Edit tour

Windows Analysis Report
WizClient.exe

Overview

General Information

Sample name:	WizClient.exe
Analysis ID:	1652216
MD5:	51dc79ac2451e7ad8809d28ee07602b4
SHA1:	37a4efa21c4a98a45b75c8b6037bc8d719cdf45e
SHA256:	dcbc3e96c538390d213875789f30feaeec238a512fc32b19e8f2c1216b89ad4c
Tags:	exeuser-BastianHein
Infos:

Detection

XWorm

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected XWorm

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

C2 URLs / IPs found in malware configuration

Joe Sandbox ML detected suspicious sample

Sample uses string decryption to hide its real strings

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Yara signature match

Classification

Process Tree

System is w10x64

WizClient.exe (PID: 6276 cmdline: "C:\Users\user\Desktop\WizClient.exe" MD5: 51DC79AC2451E7AD8809D28EE07602B4)

WerFault.exe (PID: 5560 cmdline: C:\Windows\system32\WerFault.exe -u -p 6276 -s 2280 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
XWorm	Malware with wide range of capabilities ranging from RAT to ransomware.	No Attribution	https://any.run/cybersecurity-blog/xworm-malware-communication-analysis/ https://any.run/cybersecurity-blog/xworm-technical-analysis-of-a-new-malware-version/ https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/ https://cert.pl/en/posts/2023/10/deworming-the-xworm/ https://cyber.wtf/2025/02/12/unpacking-pyarmor-v8-scripts/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

Malware Configuration

Threatname: Xworm

{
  "C2 url": [
    "127.0.0.1"
  ],
  "Port": 2323,
  "Aes key": "<123456789>",
  "SPL": "<Xwormmm>",
  "Install file": "USB.exe"
}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
WizClient.exe	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
WizClient.exe	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0x524f:$str01: $VB$Local_Port 0x5240:$str02: $VB$Local_Host 0x5462:$str03: get_Jpeg 0x4f93:$str04: get_ServicePack 0x5efa:$str05: Select * from AntivirusProduct 0x601c:$str06: PCRestart 0x6030:$str07: shutdown.exe /f /r /t 0 0x60d0:$str08: StopReport 0x60a6:$str09: StopDDos 0x6116:$str10: sendPlugin 0x6158:$str11: OfflineKeylogger Not Enabled 0x62de:$str12: -ExecutionPolicy Bypass -File " 0x6413:$str13: Content-length: 5235
WizClient.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x64be:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x655b:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x6670:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x632e:$cnc4: POST / HTTP/1.1

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.934418415.00000000007D2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000000.00000000.934418415.00000000007D2000.00000002.00000001.01000000.00000003.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x62be:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x635b:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x6470:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x612e:$cnc4: POST / HTTP/1.1
Process Memory Space: WizClient.exe PID: 6276	JoeSecurity_XWorm	Yara detected XWorm	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.WizClient.exe.7d0000.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.0.WizClient.exe.7d0000.0.unpack	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0x524f:$str01: $VB$Local_Port 0x5240:$str02: $VB$Local_Host 0x5462:$str03: get_Jpeg 0x4f93:$str04: get_ServicePack 0x5efa:$str05: Select * from AntivirusProduct 0x601c:$str06: PCRestart 0x6030:$str07: shutdown.exe /f /r /t 0 0x60d0:$str08: StopReport 0x60a6:$str09: StopDDos 0x6116:$str10: sendPlugin 0x6158:$str11: OfflineKeylogger Not Enabled 0x62de:$str12: -ExecutionPolicy Bypass -File " 0x6413:$str13: Content-length: 5235
0.0.WizClient.exe.7d0000.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x64be:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x655b:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x6670:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x632e:$cnc4: POST / HTTP/1.1

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

• AV Detection
• Compliance
• Networking
• System Summary
• Data Obfuscation
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Anti Debugging
• Language, Device and Operating System Detection
• Lowering of HIPS / PFW / Operating System Security Settings
• Stealing of Sensitive Information
• Remote Access Functionality

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: WizClient.exe

Avira: detected

Found malware configuration

Source: WizClient.exe

Malware Configuration Extractor: Xworm {"C2 url": ["127.0.0.1"], "Port": 2323, "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe"}

Multi AV Scanner detection for submitted file

Source: WizClient.exe	Virustotal: Detection: 76%			Perma Link
Source: WizClient.exe	ReversingLabs: Detection: 80%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Neural Call Log Analysis: 94.2%

Sample uses string decryption to hide its real strings

Source: WizClient.exe	String decryptor: 127.0.0.1
Source: WizClient.exe	String decryptor: 2323
Source: WizClient.exe	String decryptor: <123456789>
Source: WizClient.exe	String decryptor: <Xwormmm>
Source: WizClient.exe	String decryptor: USB.exe

Source: WizClient.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 207.174.26.219:443 -> 192.168.2.7:49684 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 207.174.26.219:443 -> 192.168.2.7:49775 version: TLS 1.2

Source: WizClient.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WERDC76.tmp.dmp.13.dr
Source:	Binary string: System.Xml.ni.pdb source: WERDC76.tmp.dmp.13.dr
Source:	Binary string: System.ni.pdbRSDS source: WERDC76.tmp.dmp.13.dr
Source:	Binary string: System.Configuration.pdbzZ) source: WERDC76.tmp.dmp.13.dr
Source:	Binary string: System.Drawing.ni.pdb source: WERDC76.tmp.dmp.13.dr
Source:	Binary string: System.Configuration.ni.pdb source: WERDC76.tmp.dmp.13.dr
Source:	Binary string: mscorlib.pdbcorlib.pdbpdblib.pdbC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: WizClient.exe, 00000000.00000002.1998771647.000000001B588000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WERDC76.tmp.dmp.13.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WERDC76.tmp.dmp.13.dr
Source:	Binary string: System.Configuration.pdb source: WERDC76.tmp.dmp.13.dr
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WERDC76.tmp.dmp.13.dr
Source:	Binary string: System.Xml.pdb source: WERDC76.tmp.dmp.13.dr
Source:	Binary string: System.pdb source: WERDC76.tmp.dmp.13.dr
Source:	Binary string: 0C:\Windows\mscorlib.pdb source: WizClient.exe, 00000000.00000002.1998771647.000000001B588000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WERDC76.tmp.dmp.13.dr
Source:	Binary string: System.Core.ni.pdb source: WERDC76.tmp.dmp.13.dr
Source:	Binary string: mscorlib.pdb`J source: WERDC76.tmp.dmp.13.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WERDC76.tmp.dmp.13.dr
Source:	Binary string: System.Drawing.pdbWizClient.exe source: WERDC76.tmp.dmp.13.dr
Source:	Binary string: mscorlib.pdb source: WERDC76.tmp.dmp.13.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: WizClient.exe, 00000000.00000002.1998953098.000000001BB14000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdbH source: WERDC76.tmp.dmp.13.dr
Source:	Binary string: System.Drawing.pdb source: WERDC76.tmp.dmp.13.dr
Source:	Binary string: mscorlib.ni.pdb source: WERDC76.tmp.dmp.13.dr
Source:	Binary string: System.Core.pdb source: WERDC76.tmp.dmp.13.dr
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WERDC76.tmp.dmp.13.dr
Source:	Binary string: symbols\dll\mscorlib.pdbpdb source: WizClient.exe, 00000000.00000002.1998771647.000000001B588000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: indoC:\Windows\mscorlib.pdb source: WizClient.exe, 00000000.00000002.1998771647.000000001B588000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdb source: WERDC76.tmp.dmp.13.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERDC76.tmp.dmp.13.dr

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 127.0.0.1

Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive

Source: Joe Sandbox View

IP Address: 207.174.26.219 207.174.26.219

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Dwrj41N/Image.png HTTP/1.1Host: i.ibb.coConnection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: i.ibb.co

Source: WizClient.exe, 00000000.00000002.1997275209.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://i.ibb.co
Source: WizClient.exe, 00000000.00000002.1997275209.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Amcache.hve.13.dr	String found in binary or memory: http://upx.sf.net
Source: WizClient.exe, 00000000.00000002.1997275209.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp, WizClient.exe, 00000000.00000002.1997275209.0000000002D3A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://i.ibb.co
Source: WizClient.exe	String found in binary or memory: https://i.ibb.co/Dwrj41N/Image.png

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49694
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49690
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49689 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49689
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49688
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49687
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49685
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49684
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49685 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49684 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49687 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 207.174.26.219:443 -> 192.168.2.7:49684 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 207.174.26.219:443 -> 192.168.2.7:49775 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: WizClient.exe, type: SAMPLE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: WizClient.exe, type: SAMPLE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.0.WizClient.exe.7d0000.0.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 0.0.WizClient.exe.7d0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000000.934418415.00000000007D2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen

Source: C:\Users\user\Desktop\WizClient.exe

Code function: 0_2_00007FFB9AA61AF5

0_2_00007FFB9AA61AF5

Source: C:\Users\user\Desktop\WizClient.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6276 -s 2280

Source: WizClient.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: WizClient.exe, type: SAMPLE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: WizClient.exe, type: SAMPLE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.0.WizClient.exe.7d0000.0.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 0.0.WizClient.exe.7d0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000000.934418415.00000000007D2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: WizClient.exe, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: WizClient.exe, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: WizClient.exe, AlgorithmAES.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.evad.winEXE@2/5@1/2

Source: C:\Users\user\Desktop\WizClient.exe	Mutant created: NULL
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6276
Source: C:\Users\user\Desktop\WizClient.exe	Mutant created: \Sessions\1\BaseNamedObjects\R22i88TmQC829Rvr

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\01e079df-7a01-40fc-a17b-f03cfbc7dc95

Jump to behavior

Source: WizClient.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: WizClient.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\WizClient.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: WizClient.exe	Virustotal: Detection: 76%
Source: WizClient.exe	ReversingLabs: Detection: 80%

Source: C:\Users\user\Desktop\WizClient.exe

File read: C:\Users\user\Desktop\WizClient.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\WizClient.exe "C:\Users\user\Desktop\WizClient.exe"
Source: C:\Users\user\Desktop\WizClient.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6276 -s 2280

