHA1: | f82e28701d256af04e7728c19dd5329dd23760f2 |
| SHA256: | 0e2ab563262e27e9095c4c1e055d25974c7f8d767de7d97d8943306268a54d33 |
| SHA512: | 70fa97b3620b569d4f304b97a3f22ea720b4dcc8007301ee0a54b3d9f901670962a08becd45b43838506d88a6b5eb4a5e4a6e43b26eb5b30202ac5f2c403c457 |
| SSDEEP: | 12288:o8PZsrAXeXzKinig6dpXnWq4U5usx+Xti:o80zKhHV4Ux |
| TLSH: | CAA4E0586696DA02C59557B91E71F2B12BB82EDEBA01E3039FD97DEBB839F100C44243 |
| File Content Preview: | MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...8.................0..h............... ........@.. ....................................@................................ |
 | |
| Icon Hash: | 00928e8e8686b000 |
| Entrypoint: | 0x4787d6 |
| Entrypoint Section: | .text |
| Digitally signed: | false |
| Imagebase: | 0x400000 |
| Subsystem: | windows gui |
| Image File Characteristics: | EXECUTABLE_IMAGE, 32BIT_MACHINE |
| DLL Characteristics: | DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE |
| Time Stamp: | 0xCCCE1A38 [Sat Nov 19 04:53:12 2078 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 4 |
| OS Version Minor: | 0 |
| File Version Major: | 4 |
| File Version Minor: | 0 |
| Subsystem Version Major: | 4 |
| Subsystem Version Minor: | 0 |
| Import Hash: | f34d5f2d4577ed6d9ceec516c1f5a744 |
| Instruction |
|---|
| jmp dword ptr [00402000h] |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| add byte ptr [eax], al |
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0x78784 | 0x4f | .text |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x7a000 | 0x5a4 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x7c000 | 0xc | .reloc |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0x76b24 | 0x70 | .text |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x2000 | 0x8 | .text |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x2008 | 0x48 | .text |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| .text | 0x2000 | 0x767dc | 0x76800 | 2ef2800a8d747ee19902434223929737 | False | 0.8756613429588608 | COM executable for DOS | 7.593770761477395 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .rsrc | 0x7a000 | 0x5a4 | 0x600 | e01fb17fc2bb4582111156b038947120 | False | 0.4205729166666667 | data | 4.0676465127493024 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .reloc | 0x7c000 | 0xc | 0x200 | 3e37d4a3a0a9c26e6b064b3e1a2e97c2 | False | 0.044921875 | data | 0.10191042566270775 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| RT_VERSION | 0x7a090 | 0x314 | data | 0.4365482233502538 | ||
| RT_MANIFEST | 0x7a3b4 | 0x1ea | XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators | 0.5489795918367347 |
| DLL | Import |
|---|---|
| mscoree.dll | _CorExeMain |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | SID | Signature | Severity | Source IP | Source Port | Dest IP | Dest Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2025-01-11T08:08:14.749663+0100 | 2855924 | ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound | 1 | 192.168.2.5 | 49709 | 94.154.37.129 | 9071 | TCP |
| 2025-01-11T08:10:19.637725+0100 | 2853193 | ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound | 1 | 192.168.2.5 | 49989 | 94.154.37.129 | 9071 | TCP |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Jan 11, 2025 08:08:01.095926046 CET | 49707 | 443 | 192.168.2.5 | 104.20.4.235 |
| Jan 11, 2025 08:08:01.095972061 CET | 443 | 49707 | 104.20.4.235 | 192.168.2.5 |
| Jan 11, 2025 08:08:01.096060991 CET | 49707 | 443 | 192.168.2.5 | 104.20.4.235 |
| Jan 11, 2025 08:08:01.102653980 CET | 49707 | 443 | 192.168.2.5 | 104.20.4.235 |
| Jan 11, 2025 08:08:01.102670908 CET | 443 | 49707 | 104.20.4.235 | 192.168.2.5 |
| Jan 11, 2025 08:08:01.582978010 CET | 443 | 49707 | 104.20.4.235 | 192.168.2.5 |
| Jan 11, 2025 08:08:01.583050966 CET | 49707 | 443 | 192.168.2.5 | 104.20.4.235 |
| Jan 11, 2025 08:08:01.588610888 CET | 49707 | 443 | 192.168.2.5 | 104.20.4.235 |
| Jan 11, 2025 08:08:01.588625908 CET | 443 | 49707 | 104.20.4.235 | 192.168.2.5 |
| Jan 11, 2025 08:08:01.588859081 CET | 443 | 49707 | 104.20.4.235 | 192.168.2.5 |
| Jan 11, 2025 08:08:01.637547016 CET | 49707 | 443 | 192.168.2.5 | 104.20.4.235 |
| Jan 11, 2025 08:08:01.662880898 CET | 49707 | 443 | 192.168.2.5 | 104.20.4.235 |
| Jan 11, 2025 08:08:01.703340054 CET | 443 | 49707 | 104.20.4.235 | 192.168.2.5 |
| Jan 11, 2025 08:08:02.147243023 CET | 443 | 49707 | 104.20.4.235 | 192.168.2.5 |
| Jan 11, 2025 08:08:02.147340059 CET | 443 | 49707 | 104.20.4.235 | 192.168.2.5 |
| Jan 11, 2025 08:08:02.147402048 CET | 49707 | 443 | 192.168.2.5 | 104.20.4.235 |
| Jan 11, 2025 08:08:02.153655052 CET | 49707 | 443 | 192.168.2.5 | 104.20.4.235 |
