Edit tour
Windows
Analysis Report
MXpl6HFisn.exe
Overview
General Information
| Sample name: | MXpl6HFisn.exerenamed because original name is a hash value |
| Original sample name: | 0aadbca2d0a26b8f90fd4f31cb7f2ffc.exe |
| Analysis ID: | 1417443 |
| MD5: | 0aadbca2d0a26b8f90fd4f31cb7f2ffc |
| SHA1: | 57246459c3890dfcd49fb792cc55a45e3bd6c48e |
| SHA256: | 4bee7d558a5346bffa5cc2393b579bd8abbdd6beef0ede8e71aeae10dd5ff207 |
| Tags: | exeRiseProStealer |
| Infos: |   |
 | |
Detection
RisePro Stealer
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Yara detected RisePro Stealer
Allocates memory in foreign processes
Contains functionality to inject threads in other processes
Creates autostart registry keys with suspicious names
Found API chain indicative of sandbox detection
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Sigma detected: Execution from Suspicious Folder
Sigma detected: New RUN Key Pointing to Suspicious Folder
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Abnormal high CPU Usage
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to detect sandboxes (mouse cursor move detection)
Contains functionality to dynamically determine API calls
Contains functionality to launch a process as a different user
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to record screenshots
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries information about the installed CPU (vendor, model number etc)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Tries to load missing DLLs
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses the keyboard layout for branch decision (may execute only for specific keyboard layouts)
Uses the system / local time for branch decision (may execute only at specific dates)
Yara signature match
Classification
- System is w10x64
MXpl6HFisn.exe (PID: 6880 cmdline: "C:\Users\ user\Deskt op\MXpl6HF isn.exe" MD5: 0AADBCA2D0A26B8F90FD4F31CB7F2FFC) 
BitLockerToGo.exe (PID: 2004 cmdline: C:\Windows \BitLocker DiscoveryV olumeConte nts\BitLoc kerToGo.ex e MD5: A64BEAB5D4516BECA4C40B25DC0C1CD8)
- (0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe (PID: 2032 cmdline:
"C:\Users\ Public\Lib raries\(0a adbca2d0a2 6b8f90fd4f 31cb7f2ffc )MXpl6HFis n.exe" MD5: 0AADBCA2D0A26B8F90FD4F31CB7F2FFC) - BitLockerToGo.exe (PID: 6884 cmdline:
C:\Windows \BitLocker DiscoveryV olumeConte nts\BitLoc kerToGo.ex e MD5: A64BEAB5D4516BECA4C40B25DC0C1CD8)
- (0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe (PID: 4904 cmdline:
"C:\Users\ Public\Lib raries\(0a adbca2d0a2 6b8f90fd4f 31cb7f2ffc )MXpl6HFis n.exe" MD5: 0AADBCA2D0A26B8F90FD4F31CB7F2FFC) - BitLockerToGo.exe (PID: 5500 cmdline:
C:\Windows \BitLocker DiscoveryV olumeConte nts\BitLoc kerToGo.ex e MD5: A64BEAB5D4516BECA4C40B25DC0C1CD8)
- cleanup
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_RiseProStealer | Yara detected RisePro Stealer | Joe Security |
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_RiseProStealer | Yara detected RisePro Stealer | Joe Security | ||
| Msfpayloads_msf_9 | Metasploit Payloads - file msf.war - contents | Florian Roth |
| |
| Msfpayloads_msf_9 | Metasploit Payloads - file msf.war - contents | Florian Roth |
| |
| Msfpayloads_msf_9 | Metasploit Payloads - file msf.war - contents | Florian Roth |