Source: C:\Users\user\Desktop\WizClient.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Section loaded: gpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\WizClient.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\WizClient.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: WizClient.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: WizClient.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WERDC76.tmp.dmp.13.dr
Source:	Binary string: System.Xml.ni.pdb source: WERDC76.tmp.dmp.13.dr
Source:	Binary string: System.ni.pdbRSDS source: WERDC76.tmp.dmp.13.dr
Source:	Binary string: System.Configuration.pdbzZ) source: WERDC76.tmp.dmp.13.dr
Source:	Binary string: System.Drawing.ni.pdb source: WERDC76.tmp.dmp.13.dr
Source:	Binary string: System.Configuration.ni.pdb source: WERDC76.tmp.dmp.13.dr
Source:	Binary string: mscorlib.pdbcorlib.pdbpdblib.pdbC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: WizClient.exe, 00000000.00000002.1998771647.000000001B588000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WERDC76.tmp.dmp.13.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WERDC76.tmp.dmp.13.dr
Source:	Binary string: System.Configuration.pdb source: WERDC76.tmp.dmp.13.dr
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WERDC76.tmp.dmp.13.dr
Source:	Binary string: System.Xml.pdb source: WERDC76.tmp.dmp.13.dr
Source:	Binary string: System.pdb source: WERDC76.tmp.dmp.13.dr
Source:	Binary string: 0C:\Windows\mscorlib.pdb source: WizClient.exe, 00000000.00000002.1998771647.000000001B588000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WERDC76.tmp.dmp.13.dr
Source:	Binary string: System.Core.ni.pdb source: WERDC76.tmp.dmp.13.dr
Source:	Binary string: mscorlib.pdb`J source: WERDC76.tmp.dmp.13.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WERDC76.tmp.dmp.13.dr
Source:	Binary string: System.Drawing.pdbWizClient.exe source: WERDC76.tmp.dmp.13.dr
Source:	Binary string: mscorlib.pdb source: WERDC76.tmp.dmp.13.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: WizClient.exe, 00000000.00000002.1998953098.000000001BB14000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdbH source: WERDC76.tmp.dmp.13.dr
Source:	Binary string: System.Drawing.pdb source: WERDC76.tmp.dmp.13.dr
Source:	Binary string: mscorlib.ni.pdb source: WERDC76.tmp.dmp.13.dr
Source:	Binary string: System.Core.pdb source: WERDC76.tmp.dmp.13.dr
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WERDC76.tmp.dmp.13.dr
Source:	Binary string: symbols\dll\mscorlib.pdbpdb source: WizClient.exe, 00000000.00000002.1998771647.000000001B588000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: indoC:\Windows\mscorlib.pdb source: WizClient.exe, 00000000.00000002.1998771647.000000001B588000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdb source: WERDC76.tmp.dmp.13.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERDC76.tmp.dmp.13.dr

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: WizClient.exe, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: WizClient.exe, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: WizClient.exe, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { Pack[2] }}, (string[])null, (Type[])null, (bool[])null, true)

.NET source code contains potential unpacker

Source: WizClient.exe, Helper.cs	.Net Code: XMemory System.AppDomain.Load(byte[])
Source: WizClient.exe, Messages.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: WizClient.exe, Messages.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: WizClient.exe, Messages.cs	.Net Code: Memory

Source: C:\Users\user\Desktop\WizClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\WizClient.exe	Memory allocated: F10000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Memory allocated: 1ACD0000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 599750	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 599641	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 599500	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 599391	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 599277	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 599163	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 599047	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 598834	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 598719	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 598609	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 598500	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 598391	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 598250	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 598141	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 598031	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 597922	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 597813	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 597704	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 597579	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 597469	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 597344	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 597235	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 597110	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 596985	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 596860	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 596735	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 596610	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 596467	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 596359	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 596224	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 596077	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 595953	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 595844	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 595719	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 595610	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 595485	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 595360	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 595235	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 595110	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 594985	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 594860	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 594735	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 594610	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 594485	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 594360	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 594235	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 594110	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 593985	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 593860	Jump to behavior

Source: C:\Users\user\Desktop\WizClient.exe	Window / User API: threadDelayed 7992			Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Window / User API: threadDelayed 1818			Jump to behavior

Source: C:\Users\user\Desktop\WizClient.exe TID: 6660	Thread sleep count: 35 > 30	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe TID: 6660	Thread sleep time: -32281802128991695s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe TID: 6660	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe TID: 6660	Thread sleep time: -599891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe TID: 6640	Thread sleep count: 7992 > 30	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe TID: 6640	Thread sleep count: 1818 > 30	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe TID: 6660	Thread sleep time: -599750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe TID: 6660	Thread sleep time: -599641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe TID: 6660	Thread sleep time: -599500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe TID: 6660	Thread sleep time: -599391s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe TID: 6660	Thread sleep time: -599277s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe TID: 6660	Thread sleep time: -599163s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe TID: 6660	Thread sleep time: -599047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe TID: 6660	Thread sleep time: -598834s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe TID: 6660	Thread sleep time: -598719s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe TID: 6660	Thread sleep time: -598609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe TID: 6660	Thread sleep time: -598500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe TID: 6660	Thread sleep time: -598391s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe TID: 6660	Thread sleep time: -598250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe TID: 6660	Thread sleep time: -598141s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe TID: 6660	Thread sleep time: -598031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe TID: 6660	Thread sleep time: -597922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe TID: 6660	Thread sleep time: -597813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe TID: 6660	Thread sleep time: -597704s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe TID: 6660	Thread sleep time: -597579s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe TID: 6660	Thread sleep time: -597469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe TID: 6660	Thread sleep time: -597344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe TID: 6660	Thread sleep time: -597235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe TID: 6660	Thread sleep time: -597110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe TID: 6660	Thread sleep time: -596985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe TID: 6660	Thread sleep time: -596860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe TID: 6660	Thread sleep time: -596735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe TID: 6660	Thread sleep time: -596610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe TID: 6660	Thread sleep time: -596467s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe TID: 6660	Thread sleep time: -596359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe TID: 6660	Thread sleep time: -596224s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe TID: 6660	Thread sleep time: -596077s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe TID: 6660	Thread sleep time: -595953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe TID: 6660	Thread sleep time: -595844s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe TID: 6660	Thread sleep time: -595719s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe TID: 6660	Thread sleep time: -595610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe TID: 6660	Thread sleep time: -595485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe TID: 6660	Thread sleep time: -595360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe TID: 6660	Thread sleep time: -595235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe TID: 6660	Thread sleep time: -595110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe TID: 6660	Thread sleep time: -594985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe TID: 6660	Thread sleep time: -594860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe TID: 6660	Thread sleep time: -594735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe TID: 6660	Thread sleep time: -594610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe TID: 6660	Thread sleep time: -594485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe TID: 6660	Thread sleep time: -594360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe TID: 6660	Thread sleep time: -594235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe TID: 6660	Thread sleep time: -594110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe TID: 6660	Thread sleep time: -593985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe TID: 6660	Thread sleep time: -593860s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\WizClient.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 599750	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 599641	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 599500	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 599391	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 599277	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 599163	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 599047	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 598834	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 598719	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 598609	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 598500	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 598391	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 598250	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 598141	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 598031	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 597922	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 597813	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 597704	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 597579	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 597469	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 597344	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 597235	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 597110	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 596985	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 596860	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 596735	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 596610	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 596467	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 596359	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 596224	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 596077	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 595953	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 595844	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 595719	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 595610	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 595485	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 595360	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 595235	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 595110	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 594985	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 594860	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 594735	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 594610	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 594485	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 594360	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 594235	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 594110	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 593985	Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Thread delayed: delay time: 593860	Jump to behavior

Source: Amcache.hve.13.dr	Binary or memory string: VMware
Source: Amcache.hve.13.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.13.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.13.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.13.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.13.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.13.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.13.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.13.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.13.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.13.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.13.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: WizClient.exe, 00000000.00000002.1996643212.0000000000CD1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.13.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.13.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.13.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.13.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.13.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.13.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.13.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.13.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.13.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.13.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.13.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.13.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.13.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.13.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.13.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.13.dr	Binary or memory string: VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
Source: Amcache.hve.13.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\WizClient.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\WizClient.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\WizClient.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\WizClient.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\WizClient.exe

Queries volume information: C:\Users\user\Desktop\WizClient.exe VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\WizClient.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.13.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.13.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.13.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.13.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.13.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected XWorm

Source: Yara match	File source: WizClient.exe, type: SAMPLE
Source: Yara match	File source: 0.0.WizClient.exe.7d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.934418415.00000000007D2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: WizClient.exe PID: 6276, type: MEMORYSTR

Remote Access Functionality

Yara detected XWorm

Source: Yara match	File source: WizClient.exe, type: SAMPLE
Source: Yara match	File source: 0.0.WizClient.exe.7d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.934418415.00000000007D2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: WizClient.exe PID: 6276, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Disable or Modify Tools	OS Credential Dumping	21 Security Software Discovery	Remote Services	11 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	41 Virtualization/Sandbox Evasion	LSASS Memory	41 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	13 System Information Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
WizClient.exe	76%	Virustotal		Browse
WizClient.exe	81%	ReversingLabs	ByteCode-MSIL.Trojan.Jalapeno
WizClient.exe	100%	Avira	HEUR/AGEN.1305769
SAMPLE	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
i.ibb.co	207.174.26.219	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://i.ibb.co/Dwrj41N/Image.png	false		high
127.0.0.1	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://upx.sf.net	Amcache.hve.13.dr	false	high
https://i.ibb.co	WizClient.exe, 00000000.00000002.1997275209.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp, WizClient.exe, 00000000.00000002.1997275209.0000000002D3A000.00000004.00000800.00020000.00000000.sdmp	false	high
http://i.ibb.co	WizClient.exe, 00000000.00000002.1997275209.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	WizClient.exe, 00000000.00000002.1997275209.0000000002CD1000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
207.174.26.219	i.ibb.co	United States		6079	RCN-ASUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1652216
Start date and time:	2025-03-30 18:03:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	WizClient.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@2/5@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 22 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, sppsvc.exe, WerFault.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.22, 4.175.87.197, 23.204.23.20, 20.190.190.131
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, login.live.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus17.westus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, c.pki.goog, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target WizClient.exe, PID 6276 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
12:04:10	API Interceptor	2390797x Sleep call for process: WizClient.exe modified
12:05:53	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
207.174.26.219	XC.exe	Get hash	malicious	XWorm	Browse
	FINAL -Legal Notice Presentation (1).pptx	Get hash	malicious	HTMLPhisher	Browse
	Formal Legal Notice Presentation (Approved).pptx	Get hash	malicious	HTMLPhisher	Browse
	Presentation Of Legal Notice.pptx	Get hash	malicious	HTMLPhisher	Browse
	Filled-Summons Notice (2).docx	Get hash	malicious	HTMLPhisher	Browse
	Legal_Notice _Letter.pdf	Get hash	malicious	HTMLPhisher	Browse
	https://ossin7fot.pelosfilhos.com.br?hbyf=YW5nZWxhLm0ucm9lbGxAeGNlbGVuZXJneS5jb20=	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse
	25 03 2025 Legal Notice Presentation.pptx	Get hash	malicious	Unknown	Browse
	https://drive.usercontent.google.com/download?id=1D-lVkrj-b014caeCIdakZBdw2yekeEO1&export=download	Get hash	malicious	HTMLPhisher	Browse
	https://medpetroenergydmcc.com/court/	Get hash	malicious	HTMLPhisher	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
i.ibb.co	XC.exe	Get hash	malicious	XWorm	Browse	207.174.26.219
	FINAL -Legal Notice Presentation (1).pptx	Get hash	malicious	HTMLPhisher	Browse	207.174.26.219
	Formal Legal Notice Presentation (Approved).pptx	Get hash	malicious	HTMLPhisher	Browse	207.174.26.219
	Presentation Of Legal Notice.pptx	Get hash	malicious	HTMLPhisher	Browse	207.174.26.219
	Filled-Summons Notice (2).docx	Get hash	malicious	HTMLPhisher	Browse	207.174.26.219
	Legal_Notice _Letter.pdf	Get hash	malicious	HTMLPhisher	Browse	207.174.26.219
	https://ossin7fot.pelosfilhos.com.br?hbyf=YW5nZWxhLm0ucm9lbGxAeGNlbGVuZXJneS5jb20=	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	207.174.26.219
	25 03 2025 Legal Notice Presentation.pptx	Get hash	malicious	Unknown	Browse	207.174.26.219
	25 03 2025 Legal Notice Presentation.pptx	Get hash	malicious	Unknown	Browse	108.181.22.211
	https://drive.usercontent.google.com/download?id=1D-lVkrj-b014caeCIdakZBdw2yekeEO1&export=download	Get hash	malicious	HTMLPhisher	Browse	207.174.26.219