| Jan 11, 2025 08:08:02.283359051 CET | 49709 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:08:02.288311958 CET | 9071 | 49709 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:08:02.291452885 CET | 49709 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:08:02.803477049 CET | 49709 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:08:02.808515072 CET | 9071 | 49709 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:08:14.749663115 CET | 49709 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:08:14.754561901 CET | 9071 | 49709 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:08:23.674807072 CET | 9071 | 49709 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:08:23.674875021 CET | 49709 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:08:26.684567928 CET | 49709 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:08:26.685465097 CET | 49834 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:08:26.689423084 CET | 9071 | 49709 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:08:26.690290928 CET | 9071 | 49834 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:08:26.690368891 CET | 49834 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:08:26.719383001 CET | 49834 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:08:26.724196911 CET | 9071 | 49834 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:08:37.701613903 CET | 49834 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:08:37.706490040 CET | 9071 | 49834 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:08:48.061971903 CET | 9071 | 49834 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:08:48.062060118 CET | 49834 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:08:48.903378010 CET | 49834 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:08:48.904256105 CET | 49975 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:08:48.908318996 CET | 9071 | 49834 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:08:48.909215927 CET | 9071 | 49975 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:08:48.909292936 CET | 49975 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:08:48.952018023 CET | 49975 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:08:48.956871033 CET | 9071 | 49975 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:09:01.201359987 CET | 49975 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:09:01.206248045 CET | 9071 | 49975 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:09:10.265530109 CET | 9071 | 49975 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:09:10.265600920 CET | 49975 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:09:10.559607029 CET | 49975 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:09:10.560884953 CET | 49987 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:09:10.564507008 CET | 9071 | 49975 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:09:10.565749884 CET | 9071 | 49987 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:09:10.565834999 CET | 49987 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:09:10.604561090 CET | 49987 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:09:10.609447002 CET | 9071 | 49987 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:09:20.763154984 CET | 49987 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:09:20.767915010 CET | 9071 | 49987 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:09:20.825301886 CET | 49987 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:09:20.830089092 CET | 9071 | 49987 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:09:30.965990067 CET | 49987 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:09:30.970828056 CET | 9071 | 49987 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:09:31.075472116 CET | 49987 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:09:31.080276966 CET | 9071 | 49987 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:09:31.938508034 CET | 9071 | 49987 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:09:31.941142082 CET | 49987 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:09:36.075274944 CET | 49987 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:09:36.077033997 CET | 49988 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:09:36.080316067 CET | 9071 | 49987 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:09:36.081835985 CET | 9071 | 49988 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:09:36.081938982 CET | 49988 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:09:36.141428947 CET | 49988 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:09:36.146239042 CET | 9071 | 49988 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:09:50.216172934 CET | 49988 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:09:50.220998049 CET | 9071 | 49988 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:09:56.887777090 CET | 49988 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:09:56.892688990 CET | 9071 | 49988 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:09:56.903362989 CET | 49988 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:09:56.908169985 CET | 9071 | 49988 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:09:56.918931007 CET | 49988 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:09:56.923758984 CET | 9071 | 49988 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:09:56.997443914 CET | 49988 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:09:57.002370119 CET | 9071 | 49988 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:09:57.028368950 CET | 49988 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:09:57.033122063 CET | 9071 | 49988 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:09:57.090972900 CET | 49988 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:09:57.095738888 CET | 9071 | 49988 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:09:57.122175932 CET | 49988 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:09:57.126986980 CET | 9071 | 49988 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:09:57.247353077 CET | 49988 