| |
| Msfpayloads_msf_9 | Metasploit Payloads - file msf.war - contents | Florian Roth |
| |
| Click to see the 3 entries | ||||
System Summary |   |
|---|
| Source: | Author: Florian Roth (Nextron Systems), Tim Shelton: | ||
| Source: | Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: | ||
| Source: | Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): | ||
| Timestamp: | 03/29/24-09:52:15.811203 |
| SID: | 2046266 |
| Source Port: | 50500 |
| Destination Port: | 49730 |
| Protocol: | TCP |
| Classtype: | A Network Trojan was detected |
| Timestamp: | 03/29/24-09:52:21.606984 |
| SID: | 2046269 |
| Source Port: | 49730 |
| Destination Port: | 50500 |
| Protocol: | TCP |
| Classtype: | A Network Trojan was detected |
| Timestamp: | 03/29/24-09:52:16.065250 |
| SID: | 2046267 |
| Source Port: | 50500 |
| Destination Port: | 49730 |
| Protocol: | TCP |
| Classtype: | A Network Trojan was detected |
| Timestamp: | 03/29/24-09:52:25.278346 |
| SID: | 2046266 |
| Source Port: | 50500 |
| Destination Port: | 49739 |
| Protocol: | TCP |
| Classtype: | A Network Trojan was detected |
| Timestamp: | 03/29/24-09:52:33.605110 |
| SID: | 2046266 |
| Source Port: | 50500 |
| Destination Port: | 49743 |
| Protocol: | TCP |
| Classtype: | A Network Trojan was detected |
| Timestamp: | 03/29/24-09:52:25.741725 |
| SID: | 2046266 |
| Source Port: | 50500 |
| Destination Port: | 49740 |
| Protocol: | TCP |
| Classtype: | A Network Trojan was detected |
| Timestamp: | 03/29/24-09:52:15.776952 |
| SID: | 2049060 |
| Source Port: | 49730 |
| Destination Port: | 50500 |
| Protocol: | TCP |
| Classtype: | A Network Trojan was detected |
| Timestamp: | 03/29/24-09:52:23.971378 |
| SID: | 2049660 |
| Source Port: | 50500 |
| Destination Port: | 49730 |
| Protocol: | TCP |
| Classtype: | A Network Trojan was detected |
Click to jump to signature section
Show All Signature Results
AV Detection | |
|---|
| Source: | ReversingLabs: | |||
| Source: | Virustotal: | Perma Link | ||
| Source: | Virustotal: | Perma Link | ||
| Source: | ReversingLabs: | |||
| Source: | Code function: | 2_2_02A20380 | |
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Code function: | 2_2_02A3E200 | |
| Source: | Code function: | 2_2_02ADC3BA | |
| Source: | Code function: | 2_2_02A0E0B0 | |
| Source: | Code function: | 2_2_02A0A6B0 | |
| Source: | Code function: | 2_2_02A20CC3 | |
| Source: | Code function: | 2_2_02ADC440 | |
| Source: | Code function: | 2_2_02A3FD60 | |
| Source: | Code function: | 2_2_0508A17B | |
| Source: | Code function: | 2_2_050590F0 | |
| Source: | Code function: | 2_2_05059990 | |
Networking | |
|---|
| Source: | Snort IDS: | ||
| Source: | Snort IDS: | ||
| Source: | Snort IDS: | ||
| Source: | Snort IDS: | ||
| Source: | Snort IDS: | ||
| Source: | Snort IDS: | ||
| Source: | Snort IDS: | ||
| Source: | Snort IDS: | ||
| Source: | TCP traffic: | ||
| Source: | IP Address: | ||
| Source: | IP Address: | ||
| Source: | IP Address: | ||
| Source: | ASN Name: | ||
| Source: | JA3 fingerprint: | ||
| Source: | DNS query: | ||
| Source: | DNS query: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | Code function: | 2_2_02A1F5F0 | |