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
RCN-ASUS	XC.exe	Get hash	malicious	XWorm	Browse	207.174.26.219
	FINAL -Legal Notice Presentation (1).pptx	Get hash	malicious	HTMLPhisher	Browse	207.174.26.219
	Formal Legal Notice Presentation (Approved).pptx	Get hash	malicious	HTMLPhisher	Browse	207.174.26.219
	k03ldc.arm.elf	Get hash	malicious	Unknown	Browse	208.59.25.232
	k03ldc.x86_64.elf	Get hash	malicious	Unknown	Browse	207.175.27.218
	Presentation Of Legal Notice.pptx	Get hash	malicious	HTMLPhisher	Browse	207.174.26.219
	core.vapvap	Get hash	malicious	Unknown	Browse	207.174.61.1
	Filled-Summons Notice (2).docx	Get hash	malicious	HTMLPhisher	Browse	207.174.26.219
	Legal_Notice _Letter.pdf	Get hash	malicious	HTMLPhisher	Browse	207.174.26.219
	https://ossin7fot.pelosfilhos.com.br?hbyf=YW5nZWxhLm0ucm9lbGxAeGNlbGVuZXJneS5jb20=	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	207.174.26.219

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	XC.exe	Get hash	malicious	XWorm	Browse	207.174.26.219
	FvkRadar Intel.exe	Get hash	malicious	XWorm	Browse	207.174.26.219
	nursultan_fix.exe	Get hash	malicious	XWorm	Browse	207.174.26.219
	AVCXw0587P.exe	Get hash	malicious	Amadey, Babadeda, Batch Injector	Browse	207.174.26.219
	JetProgram.exe	Get hash	malicious	Xmrig	Browse	207.174.26.219
	LU3J3mZT5y.exe	Get hash	malicious	LummaC Stealer	Browse	207.174.26.219
	RuntimeBroker.exe	Get hash	malicious	Unknown	Browse	207.174.26.219
	RuntimeBroker.exe	Get hash	malicious	Unknown	Browse	207.174.26.219
	climb.exe	Get hash	malicious	LummaC Stealer	Browse	207.174.26.219
	t3333-03-2825.bat	Get hash	malicious	Braodo	Browse	207.174.26.219

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_WizClient.exe_74683884012ecc2609bd869a5ad26296ce7633_ce251f58_55e6a882-50c0-4a28-b877-42a841f3bad5\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.188254775015482
Encrypted:	false
SSDEEP:	192:3YmEkez0SthpaWz8iyrelhESzuiFVZ24lO8Wjx:PEkpSthpa48iNiSzuiFVY4lO8WV
MD5:	536314B3C9587917722C62FB9F502263
SHA1:	A05D212670F59CBFB087F912F3F96ADE81A29B9C
SHA-256:	3EE31D831063607C87E9247EA8ADD8710C2A9C080BA3C60181D89CB868D6534B
SHA-512:	79B9C461358FE27E3C0CFAB6385C8859A36DC9D8FA864C18FC0DA3A3736557B1D404F5F3DF239B8170AF00B3947A3ED1C79BDDC57E3113464D7E8EC39E9C072A
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.8.7.8.2.4.3.4.9.6.1.4.1.1.7.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.8.7.8.2.4.3.5.0.8.6.4.1.1.7.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.5.e.6.a.8.8.2.-.5.0.c.0.-.4.a.2.8.-.b.8.7.7.-.4.2.a.8.4.1.f.3.b.a.d.5.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.1.5.9.b.2.d.4.-.7.f.7.5.-.4.3.1.7.-.8.0.0.0.-.8.4.8.3.5.d.3.6.f.a.f.c.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.W.i.z.C.l.i.e.n.t...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.W.i.z.C.l.i.e.n.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.8.8.4.-.0.0.0.1.-.0.0.1.8.-.9.0.9.3.-.c.c.5.d.8.d.a.1.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.c.e.2.6.8.4.b.a.f.a.3.f.c.d.a.b.1.4.6.8.2.6.5.1.2.0.8.6.f.4.7.4.0.0.0.0.0.0.0.0.!.0.0.0.0.3.7.a.4.e.f.a.2.1.c.4.a.9.8.a.4.5.b.7.5.c.8.b.6.0.3.7.b.c.8.d.7.1.9.c.d.f.4.5.e.!.W.i.z.C.l.i.e.n.t...e.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDC76.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 16 streams, Sun Mar 30 16:05:49 2025, 0x1205a4 type
Category:	dropped
Size (bytes):	605220
Entropy (8bit):	3.218995659726747
Encrypted:	false
SSDEEP:	3072:7YBfHYRQ+mRTsHpQ5iY1CCqdTH/33+vt8QoVmfyBOXpIymdSZevXdiW54vrylgcC:7qvH+A4zWqh/33Qt8hdiYerwsHLE
MD5:	FB9B2DFA8EAB144AC1D4FCA4382490D0
SHA1:	BB8CFFEED821B7875A7705C873DA97954836B98E
SHA-256:	48552A3E776CDAB40DEA868D7AA9A25E41CB3FF928EDF35770AD2FD4F55C27F2
SHA-512:	DDF7D272DC7131B01250F015BA20176C1A950DB244C0F23332DF422EBBCAEFE00785B8D593E88C04F9C8C4185945BAA79706E6F0B4DE2320E9CF1759ABA1F416
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ........k.g....................................<...p(...........(......tQ..............l.......8...........T............W..l............3...........5..............................................................................eJ......$6......Lw......................T...........wk.g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDE6B.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8906
Entropy (8bit):	3.697849072179655
Encrypted:	false
SSDEEP:	192:R6l7wVeJxjDqcwa6Y+AxyOipgmfZIBprs89bAb0f57Am:R6lXJ1DqU6YZzipgmfClA4fH
MD5:	9B9B960E1E1C5A37E60CB2DFAEF35249
SHA1:	9E5D78DA98DB14ACD3AC120D2EAA7103A60D51A1
SHA-256:	C210C3ED0E36B00231A7E03E4DAC41C83C0DE520F74060F6924E796D469219FC
SHA-512:	7BA0582FC7ADB0DA7F3A5A116802CD241EA2C3AFDA53A942E5D01AE723E5F19E1F41F76F8526935B8D4A717F71BFF5434EFB3D238B0748A5E1258C36DBD86956
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.2.7.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDEF9.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4781
Entropy (8bit):	4.452582001296201
Encrypted:	false
SSDEEP:	48:cvIwWl8zsTzJg771I9f8WpW8VYfYm8M4J+BFwyq8vpZhQVeEd:uIjfTNI7Y17VnJLWbhQoEd
MD5:	08589C9772CF511AB9030E976977540E
SHA1:	A4431848830122DD559C139904321402C18F3104
SHA-256:	E7E3FB1D5BB85DA6BBD539E423C0D33B660F6AB4901C40ED59E88154CF4EF7A1
SHA-512:	FB74110BADAA0125A6D6EFF3C3C5191C8DBF1A2592B55E972C5FBC49B10DCF7FCFEC424C80C6DAC8D1E5CBAD09E78857FD5776FC38749FCEFC3CCE4D7ED880EF
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="783788" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.419954234821631
Encrypted:	false
SSDEEP:	6144:jcifpi6ceLPL9skLmb0mgSWSPtaJG8nAgex285i2MMhA20X4WABlUuNT5+7:Yi58gSWIZBk2MM6AFn9o
MD5:	9A3F7C6C59DF1C3BC1B67DA443B5C614
SHA1:	FBB1054C47668376D49399D89D250236D633FE15
SHA-256:	F607E13BBBC985F6A43F437B2508FF337597FB852E41AFC084BD7EF48127EE27
SHA-512:	25270B039F150A2A6FF644E4A09074EFEC2C34840673D81AEA30EE5B8C839B10BE535A80A90D39CED96550978D42B03C335C53BD7BA088B484CE29D437A1C335
Malicious:	false
Reputation:	low
Preview:	regfH...H....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm6..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.598583777406854
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	WizClient.exe
File size:	31'232 bytes
MD5:	51dc79ac2451e7ad8809d28ee07602b4
SHA1:	37a4efa21c4a98a45b75c8b6037bc8d719cdf45e
SHA256:	dcbc3e96c538390d213875789f30feaeec238a512fc32b19e8f2c1216b89ad4c
SHA512:	6e737cb3b034a4f7979b99614adbd71d9fab76b4397501f165815bcf1646dd763fe7ea9544a3c66a1967ba80598bf2287ee0cd53d6cbeaebd8ad25abdeeeb65a
SSDEEP:	384:N2458Ytf+1mOEUehuzD2LZX01uYTEXXQmRuptFlBLTIOZw/W2Zvn9Ikn1W2kxOq8:9+1mOE1yG6u4QAm0FG9L4nOqhFbg
TLSH:	1AE23B487BA88326D6FE1FF219B3910102749513E913EF9F4CD595EB6B6BAC046013EA
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....O.g.................p............... ........@.. ....................................@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x408fce
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x67E94F90 [Sun Mar 30 14:05:04 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8f78	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa000	0x4e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xc000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x6fd4	0x7000	6ec5d5c0e42371ad4d5899e55b79bb0e	False	0.5057896205357143	data	5.760275569586321	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xa000	0x4e0	0x600	235e94540ed2bb03f2399871a29cec24	False	0.376953125	data	3.7387328467315477	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xc000	0xc	0x200	31ca38b3f46e1c56e0678c2fc19748f8	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xa0a0	0x24c	data			0.47619047619047616
RT_MANIFEST	0xa2f0	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
FileDescription
FileVersion	1.0.0.0
InternalName	WizClient.exe
LegalCopyright
OriginalFilename	WizClient.exe
ProductVersion	1.0.0.0
Assembly Version	1.0.0.0