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:09:57.252319098 CET | 9071 | 49988 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:09:57.457034111 CET | 9071 | 49988 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:09:57.461174011 CET | 49988 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:10:02.403728962 CET | 49988 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:10:02.406725883 CET | 49989 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:10:02.449136019 CET | 9071 | 49988 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:10:02.449155092 CET | 9071 | 49989 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:10:02.449234009 CET | 49989 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:10:02.492876053 CET | 49989 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:10:02.497728109 CET | 9071 | 49989 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:10:03.169229984 CET | 49989 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:10:03.174038887 CET | 9071 | 49989 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:10:03.373013973 CET | 49989 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:10:03.378057003 CET | 9071 | 49989 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:10:08.622153997 CET | 49989 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:10:08.627078056 CET | 9071 | 49989 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:10:19.637725115 CET | 49989 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:10:19.642715931 CET | 9071 | 49989 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:10:22.856437922 CET | 49989 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:10:22.861637115 CET | 9071 | 49989 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:10:23.834918022 CET | 9071 | 49989 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:10:23.835031986 CET | 49989 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:10:23.965723038 CET | 49989 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:10:23.968411922 CET | 49990 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:10:23.970606089 CET | 9071 | 49989 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:10:23.973285913 CET | 9071 | 49990 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:10:23.974030972 CET | 49990 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:10:24.027538061 CET | 49990 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:10:24.032394886 CET | 9071 | 49990 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:10:24.450229883 CET | 49990 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:10:24.455332994 CET | 9071 | 49990 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:10:36.201654911 CET | 49990 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:10:36.206417084 CET | 9071 | 49990 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:10:39.965962887 CET | 49990 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:10:39.970927954 CET | 9071 | 49990 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:10:45.279175997 CET | 49990 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:10:45.284085035 CET | 9071 | 49990 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:10:45.350895882 CET | 9071 | 49990 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:10:45.350960016 CET | 49990 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:10:45.351460934 CET | 49990 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:10:45.353029013 CET | 49991 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:10:45.356215000 CET | 9071 | 49990 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:10:45.357883930 CET | 9071 | 49991 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:10:45.358958006 CET | 49991 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:10:45.423437119 CET | 49991 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:10:45.428363085 CET | 9071 | 49991 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:10:45.434819937 CET | 49991 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:10:45.439640999 CET | 9071 | 49991 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:10:45.497257948 CET | 49991 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:10:45.502157927 CET | 9071 | 49991 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:10:45.513025999 CET | 49991 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:10:45.517937899 CET | 9071 | 49991 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:10:45.528431892 CET | 49991 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:10:45.533432007 CET | 9071 | 49991 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:10:45.669122934 CET | 49991 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:10:45.674092054 CET | 9071 | 49991 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:10:45.700486898 CET | 49991 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:10:45.705370903 CET | 9071 | 49991 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:10:45.716300011 CET | 49991 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:10:45.721322060 CET | 9071 | 49991 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:10:45.856513023 CET | 49991 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:10:45.861499071 CET | 9071 | 49991 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:10:45.872174025 CET | 49991 