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Code function: | 2_2_02A0AE90 | |
| Source: | Code function: | 2_2_05061510 | |
System Summary | |
|---|
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Process Stats: | ||
| Source: | Code function: | 2_2_0505A360 | |
| Source: | Code function: | 2_2_02A3E200 | |
| Source: | Code function: | 2_2_02A8E240 | |
| Source: | Code function: | 2_2_02A2C3B0 | |
| Source: | Code function: | 2_2_02A0E0B0 | |
| Source: | Code function: | 2_2_02A561A0 | |
| Source: | Code function: | 2_2_02A287E0 | |
| Source: | Code function: | 2_2_02A3C720 | |
| Source: | Code function: | 2_2_02ACC4A0 | |
| Source: | Code function: | 2_2_02A60400 | |
| Source: | Code function: | 2_2_02AEA58E | |
| Source: | Code function: | 2_2_02A24A10 | |
| Source: | Code function: | 2_2_02A6286B | |
| Source: | Code function: | 2_2_02A2E9A0 | |
| Source: | Code function: | 2_2_02A3C9B0 | |
| Source: | Code function: | 2_2_02A38930 | |
| Source: | Code function: | 2_2_02A8CEC0 | |
| Source: | Code function: | 2_2_02A42E70 | |
| Source: | Code function: | 2_2_02A62F97 | |
| Source: | Code function: | 2_2_02A2AD70 | |
| Source: | Code function: | 2_2_02A23270 | |
| Source: | Code function: | 2_2_02A3B3B0 | |
| Source: | Code function: | 2_2_02A8D340 | |
| Source: | Code function: | 2_2_02A43090 | |
| Source: | Code function: | 2_2_02A5B160 | |
| Source: | Code function: | 2_2_02A41150 | |
| Source: | Code function: | 2_2_02A357D0 | |
| Source: | Code function: | 2_2_02A37710 | |
| Source: | Code function: | 2_2_02A49480 | |
| Source: | Code function: | 2_2_02A5D4C0 | |
| Source: | Code function: | 2_2_02A8D5A0 | |
| Source: | Code function: | 2_2_02A55B20 | |
| Source: | Code function: | 2_2_02ADB830 | |
| Source: | Code function: | 2_2_02A3D840 | |
| Source: | Code function: | 2_2_02A31E10 | |
| Source: | Code function: | 2_2_02A57E70 | |
| Source: | Code function: | 2_2_02A25D70 | |
| Source: | Code function: | 2_2_02A882B0 | |
| Source: | Code function: | 2_2_02ACE220 | |
| Source: | Code function: | 2_2_02AF8244 | |
| Source: | Code function: | 2_2_02A44387 | |
| Source: | Code function: | 2_2_02A8E030 | |
| Source: | Code function: | 2_2_02A28069 | |
| Source: | Code function: | 2_2_02A2E048 | |
| Source: | Code function: | 2_2_02A1A1F0 | |
| Source: | Code function: | 2_2_02A46160 | |
| Source: | Code function: | 2_2_02A2E169 | |
| Source: | Code function: | 2_2_02A5E697 | |
| Source: | Code function: | 2_2_02ABC690 | |
| Source: | Code function: | 2_2_02A58609 | |
| Source: | Code function: | 2_2_02A8A780 | |
| Source: | Code function: | 2_2_02A58769 | |
| Source: | Code function: | 2_2_02A024F0 | |
| Source: | Code function: | 2_2_02A5C4C9 | |
| Source: | Code function: | 2_2_02AA4411 | |
| Source: | Code function: | 2_2_02A165E9 | |
| Source: | Code function: | 2_2_02A4C550 | |
| Source: | Code function: | 2_2_02A84550 | |
| Source: | Code function: | 2_2_02AB6550 | |
| Source: | Code function: | 2_2_02A88A6B | |
| Source: | Code function: | 2_2_02A18BB8 | |
| Source: | Code function: | 2_2_02A32B99 | |
| Source: | Code function: | 2_2_02A38BC7 | |
| Source: | Code function: | 2_2_02A8CB70 | |
| Source: | Code function: | 2_2_02AEA8D0 | |
| Source: | Code function: | 2_2_02A4A830 | |