Network Behavior

Download Network PCAP: filtered – full

Network Port Distribution

Total Packets: 317
• 443 (HTTPS)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 30, 2025 18:04:17.673163891 CEST	49684	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:17.673202991 CEST	443	49684	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:17.673337936 CEST	49684	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:17.692189932 CEST	49684	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:17.692220926 CEST	443	49684	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:17.915535927 CEST	443	49684	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:17.915741920 CEST	49684	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:17.921082020 CEST	49684	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:17.921097994 CEST	443	49684	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:17.921354055 CEST	443	49684	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:17.974210978 CEST	49684	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:17.987999916 CEST	49684	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:18.032272100 CEST	443	49684	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:18.119215012 CEST	443	49684	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:18.119268894 CEST	443	49684	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:18.119395971 CEST	49684	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:18.179507017 CEST	49684	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:18.179543972 CEST	443	49684	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:18.184154987 CEST	49685	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:18.184201956 CEST	443	49685	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:18.184264898 CEST	49685	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:18.184787035 CEST	49685	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:18.184801102 CEST	443	49685	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:18.394051075 CEST	443	49685	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:18.397830009 CEST	49685	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:18.397855043 CEST	443	49685	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:18.601603031 CEST	443	49685	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:18.601665020 CEST	443	49685	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:18.601728916 CEST	49685	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:18.602255106 CEST	49685	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:18.602272034 CEST	443	49685	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:20.615942955 CEST	49687	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:20.615998030 CEST	443	49687	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:20.616117954 CEST	49687	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:20.616400003 CEST	49687	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:20.616413116 CEST	443	49687	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:20.822911024 CEST	443	49687	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:20.824234962 CEST	49687	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:20.824273109 CEST	443	49687	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:21.033524990 CEST	443	49687	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:21.033615112 CEST	443	49687	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:21.033721924 CEST	49687	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:21.034224987 CEST	49687	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:21.034241915 CEST	443	49687	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:21.035322905 CEST	49688	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:21.035370111 CEST	443	49688	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:21.035444975 CEST	49688	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:21.035706997 CEST	49688	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:21.035713911 CEST	443	49688	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:21.255697012 CEST	443	49688	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:21.258517027 CEST	49688	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:21.258548021 CEST	443	49688	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:21.456410885 CEST	443	49688	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:21.456518888 CEST	443	49688	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:21.456602097 CEST	49688	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:21.457154989 CEST	49688	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:21.457175970 CEST	443	49688	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:23.460273981 CEST	49689	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:23.460323095 CEST	443	49689	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:23.460428953 CEST	49689	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:23.460892916 CEST	49689	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:23.460906982 CEST	443	49689	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:24.383944035 CEST	443	49689	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:24.385226965 CEST	49689	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:24.385251999 CEST	443	49689	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:24.590948105 CEST	443	49689	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:24.591008902 CEST	443	49689	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:24.591064930 CEST	49689	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:24.652394056 CEST	49689	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:24.652416945 CEST	443	49689	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:24.653264046 CEST	49690	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:24.653304100 CEST	443	49690	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:24.653389931 CEST	49690	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:24.653623104 CEST	49690	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:24.653640985 CEST	443	49690	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:24.871927023 CEST	443	49690	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:24.881068945 CEST	49690	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:24.881088972 CEST	443	49690	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:25.080022097 CEST	443	49690	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:25.080075979 CEST	443	49690	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:25.080209017 CEST	49690	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:25.080815077 CEST	49690	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:25.080837011 CEST	443	49690	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:27.084832907 CEST	49693	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:27.084871054 CEST	443	49693	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:27.085019112 CEST	49693	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:27.085342884 CEST	49693	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:27.085357904 CEST	443	49693	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:27.298055887 CEST	443	49693	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:27.299992085 CEST	49693	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:27.300015926 CEST	443	49693	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:27.504550934 CEST	443	49693	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:27.504615068 CEST	443	49693	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:27.504743099 CEST	49693	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:27.505143881 CEST	49693	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:27.505163908 CEST	443	49693	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:27.506323099 CEST	49694	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:27.506376028 CEST	443	49694	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:27.506447077 CEST	49694	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:27.506767035 CEST	49694	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:27.506783009 CEST	443	49694	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:28.720325947 CEST	443	49694	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:28.721766949 CEST	49694	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:28.721791029 CEST	443	49694	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:29.280065060 CEST	443	49694	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:29.280122995 CEST	443	49694	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:29.280168056 CEST	49694	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:29.280747890 CEST	49694	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:29.280766964 CEST	443	49694	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:31.289418936 CEST	49701	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:31.289467096 CEST	443	49701	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:31.289560080 CEST	49701	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:31.289853096 CEST	49701	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:31.289865017 CEST	443	49701	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:31.929954052 CEST	443	49701	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:31.939717054 CEST	49701	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:31.939728975 CEST	443	49701	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:32.143419027 CEST	443	49701	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:32.143485069 CEST	443	49701	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:32.143570900 CEST	49701	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:32.144095898 CEST	49701	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:32.144114971 CEST	443	49701	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:32.145222902 CEST	49702	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:32.145334959 CEST	443	49702	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:32.145448923 CEST	49702	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:32.145658016 CEST	49702	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:32.145690918 CEST	443	49702	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:32.352907896 CEST	443	49702	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:32.354593992 CEST	49702	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:32.354619980 CEST	443	49702	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:32.558614016 CEST	443	49702	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:32.558681011 CEST	443	49702	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:32.559202909 CEST	49702	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:32.559274912 CEST	443	49702	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:32.559315920 CEST	49702	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:34.569626093 CEST	49704	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:34.569678068 CEST	443	49704	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:34.569737911 CEST	49704	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:34.570342064 CEST	49704	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:34.570365906 CEST	443	49704	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:34.784703970 CEST	443	49704	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:34.786119938 CEST	49704	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:34.786156893 CEST	443	49704	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:35.001564980 CEST	443	49704	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:35.001625061 CEST	443	49704	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:35.001724958 CEST	49704	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:35.002182007 CEST	49704	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:35.002219915 CEST	443	49704	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:35.003362894 CEST	49705	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:35.003406048 CEST	443	49705	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:35.003493071 CEST	49705	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:35.003730059 CEST	49705	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:35.003743887 CEST	443	49705	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:35.220841885 CEST	443	49705	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:35.222374916 CEST	49705	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:35.222398996 CEST	443	49705	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:35.803325891 CEST	443	49705	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:35.803392887 CEST	443	49705	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:35.803441048 CEST	49705	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:35.803940058 CEST	49705	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:35.803956032 CEST	443	49705	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:37.819183111 CEST	49710	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:37.819257975 CEST	443	49710	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:37.819361925 CEST	49710	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:37.819628000 CEST	49710	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:37.819643974 CEST	443	49710	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:39.714845896 CEST	443	49710	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:39.716262102 CEST	49710	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:39.716293097 CEST	443	49710	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:39.920748949 CEST	443	49710	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:39.920804977 CEST	443	49710	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:39.920881987 CEST	49710	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:39.921363115 CEST	49710	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:39.921385050 CEST	443	49710	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:39.922607899 CEST	49713	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:39.922645092 CEST	443	49713	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:39.922739029 CEST	49713	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:39.922961950 CEST	49713	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:39.922976017 CEST	443	49713	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:40.129374027 CEST	443	49713	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:40.130836010 CEST	49713	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:40.130858898 CEST	443	49713	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:40.331583977 CEST	443	49713	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:40.331639051 CEST	443	49713	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:40.331681967 CEST	49713	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:40.332163095 CEST	49713	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:40.332176924 CEST	443	49713	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:42.336349964 CEST	49717	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:42.336394072 CEST	443	49717	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:42.336520910 CEST	49717	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:42.337030888 CEST	49717	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:42.337044954 CEST	443	49717	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:42.545840025 CEST	443	49717	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:42.547354937 CEST	49717	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:42.547364950 CEST	443	49717	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:42.752444029 CEST	443	49717	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:42.752506018 CEST	443	49717	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:42.752556086 CEST	49717	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:42.753072023 CEST	49717	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:42.753086090 CEST	443	49717	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:42.754185915 CEST	49718	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:42.754225969 CEST	443	49718	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:42.754301071 CEST	49718	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:42.754579067 CEST	49718	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:42.754590034 CEST	443	49718	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:43.370428085 CEST	443	49718	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:43.371778011 CEST	49718	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:43.371798992 CEST	443	49718	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:43.576544046 CEST	443	49718	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:43.576612949 CEST	443	49718	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:43.576931953 CEST	49718	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:43.577069044 CEST	49718	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:43.577091932 CEST	443	49718	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:45.622059107 CEST	49720	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:45.622128010 CEST	443	49720	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:45.622313023 CEST	49720	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:45.622755051 CEST	49720	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:45.622776031 CEST	443	49720	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:45.832626104 CEST	443	49720	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:45.839829922 CEST	49720	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:45.839864969 CEST	443	49720	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:46.041433096 CEST	443	49720	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:46.041502953 CEST	443	49720	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:46.041569948 CEST	49720	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:46.042027950 CEST	49720	