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:10:45.877095938 CET | 9071 | 49991 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:10:45.887651920 CET | 49991 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:10:45.892520905 CET | 9071 | 49991 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:10:45.934674978 CET | 49991 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:10:45.939502001 CET | 9071 | 49991 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:10:45.997148991 CET | 49991 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:10:46.002032042 CET | 9071 | 49991 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:11:00.085613012 CET | 49991 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:11:00.229975939 CET | 9071 | 49991 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:11:01.356607914 CET | 49991 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:11:01.361512899 CET | 9071 | 49991 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:11:06.739324093 CET | 9071 | 49991 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:11:06.745094061 CET | 49991 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:11:06.748136044 CET | 49991 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:11:06.749109030 CET | 49992 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:11:06.752933979 CET | 9071 | 49991 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:11:06.753881931 CET | 9071 | 49992 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:11:06.756164074 CET | 49992 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:11:06.852065086 CET | 49992 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:11:06.856913090 CET | 9071 | 49992 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:11:07.107067108 CET | 49992 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:11:07.111965895 CET | 9071 | 49992 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:11:17.825826883 CET | 49992 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:11:17.830730915 CET | 9071 | 49992 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:11:28.131198883 CET | 9071 | 49992 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:11:28.131259918 CET | 49992 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:11:32.559386969 CET | 49992 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:11:32.561290026 CET | 49993 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:11:32.564189911 CET | 9071 | 49992 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:11:32.566085100 CET | 9071 | 49993 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:11:32.566226006 CET | 49993 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:11:32.641223907 CET | 49993 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:11:32.646051884 CET | 9071 | 49993 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:11:45.590966940 CET | 49993 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:11:45.595802069 CET | 9071 | 49993 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:11:50.215842962 CET | 49993 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:11:50.220725060 CET | 9071 | 49993 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:11:53.975851059 CET | 9071 | 49993 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:11:53.975951910 CET | 49993 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:11:58.168911934 CET | 49993 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:11:58.171461105 CET | 49994 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:11:58.173854113 CET | 9071 | 49993 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:11:58.176271915 CET | 9071 | 49994 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:11:58.176383018 CET | 49994 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:11:58.207715988 CET | 49994 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:11:58.212517023 CET | 9071 | 49994 | 94.154.37.129 | 192.168.2.5 |
| Jan 11, 2025 08:11:58.779361963 CET | 49994 | 9071 | 192.168.2.5 | 94.154.37.129 |
| Jan 11, 2025 08:11:58.784326077 CET | 9071 | 49994 | 94.154.37.129 | 192.168.2.5 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Jan 11, 2025 08:08:01.081582069 CET | 51658 | 53 | 192.168.2.5 | 1.1.1.1 |
| Jan 11, 2025 08:08:01.088620901 CET | 53 | 51658 | 1.1.1.1 | 192.168.2.5 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Jan 11, 2025 08:08:01.081582069 CET | 192.168.2.5 | 1.1.1.1 | 0x4f48 | Standard query (0) | A (IP address) | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Jan 11, 2025 08:08:01.088620901 CET | 1.1.1.1 | 192.168.2.5 | 0x4f48 | No error (0) | 104.20.4.235 | A (IP address) | IN (0x0001) | false | ||
| Jan 11, 2025 08:08:01.088620901 CET | 1.1.1.1 | 192.168.2.5 | 0x4f48 | No error (0) | 172.67.19.24 | A (IP address) | IN (0x0001) | false | ||
| Jan 11, 2025 08:08:01.088620901 CET | 1.1.1.1 | 192.168.2.5 | 0x4f48 | No error (0) | 104.20.3.235 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.5 | 49707 | 104.20.4.235 | 443 | 616 | C:\Users\user\Desktop\lrw6UNGsUC.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-11 07:08:01 UTC | 74 | OUT | |
| 2025-01-11 07:08:02 UTC | 388 | IN | |
| 2025-01-11 07:08:02 UTC | 24 | IN | |
| 2025-01-11 07:08:02 UTC | 5 | IN |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
| Target ID: | 0 |
| Start time: | 02:07:50 |
| Start date: | 11/01/2025 |