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:46.042049885 CEST	443	49720	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:46.043034077 CEST	49722	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:46.043080091 CEST	443	49722	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:46.043195009 CEST	49722	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:46.043457031 CEST	49722	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:46.043472052 CEST	443	49722	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:46.248925924 CEST	443	49722	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:46.250418901 CEST	49722	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:46.250443935 CEST	443	49722	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:46.767703056 CEST	443	49722	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:46.767767906 CEST	443	49722	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:46.768013000 CEST	49722	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:46.768625021 CEST	49722	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:46.768646002 CEST	443	49722	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:48.772996902 CEST	49724	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:48.773051023 CEST	443	49724	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:48.773124933 CEST	49724	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:48.773505926 CEST	49724	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:48.773516893 CEST	443	49724	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:48.983617067 CEST	443	49724	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:48.985091925 CEST	49724	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:48.985127926 CEST	443	49724	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:49.191389084 CEST	443	49724	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:49.191448927 CEST	443	49724	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:49.191498995 CEST	49724	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:49.192078114 CEST	49724	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:49.192094088 CEST	443	49724	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:49.193397045 CEST	49725	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:49.193434000 CEST	443	49725	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:49.193512917 CEST	49725	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:49.193778992 CEST	49725	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:49.193794966 CEST	443	49725	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:49.407793999 CEST	443	49725	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:49.409394979 CEST	49725	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:49.409434080 CEST	443	49725	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:49.620815039 CEST	443	49725	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:49.620868921 CEST	443	49725	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:49.621017933 CEST	49725	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:49.621412992 CEST	49725	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:49.621428967 CEST	443	49725	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:51.631818056 CEST	49726	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:51.631866932 CEST	443	49726	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:51.632105112 CEST	49726	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:51.632405043 CEST	49726	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:51.632421970 CEST	443	49726	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:51.846779108 CEST	443	49726	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:51.848418951 CEST	49726	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:51.848439932 CEST	443	49726	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:52.062406063 CEST	443	49726	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:52.062453032 CEST	443	49726	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:52.062591076 CEST	49726	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:52.063138008 CEST	49726	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:52.063154936 CEST	443	49726	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:52.064634085 CEST	49727	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:52.064680099 CEST	443	49727	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:52.064807892 CEST	49727	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:52.065018892 CEST	49727	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:52.065032005 CEST	443	49727	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:52.276380062 CEST	443	49727	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:52.277935982 CEST	49727	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:52.277964115 CEST	443	49727	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:52.852157116 CEST	443	49727	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:52.852209091 CEST	443	49727	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:52.852267981 CEST	49727	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:52.852699995 CEST	49727	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:52.852720022 CEST	443	49727	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:54.865987062 CEST	49730	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:54.866030931 CEST	443	49730	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:54.866139889 CEST	49730	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:54.866444111 CEST	49730	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:54.866466045 CEST	443	49730	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:55.080588102 CEST	443	49730	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:55.082138062 CEST	49730	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:55.082159996 CEST	443	49730	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:55.307574987 CEST	443	49730	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:55.307640076 CEST	443	49730	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:55.307854891 CEST	49730	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:55.308367968 CEST	49730	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:55.308387041 CEST	443	49730	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:55.309463024 CEST	49731	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:55.309519053 CEST	443	49731	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:55.309617996 CEST	49731	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:55.309834957 CEST	49731	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:55.309849024 CEST	443	49731	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:56.533096075 CEST	443	49731	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:56.534792900 CEST	49731	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:56.534818888 CEST	443	49731	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:56.745934010 CEST	443	49731	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:56.745995045 CEST	443	49731	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:56.746134996 CEST	49731	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:56.752371073 CEST	49731	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:56.752392054 CEST	443	49731	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:58.756645918 CEST	49734	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:58.756689072 CEST	443	49734	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:58.756776094 CEST	49734	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:58.757044077 CEST	49734	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:58.757060051 CEST	443	49734	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:58.969472885 CEST	443	49734	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:58.970988989 CEST	49734	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:58.971002102 CEST	443	49734	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:59.805560112 CEST	443	49734	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:59.805620909 CEST	443	49734	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:59.805727959 CEST	49734	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:59.866060972 CEST	49734	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:59.866087914 CEST	443	49734	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:59.867005110 CEST	49735	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:59.867052078 CEST	443	49735	207.174.26.219	192.168.2.7
Mar 30, 2025 18:04:59.867157936 CEST	49735	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:59.867353916 CEST	49735	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:04:59.867364883 CEST	443	49735	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:00.073111057 CEST	443	49735	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:00.079651117 CEST	49735	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:00.079659939 CEST	443	49735	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:00.712165117 CEST	443	49735	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:00.712239027 CEST	443	49735	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:00.712342978 CEST	49735	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:00.712729931 CEST	49735	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:00.712748051 CEST	443	49735	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:02.732656002 CEST	49738	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:02.732723951 CEST	443	49738	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:02.732817888 CEST	49738	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:02.733153105 CEST	49738	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:02.733172894 CEST	443	49738	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:02.940393925 CEST	443	49738	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:02.941768885 CEST	49738	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:02.941809893 CEST	443	49738	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:03.157448053 CEST	443	49738	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:03.157530069 CEST	443	49738	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:03.157732964 CEST	49738	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:03.158152103 CEST	49738	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:03.158169031 CEST	443	49738	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:03.159336090 CEST	49739	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:03.159390926 CEST	443	49739	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:03.159465075 CEST	49739	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:03.159698963 CEST	49739	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:03.159719944 CEST	443	49739	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:04.014348030 CEST	443	49739	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:04.015760899 CEST	49739	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:04.015782118 CEST	443	49739	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:04.903966904 CEST	443	49739	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:04.904042959 CEST	443	49739	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:04.904186010 CEST	49739	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:04.904506922 CEST	49739	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:04.904525042 CEST	443	49739	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:06.913140059 CEST	49740	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:06.913193941 CEST	443	49740	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:06.913286924 CEST	49740	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:06.913554907 CEST	49740	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:06.913567066 CEST	443	49740	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:07.126566887 CEST	443	49740	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:07.128077984 CEST	49740	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:07.128114939 CEST	443	49740	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:07.705099106 CEST	443	49740	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:07.705164909 CEST	443	49740	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:07.705225945 CEST	49740	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:07.705729008 CEST	49740	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:07.705746889 CEST	443	49740	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:07.706928968 CEST	49741	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:07.706976891 CEST	443	49741	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:07.707082033 CEST	49741	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:07.707321882 CEST	49741	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:07.707333088 CEST	443	49741	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:09.031898975 CEST	443	49741	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:09.033467054 CEST	49741	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:09.033503056 CEST	443	49741	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:09.235851049 CEST	443	49741	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:09.235920906 CEST	443	49741	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:09.236077070 CEST	49741	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:09.236553907 CEST	49741	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:09.236574888 CEST	443	49741	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:11.241369963 CEST	49744	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:11.241419077 CEST	443	49744	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:11.241590023 CEST	49744	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:11.241842985 CEST	49744	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:11.241852999 CEST	443	49744	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:11.885459900 CEST	443	49744	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:11.886964083 CEST	49744	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:11.886980057 CEST	443	49744	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:12.102662086 CEST	443	49744	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:12.102716923 CEST	443	49744	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:12.102787971 CEST	49744	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:12.103239059 CEST	49744	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:12.103254080 CEST	443	49744	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:12.104262114 CEST	49745	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:12.104300022 CEST	443	49745	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:12.104367971 CEST	49745	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:12.104643106 CEST	49745	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:12.104655981 CEST	443	49745	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:12.319545984 CEST	443	49745	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:12.321274042 CEST	49745	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:12.321300983 CEST	443	49745	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:12.907711029 CEST	443	49745	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:12.907780886 CEST	443	49745	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:12.907838106 CEST	49745	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:12.908348083 CEST	49745	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:12.908365965 CEST	443	49745	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:14.913203955 CEST	49746	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:14.913254023 CEST	443	49746	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:14.913363934 CEST	49746	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:14.913831949 CEST	49746	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:14.913844109 CEST	443	49746	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:15.535664082 CEST	443	49746	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:15.537362099 CEST	49746	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:15.537377119 CEST	443	49746	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:15.753870964 CEST	443	49746	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:15.753940105 CEST	443	49746	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:15.754120111 CEST	49746	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:15.754465103 CEST	49746	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:15.754481077 CEST	443	49746	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:15.755620003 CEST	49747	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:15.755649090 CEST	443	49747	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:15.755810976 CEST	49747	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:15.756059885 CEST	49747	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:15.756072044 CEST	443	49747	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:15.969257116 CEST	443	49747	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:15.970786095 CEST	49747	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:15.970803976 CEST	443	49747	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:16.177592993 CEST	443	49747	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:16.177663088 CEST	443	49747	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:16.177824974 CEST	49747	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:16.178272009 CEST	49747	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:16.178292036 CEST	443	49747	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:18.196717978 CEST	49750	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:18.196763039 CEST	443	49750	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:18.197010994 CEST	49750	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:18.197283030 CEST	49750	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:18.197299004 CEST	443	49750	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:20.975414038 CEST	443	49750	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:20.978137016 CEST	49750	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:20.978152037 CEST	443	49750	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:21.180007935 CEST	443	49750	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:21.180061102 CEST	443	49750	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:21.180107117 CEST	49750	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:21.180677891 CEST	49750	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:21.180692911 CEST	443	49750	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:21.182159901 CEST	49752	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:21.182198048 CEST	443	49752	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:21.182265997 CEST	49752	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:21.182636976 CEST	49752	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:21.182650089 CEST	443	49752	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:22.426817894 CEST	443	49752	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:22.454670906 CEST	49752	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:22.454699993 CEST	443	49752	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:22.971255064 CEST	443	49752	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:22.971313953 CEST	443	49752	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:22.971358061 CEST	49752	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:22.971980095 CEST	49752	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:22.971995115 CEST	443	49752	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:24.851037025 CEST	49755	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:24.851082087 CEST	443	49755	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:24.851139069 CEST	49755	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:24.851588964 CEST	49755	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:24.851597071 CEST	443	49755	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:25.072901964 CEST	443	49755	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:25.114808083 CEST	49755	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:25.156610966 CEST	49755	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:25.156625986 CEST	443	49755	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:25.286732912 CEST	443	49755	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:25.286793947 CEST	443	49755	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:25.286842108 CEST	49755	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:25.370594025 CEST	49755	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:25.370635986 CEST	443	49755	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:25.375230074 CEST	49756	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:25.375281096 CEST	443	49756	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:25.375340939 CEST	49756	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:25.379383087 CEST	49756	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:25.379411936 CEST	443	49756	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:25.596996069 CEST	443	49756	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:25.598440886 CEST	49756	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:25.598490000 CEST	443	49756	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:25.814085007 CEST	443	49756	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:25.814171076 CEST	443	49756	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:25.814785957 CEST	49756	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:25.815169096 CEST	49756	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:25.815181017 CEST	443	49756	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:27.569675922 CEST	49758	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:27.569741011 CEST	443	49758	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:27.569998980 CEST	49758	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:27.574244022 CEST	49758	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:27.574259996 CEST	443	49758	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:28.429446936 CEST	443	49758	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:28.431225061 CEST	49758	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:28.431258917 CEST	443	49758	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:28.635179043 CEST	443	49758	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:28.635256052 CEST	443	49758	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:28.635313034 CEST	49758	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:28.635814905 CEST	49758	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:28.635832071 CEST	443	49758	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:28.637154102 CEST	49759	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:28.637191057 CEST	443	49759	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:28.637254000 CEST	49759	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:28.637578964 CEST	49759	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:28.637588978 CEST	443	49759	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:28.845272064 CEST	443	49759	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:28.846630096 CEST	49759	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:28.846642017 CEST	443	49759	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:29.059205055 CEST	443	49759	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:29.059269905 CEST	443	49759	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:29.059318066 CEST	49759	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:29.059901953 CEST	49759	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:29.059919119 CEST	443	49759	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:30.694547892 CEST	49760	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:30.694602966 CEST	443	49760	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:30.694674969 CEST	49760	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:30.694988966 CEST	49760	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:30.695002079 CEST	443	49760	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:31.918390989 CEST	443	49760	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:31.922858953 CEST	49760	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:31.922882080 CEST	443	49760	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:32.126728058 CEST	443	49760	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:32.126780033 CEST	443	49760	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:32.131742001 CEST	49760	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:32.134161949 CEST	49760	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:32.134183884 CEST	443	49760	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:32.142563105 CEST	49761	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:32.142612934 CEST	443	49761	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:32.142868042 CEST	49761	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:32.146764040 CEST	49761	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:32.146791935 CEST	443	49761	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:32.353912115 CEST	443	49761	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:32.355129957 CEST	49761	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:32.355149031 CEST	443	49761	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:32.868926048 CEST	443	49761	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:32.868995905 CEST	443	49761	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:32.869056940 CEST	49761	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:32.869560003 CEST	49761	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:32.869591951 CEST	443	49761	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:34.398178101 CEST	49763	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:34.398277044 CEST	443	49763	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:34.401326895 CEST	49763	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:34.404181957 CEST	49763	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:34.404196024 CEST	443	49763	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:34.612169027 CEST	443	49763	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:34.645239115 CEST	49763	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:34.645265102 CEST	443	49763	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:34.826386929 CEST	443	49763	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:34.826438904 CEST	443	49763	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:34.826520920 CEST	49763	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:34.831779957 CEST	49763	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:34.831794024 CEST	443	49763	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:34.844707012 CEST	49764	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:34.844744921 CEST	443	49764	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:34.844882011 CEST	49764	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:34.845165968 CEST	49764	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:34.845179081 CEST	443	49764	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:35.693021059 CEST	443	49764	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:35.694576979 CEST	49764	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:35.694607973 CEST	443	49764	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:35.906373024 CEST	443	49764	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:35.906435013 CEST	443	49764	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:35.906485081 CEST	49764	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:35.906889915 CEST	49764	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:35.906903982 CEST	443	49764	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:37.336097002 CEST	49765	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:37.336148977 CEST	443	49765	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:37.336275101 CEST	49765	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:37.336548090 CEST	49765	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:37.336565971 CEST	443	49765	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:38.668046951 CEST	443	49765	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:38.671497107 CEST	49765	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:38.671526909 CEST	443	49765	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:39.007731915 CEST	443	49765	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:39.007788897 CEST	443	49765	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:39.008241892 CEST	49765	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:39.008338928 CEST	49765	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:39.008357048 CEST	443	49765	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:39.012168884 CEST	49767	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:39.012212992 CEST	443	49767	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:39.016335964 CEST	49767	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:39.020270109 CEST	49767	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:39.020282984 CEST	443	49767	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:39.650726080 CEST	443	49767	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:39.652306080 CEST	49767	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:39.652333021 CEST	443	49767	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:39.858023882 CEST	443	49767	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:39.858088970 CEST	443	49767	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:39.858133078 CEST	49767	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:39.858568907 CEST	49767	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:39.858581066 CEST	443	49767	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:41.194160938 CEST	49768	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:41.194197893 CEST	443	49768	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:41.194586992 CEST	49768	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:41.194586992 CEST	49768	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:41.194612980 CEST	443	49768	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:41.417588949 CEST	443	49768	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:41.419118881 CEST	49768	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:41.419131041 CEST	443	49768	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:42.014833927 CEST	443	49768	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:42.014892101 CEST	443	49768	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:42.014955044 CEST	49768	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:42.015381098 CEST	49768	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:42.015398026 CEST	443	49768	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:42.016611099 CEST	49769	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:42.016638041 CEST	443	49769	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:42.016705036 CEST	49769	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:42.016988039 CEST	49769	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:42.016994953 CEST	443	49769	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:42.657571077 CEST	443	49769	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:42.661616087 CEST	49769	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:42.661642075 CEST	443	49769	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:43.190596104 CEST	443	49769	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:43.190658092 CEST	443	49769	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:43.191113949 CEST	49769	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:43.191126108 CEST	443	49769	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:43.396267891 CEST	443	49769	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:43.396342993 CEST	49769	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:44.428711891 CEST	49770	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:44.428749084 CEST	443	49770	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:44.428812027 CEST	49770	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:44.429151058 CEST	49770	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:44.429164886 CEST	443	49770	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:45.302228928 CEST	443	49770	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:45.304193974 CEST	49770	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:45.304209948 CEST	443	49770	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:45.516383886 CEST	443	49770	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:45.516441107 CEST	443	49770	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:45.516495943 CEST	49770	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:45.516921997 CEST	49770	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:45.516940117 CEST	443	49770	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:45.518096924 CEST	49771	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:45.518130064 CEST	443	49771	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:45.518199921 CEST	49771	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:45.518548012 CEST	49771	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:45.518556118 CEST	443	49771	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:45.728529930 CEST	443	49771	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:45.730240107 CEST	49771	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:45.730252028 CEST	443	49771	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:45.945183992 CEST	443	49771	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:45.945293903 CEST	443	49771	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:45.945410013 CEST	49771	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:45.945811987 CEST	49771	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:45.945831060 CEST	443	49771	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:47.100290060 CEST	49773	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:47.100325108 CEST	443	49773	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:47.101311922 CEST	49773	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:47.101716042 CEST	49773	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:47.101730108 CEST	443	49773	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:48.335457087 CEST	443	49773	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:48.351535082 CEST	49773	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:48.351638079 CEST	443	49773	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:48.351696968 CEST	49773	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:49.446146965 CEST	49775	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:49.446175098 CEST	443	49775	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:49.446438074 CEST	49775	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:49.446726084 CEST	49775	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:49.446733952 CEST	443	49775	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:53.242016077 CEST	443	49775	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:53.242113113 CEST	49775	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:54.781651020 CEST	49775	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:54.781671047 CEST	443	49775	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:54.782033920 CEST	443	49775	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:54.785893917 CEST	49775	443	192.168.2.7	207.174.26.219
Mar 30, 2025 18:05:54.785943031 CEST	443	49775	207.174.26.219	192.168.2.7
Mar 30, 2025 18:05:54.785999060 CEST	49775	443	192.168.2.7	207.174.26.219