| Path: | C:\Users\user\Desktop\lrw6UNGsUC.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0xc60000 |
| File size: | 487'936 bytes |
| MD5 hash: | EB23D50AF27DF1288FAF92898CCCC3D3 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Reputation: | low |
| Has exited: | true |
| Target ID: | 3 |
| Start time: | 02:07:56 |
| Start date: | 11/01/2025 |
| Path: | C:\Users\user\Desktop\lrw6UNGsUC.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x1e0000 |
| File size: | 487'936 bytes |
| MD5 hash: | EB23D50AF27DF1288FAF92898CCCC3D3 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | low |
| Has exited: | true |
| Target ID: | 4 |
| Start time: | 02:07:56 |
| Start date: | 11/01/2025 |
| Path: | C:\Users\user\Desktop\lrw6UNGsUC.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0xa30000 |
| File size: | 487'936 bytes |
| MD5 hash: | EB23D50AF27DF1288FAF92898CCCC3D3 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Reputation: | low |
| Has exited: | false |
Execution Graph
| Execution Coverage: | 10.1% |
| Dynamic/Decrypted Code Coverage: | 100% |
| Signature Coverage: | 3.5% |
| Total number of Nodes: | 284 |
| Total number of Limit Nodes: | 15 |
Graph
Function 03026688 Relevance: .5, Instructions: 483COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 03026698 Relevance: .5, Instructions: 483COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0770CA4B Relevance: .1, Instructions: 137COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0174D468 Relevance: 6.1, APIs: 4, Instructions: 133threadCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0174D478 Relevance: 6.1, APIs: 4, Instructions: 128threadCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0174ADE8 Relevance: 1.7, APIs: 1, Instructions: 197COMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 030218E4 Relevance: 1.6, APIs: 1, Instructions: 120COMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 030218F0 Relevance: 1.6, APIs: 1, Instructions: 113COMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 017444B4 Relevance: 1.6, APIs: 1, Instructions: 96COMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0174590C Relevance: 1.6, APIs: 1, Instructions: 95COMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0770B4D1 Relevance: 1.6, APIs: 1, Instructions: 84memoryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0302407E Relevance: 1.6, APIs: 1, Instructions: 80COMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0770AB88 Relevance: 1.6, APIs: 1, Instructions: 73threadCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0770B683 Relevance: 1.6, APIs: 1, Instructions: 64COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0174D6B9 Relevance: 1.6, APIs: 1, Instructions: 64COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0770B688 Relevance: 1.6, APIs: 1, Instructions: 63COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0770AB90 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0174D6C0 Relevance: 1.6, APIs: 1, Instructions: 62COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0770B4D8 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0770DC50 Relevance: 1.6, APIs: 1, Instructions: 52windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0770AAD8 Relevance: 1.6, APIs: 1, Instructions: 51threadCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0770AAE0 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 07709E00 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0174AFD8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 012AD01C Relevance: .1, Instructions: 72COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 012AD1D4 Relevance: .1, Instructions: 72COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 012AD006 Relevance: .1, Instructions: 63COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 012AD1CF Relevance: .1, Instructions: 53COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0770EFD0 Relevance: .4, Instructions: 389COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 03020040 Relevance: .3, Instructions: 315COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 07708680 Relevance: .3, Instructions: 312COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0770B0A0 Relevance: .3, Instructions: 312COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 07708EF0 Relevance: .3, Instructions: 312COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0770AC68 Relevance: .3, Instructions: 312COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 07708AB8 Relevance: .3, Instructions: 312COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0302EF28 Relevance: .3, Instructions: 271COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0302EF38 Relevance: .3, Instructions: 264COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0174D3A4 Relevance: .3, Instructions: 264COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 03020006 Relevance: .2, Instructions: 244COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0770B091 Relevance: .1, Instructions: 140COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 07708EE0 Relevance: .1, Instructions: 139COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Execution Graph
| Execution Coverage: | 15.4% |
| Dynamic/Decrypted Code Coverage: | 100% |
| Signature Coverage: | 0% |
| Total number of Nodes: | 3 |
| Total number of Limit Nodes: | 0 |
Graph
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|