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 30, 2025 18:04:17.558356047 CEST	64038	53	192.168.2.7	1.1.1.1
Mar 30, 2025 18:04:17.664057016 CEST	53	64038	1.1.1.1	192.168.2.7
Mar 30, 2025 18:04:54.561300993 CEST	53	63077	162.159.36.2	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 30, 2025 18:04:17.558356047 CEST	192.168.2.7	1.1.1.1	0x661e	Standard query (0)	i.ibb.co	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 30, 2025 18:04:17.664057016 CEST	1.1.1.1	192.168.2.7	0x661e	No error (0)	i.ibb.co		207.174.26.219	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

i.ibb.co

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49684	207.174.26.219	443	6276	C:\Users\user\Desktop\WizClient.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-30 16:04:17 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49685	207.174.26.219	443	6276	C:\Users\user\Desktop\WizClient.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-30 16:04:18 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49687	207.174.26.219	443	6276	C:\Users\user\Desktop\WizClient.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-30 16:04:20 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49688	207.174.26.219	443	6276	C:\Users\user\Desktop\WizClient.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-30 16:04:21 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49689	207.174.26.219	443	6276	C:\Users\user\Desktop\WizClient.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-30 16:04:24 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49690	207.174.26.219	443	6276	C:\Users\user\Desktop\WizClient.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-30 16:04:24 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49693	207.174.26.219	443	6276	C:\Users\user\Desktop\WizClient.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-30 16:04:27 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49694	207.174.26.219	443	6276	C:\Users\user\Desktop\WizClient.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-30 16:04:28 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49701	207.174.26.219	443	6276	C:\Users\user\Desktop\WizClient.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-30 16:04:31 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	49702	207.174.26.219	443	6276	C:\Users\user\Desktop\WizClient.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-30 16:04:32 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	49704	207.174.26.219	443	6276	C:\Users\user\Desktop\WizClient.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-30 16:04:34 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	49705	207.174.26.219	443	6276	C:\Users\user\Desktop\WizClient.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-30 16:04:35 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.7	49710	207.174.26.219	443	6276	C:\Users\user\Desktop\WizClient.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-30 16:04:39 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.7	49713	207.174.26.219	443	6276	C:\Users\user\Desktop\WizClient.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-30 16:04:40 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.7	49717	207.174.26.219	443	6276	C:\Users\user\Desktop\WizClient.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-30 16:04:42 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.7	49718	207.174.26.219	443	6276	C:\Users\user\Desktop\WizClient.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-30 16:04:43 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.7	49720	207.174.26.219	443	6276	C:\Users\user\Desktop\WizClient.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-30 16:04:45 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.7	49722	207.174.26.219	443	6276	C:\Users\user\Desktop\WizClient.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-30 16:04:46 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.7	49724	207.174.26.219	443	6276	C:\Users\user\Desktop\WizClient.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-30 16:04:48 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.7	49725	207.174.26.219	443	6276	C:\Users\user\Desktop\WizClient.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-30 16:04:49 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.7	49726	207.174.26.219	443	6276	C:\Users\user\Desktop\WizClient.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-30 16:04:51 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.7	49727	207.174.26.219	443	6276	C:\Users\user\Desktop\WizClient.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-30 16:04:52 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.7	49730	207.174.26.219	443	6276	C:\Users\user\Desktop\WizClient.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-30 16:04:55 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.7	49731	207.174.26.219	443	6276	C:\Users\user\Desktop\WizClient.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-30 16:04:56 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.7	49734	207.174.26.219	443	6276	C:\Users\user\Desktop\WizClient.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-30 16:04:58 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.7	49735	207.174.26.219	443	6276	C:\Users\user\Desktop\WizClient.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-30 16:05:00 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.7	49738	207.174.26.219	443	6276	C:\Users\user\Desktop\WizClient.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-30 16:05:02 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.7	49739	207.174.26.219	443	6276	C:\Users\user\Desktop\WizClient.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-30 16:05:04 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.7	49740	207.174.26.219	443	6276	C:\Users\user\Desktop\WizClient.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-30 16:05:07 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.7	49741	207.174.26.219	443	6276	C:\Users\user\Desktop\WizClient.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-30 16:05:09 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.7	49744	207.174.26.219	443	6276	C:\Users\user\Desktop\WizClient.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-30 16:05:11 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.7	49745	207.174.26.219	443	6276	C:\Users\user\Desktop\WizClient.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-30 16:05:12 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.7	49746	207.174.26.219	443	6276	C:\Users\user\Desktop\WizClient.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-30 16:05:15 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.7	49747	207.174.26.219	443	6276	C:\Users\user\Desktop\WizClient.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-30 16:05:15 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.7	49750	207.174.26.219	443	6276	C:\Users\user\Desktop\WizClient.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-30 16:05:20 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.7	49752	207.174.26.219	443	6276	C:\Users\user\Desktop\WizClient.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-30 16:05:22 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.7	49755	207.174.26.219	443	6276	C:\Users\user\Desktop\WizClient.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-30 16:05:25 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.7	49756	207.174.26.219	443	6276	C:\Users\user\Desktop\WizClient.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-30 16:05:25 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.7	49758	207.174.26.219	443	6276	C:\Users\user\Desktop\WizClient.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-30 16:05:28 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.7	49759	207.174.26.219	443	6276	C:\Users\user\Desktop\WizClient.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-30 16:05:28 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.7	49760	207.174.26.219	443	6276	C:\Users\user\Desktop\WizClient.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-30 16:05:31 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.7	49761	207.174.26.219	443	6276	C:\Users\user\Desktop\WizClient.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-30 16:05:32 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.7	49763	207.174.26.219	443	6276	C:\Users\user\Desktop\WizClient.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-30 16:05:34 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.7	49764	207.174.26.219	443	6276	C:\Users\user\Desktop\WizClient.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-30 16:05:35 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.7	49765	207.174.26.219	443	6276	C:\Users\user\Desktop\WizClient.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-30 16:05:38 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.7	49767	207.174.26.219	443	6276	C:\Users\user\Desktop\WizClient.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-30 16:05:39 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.7	49768	207.174.26.219	443	6276	C:\Users\user\Desktop\WizClient.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-30 16:05:41 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.7	49769	207.174.26.219	443	6276	C:\Users\user\Desktop\WizClient.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-30 16:05:42 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.7	49770	207.174.26.219	443	6276	C:\Users\user\Desktop\WizClient.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-30 16:05:45 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.7	49771	207.174.26.219	443	6276	C:\Users\user\Desktop\WizClient.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-30 16:05:45 UTC	75	OUT	GET /Dwrj41N/Image.png HTTP/1.1 Host: i.ibb.co Connection: Keep-Alive

Statistics

Click to jump to process

Memory Usage

• WizClient.exe
• WerFault.exe

Click to jump to process

High Level Behavior Distribution

• File
• Registry
• Network

Click to dive into process behavior distribution

Behavior

• WizClient.exe
• WerFault.exe

Click to jump to process

System Behavior

Analysis Process: WizClient.exePID: 6276, Parent PID: 4088

Function Logs

General

Target ID:	0
Start time:	12:04:07
Start date:	30/03/2025
Path:	C:\Users\user\Desktop\WizClient.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\WizClient.exe"
Imagebase:	0x7d0000
File size:	31'232 bytes
MD5 hash:	51DC79AC2451E7AD8809D28EE07602B4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000000.934418415.00000000007D2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000000.934418415.00000000007D2000.00000002.00000001.01000000.00000003.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

File Activities

File Opened

File Created

File Read

File Attributes Queried

Other File Operations

Volume Information Queried

Device IO

Show Windows behavior

Section Activities

Sections loaded by Windows

Sections loaded by Program

Show Windows behavior

Registry Activities

Key Opened

Key Value Queried

Key Monitored

Key Value Enumerated

Key Enumerated

COM Activities

COM Object Queried

Show Windows behavior

Mutex Activities

Mutex Created

Show Windows behavior

Process Activities

Process Queried

Process Information Set

Show Windows behavior

Thread Activities

Thread Created

Thread APC Queued

Thread Execution Resumed

Thread Delayed

Thread Information Set

Show Windows behavior

Memory Activities

Memory Allocated

Memory Protection Changed

Memory Usage Statistics

Show Windows behavior

System Activities

System Information Set

Language or Locale ID Queried

System Information Queried

Show Windows behavior

Timing Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Windows UI Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Network Activities

Socket bound

Socket connected

Process Token Activities

Token Adjusted

Show Windows behavior

LPC Port Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 5560, Parent PID: 6276

Function Logs

General

Target ID:	13
Start time:	12:05:49
Start date:	30/03/2025
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 6276 -s 2280
Imagebase:	0x7ff612c70000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

File Activities

File Opened

File Created

File Written

File Attributes Queried

Other File Operations

Volume Information Queried

Show Windows behavior

Section Activities

Sections loaded by Windows

Sections loaded by Program

Show Windows behavior

Registry Activities

Key Opened

Key Created

Key Deleted

Key Value Created

Show Windows behavior

Mutex Activities

Mutex Created

Show Windows behavior

Process Activities

Process Queried

Process Information Set

Process Suspended

Show Windows behavior

Thread Activities

Thread Created

Thread Execution Resumed

Thread Execution Suspended

Thread Terminated

Thread Information Set

Show Windows behavior

Memory Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

System Activities

System Information Set

Language or Locale ID Queried

System Information Queried

Show Windows behavior

Timing Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Windows UI Activities

Window UI Enumerated

Show Windows behavior

Object Security Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

LPC Port Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Chronological Activities

Disassembly

Analysis Process: WizClient.exePID: 6276, Parent PID: 4088COMMON

Executed Functions

Function 00007FFB9AA61AF5 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2000127391.00007FFB9AA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB9AA60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb9aa60000_WizClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 229de08d9d26d16a57897b9eef0eabbfb33f14446597d0d4c58cfbd5e299e640
Instruction ID: 56b569fa8c0439ec14376d08f21fbb2c71e493d6568d5fcb86e0da74c794d536
Opcode Fuzzy Hash: 229de08d9d26d16a57897b9eef0eabbfb33f14446597d0d4c58cfbd5e299e640
Instruction Fuzzy Hash: 3B9148B1A1CA898FE369DB78C8552BD7BD5EF95715F0401BEE04DC72D2DE246842CB80

Function 00007FFB9AA606C8 Relevance: 1.5, Strings: 1, Instructions: 279COMMON

Download Yara Rule

Strings

N_^, xrefs: 00007FFB9AA606EA

Memory Dump Source

Source File: 00000000.00000002.2000127391.00007FFB9AA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB9AA60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb9aa60000_WizClient.jbxd

Similarity

API ID:
String ID: N_^
API String ID: 0-884294832
Opcode ID: 0afacb9b35194cf5938334e57ad09c5f04fb8c9fbfe92be6cabb9b887c3e9fdf
Instruction ID: 69cab648228e8940c65467609f8c64d2ba3a5210e88058c827d198a5c0806c52
Opcode Fuzzy Hash: 0afacb9b35194cf5938334e57ad09c5f04fb8c9fbfe92be6cabb9b887c3e9fdf
Instruction Fuzzy Hash: 71813CE1B1CA4A4FE7A8EB7CC4552BD7AD1EFA8714B5405BDD04DD32C7DD2868028781

Function 00007FFB9AA61714 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2000127391.00007FFB9AA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB9AA60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb9aa60000_WizClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7d4164622240614ecc011b3f47e786b460b0000fc3a00bce7b17f6f3bf34e2a
Instruction ID: 34ce9bb273d9f825550e6fe25fdd0bee992b4df4b555344b4e332939d9ea03f3
Opcode Fuzzy Hash: b7d4164622240614ecc011b3f47e786b460b0000fc3a00bce7b17f6f3bf34e2a
Instruction Fuzzy Hash: A7A16CA1A1CA8A0FE759977CC8552AD7FD1EFA5764F5401FDD089C32C7CD2868038781

Function 00007FFB9AA606F8 Relevance: .3, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2000127391.00007FFB9AA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB9AA60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb9aa60000_WizClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 767f2b933079aaeec6500bf577280a41b6ddabe362cb92636cc5631444487c1b
Instruction ID: d0381e22df56b76d21d522df35a3874e8698114f435dcb0a5737d83c2795fdbd
Opcode Fuzzy Hash: 767f2b933079aaeec6500bf577280a41b6ddabe362cb92636cc5631444487c1b
Instruction Fuzzy Hash: A4811CE1B18A0A0FE798EB7CC4552BD7BD5EFA8754B5405BDD04ED32C6DD286C028781

Function 00007FFB9AA62685 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2000127391.00007FFB9AA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB9AA60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb9aa60000_WizClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be6f3db4f25dd174feda8e35bc1987e3c8ca604f9e37d3f40a2fcb5b18595193
Instruction ID: 2c9b0d749e7368f2dbcc64da5f35eb1d8c46ded9c4ca583a12af6137b3b6e039
Opcode Fuzzy Hash: be6f3db4f25dd174feda8e35bc1987e3c8ca604f9e37d3f40a2fcb5b18595193
Instruction Fuzzy Hash: BF61F4B1D0C6498FD759DB78C855AB8BBE4EF66320F0841BBD048C71D3DA29A846CB91

Function 00007FFB9AA60438 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2000127391.00007FFB9AA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB9AA60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb9aa60000_WizClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cfd02f5c85b396d38f37416f658dbd15c84fd71291eac9b7603bf2e2ccbe5a4
Instruction ID: 6ad6bf9edcca0174af718d030d719439d1df4d10d7546e592377b132bed55c7b
Opcode Fuzzy Hash: 1cfd02f5c85b396d38f37416f658dbd15c84fd71291eac9b7603bf2e2ccbe5a4
Instruction Fuzzy Hash: A8513AA2B0C6850FE354EBBCD8692B87BC1EF85214B0840FFE08DC71E7DD18A8468385

Function 00007FFB9AA60F9E Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2000127391.00007FFB9AA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB9AA60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb9aa60000_WizClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 755be6e727317fecb98330390a3da9de0967c91b532b5489d18951bc5f9abde6
Instruction ID: b824b9ffa57bae9da1dd9ec988f9d1683365a9d13fb0ca56af548e96c3589316
Opcode Fuzzy Hash: 755be6e727317fecb98330390a3da9de0967c91b532b5489d18951bc5f9abde6
Instruction Fuzzy Hash: E4515A61B1CA860FE7A6A778C8565797FD1DF96620B0840FAD48DC32D3DC1CAC438791

Function 00007FFB9AA60915 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2000127391.00007FFB9AA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB9AA60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb9aa60000_WizClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22e2e33bed19b419499a5c876049494beae94a6c1f1a72a797deeedb445e8ca4
Instruction ID: dd31f829ad826298853e0f173fda9533fa77799531c354bca17b95c1de8e0316
Opcode Fuzzy Hash: 22e2e33bed19b419499a5c876049494beae94a6c1f1a72a797deeedb445e8ca4
Instruction Fuzzy Hash: E3517BA1A28A4E1FE7A8FB78C8595BD7BA1FF54760B4045BDD04EC31CBDD68A8018780

Function 00007FFB9AA60B89 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2000127391.00007FFB9AA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB9AA60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb9aa60000_WizClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b44c0c5b1224ed07c66e9cf395880d023417061debc99f615bffd49ab8c060f9
Instruction ID: d95049b16a2d12c9e7dc9b5aa4be01fe61deb0be42b2b509827fcd749751e8e7
Opcode Fuzzy Hash: b44c0c5b1224ed07c66e9cf395880d023417061debc99f615bffd49ab8c060f9
Instruction Fuzzy Hash: D741E6A1B1CA894FD798AB7C8869275BBD5DF9A215F0801FEE08DC32D7CD189C46C345

Function 00007FFB9AA614CD Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2000127391.00007FFB9AA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB9AA60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb9aa60000_WizClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf4af0d0b0f8a0058f59e8a0e30fe6f56565fbe9933c79945a82f39258e36c85
Instruction ID: a5cda99176c2db3bca42233ab5f3113e04f64ceba4166017d5712d9b143b06e0
Opcode Fuzzy Hash: cf4af0d0b0f8a0058f59e8a0e30fe6f56565fbe9933c79945a82f39258e36c85
Instruction Fuzzy Hash: 294182B4908A1C8FDB68EF68D459BA9BBE0FF65311F0042AED44AD3691CB35A841CB41

Function 00007FFB9AA60748 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2000127391.00007FFB9AA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB9AA60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb9aa60000_WizClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3d4522fecfb4f153c70c9a3d008663ac06c0bab824b5c21fc7d146d1e8f06ec
Instruction ID: 224e216628cb43ad686743033deb4a072ec89e1dec9c5e7c1704db134a3e4eef
Opcode Fuzzy Hash: d3d4522fecfb4f153c70c9a3d008663ac06c0bab824b5c21fc7d146d1e8f06ec
Instruction Fuzzy Hash: 384182B460891C8FEB68EF68D495BA9BBE5FB64711F0001BED40AD3691CB75E841CB80

Function 00007FFB9AA604C8 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2000127391.00007FFB9AA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB9AA60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb9aa60000_WizClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6546cb9c278f26fd486709182fd2cc3e5abaf9e092868a3b1493b5ff1cdbd8c
Instruction ID: 1fac166b4cd389dd0a846dc3048d4824e98bea4428e6588978bb82534551f870
Opcode Fuzzy Hash: a6546cb9c278f26fd486709182fd2cc3e5abaf9e092868a3b1493b5ff1cdbd8c
Instruction Fuzzy Hash: 8A31D5A1B189494FE798EB7CC85A279B7C6EF99715F0401BEE04EC32D7CD189C428345

Function 00007FFB9AA60E39 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2000127391.00007FFB9AA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB9AA60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb9aa60000_WizClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e96a1cd642f74330ec052cc691479a36612f8cf46597f8536e7acb4d2ac4a253
Instruction ID: a6818c0004588fae04f4695a6cc04c50258e91ab3240374a8b73198f7fdcb3a7
Opcode Fuzzy Hash: e96a1cd642f74330ec052cc691479a36612f8cf46597f8536e7acb4d2ac4a253
Instruction Fuzzy Hash: CF31E791B18A0A4FE744BBFCDC593BD7AD5EF98751F0441BAE00CC32D6DE18A8418781

Function 00007FFB9AA60CF1 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2000127391.00007FFB9AA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB9AA60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb9aa60000_WizClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e30326610a0d7c9f4547d13c63a99f5ccaa70bfc14ad58b9e83a9149244a4da
Instruction ID: 0ab387b532475b8d7429ccdf34d976ccbc62fa19a3a3356768f4e775aa7c5224
Opcode Fuzzy Hash: 6e30326610a0d7c9f4547d13c63a99f5ccaa70bfc14ad58b9e83a9149244a4da
Instruction Fuzzy Hash: 9E4194B4A18A0E9FD744EBB8C8956FD7BB1FF88310F504579D149D32CACD2868418B90

Function 00007FFB9AA61415 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2000127391.00007FFB9AA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB9AA60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb9aa60000_WizClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8a9cbb7530af588dfb4b262e45aa4778ccde60bd9b7af68a2f2fe0a0c406336
Instruction ID: 907612942e792a0c1c78bbb1756846e55c2a7c1a3c26800f7e4561a6a2adc3aa
Opcode Fuzzy Hash: b8a9cbb7530af588dfb4b262e45aa4778ccde60bd9b7af68a2f2fe0a0c406336
Instruction Fuzzy Hash: 182109E1E0C6034BF7A4A778C45627D3A96AFA0710F5450F9D00DC71C7DE6CA8434785

Function 00007FFB9AA612E1 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2000127391.00007FFB9AA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB9AA60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb9aa60000_WizClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8e8b55c0f8bf837ca4cbe90663d3a73cadb65283f9b24d9a291a5632356dcd1
Instruction ID: b071d9892bfe8932191173db8f5953e3d0d2fd3f03fd77789f1c0f916dcb5af9
Opcode Fuzzy Hash: d8e8b55c0f8bf837ca4cbe90663d3a73cadb65283f9b24d9a291a5632356dcd1
Instruction Fuzzy Hash: 891120F1958A8E9FE388DB3888961B93FF1EBA4212B4441FFC849D3695CA3011018780

Function 00007FFB9AA60AB8 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2000127391.00007FFB9AA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB9AA60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb9aa60000_WizClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ae83ba676c1168a1803a0d607dfec81aeeef79ab134d5ab810a4e91d1e9359a
Instruction ID: 03ddb4adb5b2e02e5cdfc2d973bb8030f9a053d564bd48fc63beeacd4e918615
Opcode Fuzzy Hash: 2ae83ba676c1168a1803a0d607dfec81aeeef79ab134d5ab810a4e91d1e9359a
Instruction Fuzzy Hash: 1B0149A2F1CD560BE769A3BCA4650FCA7C1DF58660B0841BDD05EC31C7CE59A8425789

Function 00007FFB9AA61391 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2000127391.00007FFB9AA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB9AA60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb9aa60000_WizClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9d9ebfd2567ddcf4cc333c9db8f63aacbb106272c47f0b263ad18a2e842deb8
Instruction ID: 1a6c46b348825030d74bac0d1b741a94437a7cc4fb68ff0f0c1928d492319e3f
Opcode Fuzzy Hash: f9d9ebfd2567ddcf4cc333c9db8f63aacbb106272c47f0b263ad18a2e842deb8
Instruction Fuzzy Hash: 4A01ADD0E0D6864FF7A4A378C46A27C3E95EFA4604F4411F9D04AC79C7EE5CA8428745

Function 00007FFB9AA61DED Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2000127391.00007FFB9AA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB9AA60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb9aa60000_WizClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40f34c9a13aa9e426ce26f5bf8a249337bb4ea370831410cb64fadbe7ab7888e
Instruction ID: 32c1b4bd80c84660bad9e79bec5061d15dba5266f0d3f2e42809afaccebd2a30
Opcode Fuzzy Hash: 40f34c9a13aa9e426ce26f5bf8a249337bb4ea370831410cb64fadbe7ab7888e
Instruction Fuzzy Hash: 99E092B120C51C5FDB54FB65EC4EAEA3B6CFB81335F00112FE80EC2142E525A126C7A1

Function 00007FFB9AA6147B Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2000127391.00007FFB9AA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB9AA60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb9aa60000_WizClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6e393bed137ef7733aaa9029c4900fe6e3c9feaf9c6ffa7691916047df5c3b9
Instruction ID: 9035ba9a2ef6a2dea02faad8ab94ca2ea150da267af5731fc3c3f019059d854a
Opcode Fuzzy Hash: e6e393bed137ef7733aaa9029c4900fe6e3c9feaf9c6ffa7691916047df5c3b9
Instruction Fuzzy Hash: 57F049E4D0C5168BF375E774C54927D7AAAAFA1B20F9096B8D01DC31D2DE28B8538A80

Function 00007FFB9AA612A4 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2000127391.00007FFB9AA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB9AA60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb9aa60000_WizClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f84d8e6657066afb7a2dad7ea631b2fe1a2771d3ac37f672c3414afdbf81864e
Instruction ID: 8d0310508247d7da8954cf7b1ce2e29b0c3a3374ee59dc3ab2d82fc34f49871b
Opcode Fuzzy Hash: f84d8e6657066afb7a2dad7ea631b2fe1a2771d3ac37f672c3414afdbf81864e
Instruction Fuzzy Hash: 76D0C780C0E2C20BE32B23B40C829847F288E132A0B9942E2D480C70D3E88D249B8372

Function 00007FFB9AA61161 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2000127391.00007FFB9AA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB9AA60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb9aa60000_WizClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 028b367c0bcd80a34a834283f7117496f09d4f6f892adb74ea87f37949aafd97
Instruction ID: 8ee7554561b7a9dd2935af00434e2e08fb75d2b21f76124181c9ad90578711c7
Opcode Fuzzy Hash: 028b367c0bcd80a34a834283f7117496f09d4f6f892adb74ea87f37949aafd97
Instruction Fuzzy Hash: B6D02B72C2938D8FD7516B7084161DA7730FF84300F85069BE41C82051EF2462158792

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report WizClient.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Xworm

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_WizClient.exe_74683884012ecc2609bd869a5ad26296ce7633_ce251f58_55e6a882-50c0-4a28-b877-42a841f3bad5\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDC76.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDE6B.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDEF9.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Windows Analysis Report
WizClient.exe