| Source: | Code function: | 2_2_02A90860 | |
| Source: | Code function: | 2_2_02A14840 | |
| Source: | Code function: | 2_2_02A829B0 | |
| Source: | Code function: | 2_2_02AE4E88 | |
| Source: | Code function: | 2_2_02AE6EC0 | |
| Source: | Code function: | 2_2_02A94E00 | |
| Source: | Code function: | 2_2_02A58E18 | |
| Source: | Code function: | 2_2_02A84F80 | |
| Source: | Code function: | 2_2_02A9AF20 | |
| Source: | Code function: | 2_2_02A952F0 | |
| Source: | Code function: | 2_2_02A41208 | |
| Source: | Code function: | 2_2_02A8F261 | |
| Source: | Code function: | 2_2_02AD5390 | |
| Source: | Code function: | 2_2_02AD1370 | |
| Source: | Code function: | 2_2_02A2B029 | |
| Source: | Code function: | 2_2_02A87040 | |
| Source: | Code function: | 2_2_02A91040 | |
| Source: | Code function: | 2_2_02A4F1B0 | |
| Source: | Code function: | 2_2_02A191B9 | |
| Source: | Code function: | 2_2_02A331C6 | |
| Source: | Code function: | 2_2_02A31110 | |
| Source: | Code function: | 2_2_02A596F9 | |
| Source: | Code function: | 2_2_02A5D628 | |
| Source: | Code function: | 2_2_02A85630 | |
| Source: | Code function: | 2_2_02A91720 | |
| Source: | Code function: | 2_2_02AE1700 | |
| Source: | Code function: | 2_2_02A4B498 | |
| Source: | Code function: | 2_2_02A3B5F9 | |
| Source: | Code function: | 2_2_02A23A68 | |
| Source: | Code function: | 2_2_02A9BBD0 | |
| Source: | Code function: | 2_2_02AD3B20 | |
| Source: | Code function: | 2_2_02A87B10 | |
| Source: | Code function: | 2_2_02A4B869 | |
| Source: | Code function: | 2_2_02A59999 | |
| Source: | Code function: | 2_2_02A5F928 | |
| Source: | Code function: | 2_2_02A15970 | |
| Source: | Code function: | 2_2_02A37977 | |
| Source: | Code function: | 2_2_02A83FE0 | |
| Source: | Code function: | 2_2_02A9FCA0 | |
| Source: | Code function: | 2_2_02A83C70 | |
| Source: | Code function: | 2_2_02A8DD90 | |
| Source: | Code function: | 2_2_02AF9DD9 | |
| Source: | Code function: | 2_2_02A17D20 | |
| Source: | Code function: | 2_2_05061510 | |
| Source: | Code function: | 2_2_05058040 | |
| Source: | Code function: | 2_2_0507A340 | |
| Source: | Code function: | 2_2_05079C00 | |
| Source: | Code function: | 2_2_0506EE70 | |
| Source: | Code function: | 2_2_05057820 | |
| Source: | Code function: | 2_2_0505D460 | |
| Source: | Code function: | 2_2_05076470 | |
| Source: | Code function: | 2_2_0505E490 | |
| Source: | Code function: | 2_2_050A34F9 | |
| Source: | Code function: | 2_2_050717E0 | |
| Source: | Code function: | 2_2_050747F0 | |
| Source: | Code function: | 2_2_0505A640 | |
| Source: | Code function: | 2_2_05095070 | |
| Source: | Code function: | 2_2_05054360 | |
| Source: | Code function: | 2_2_05099380 | |
| Source: | Code function: | 2_2_050953CF | |
| Source: | Code function: | 2_2_0508ED00 | |
| Source: | Code function: | 2_2_05094D2E | |
| Source: | Code function: | 2_2_050A2D60 | |
| Source: | Code function: | 2_2_05072F50 | |
| Source: | Code function: | 2_2_0505FE40 | |
| Source: | Code function: | 2_2_0505D8E0 | |
| Source: | Code function: | 2_2_050A8BEB | |
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Classification label: | ||
| Source: | Code function: | 2_2_02A93220 | |
| Source: | Code function: | 2_2_02A92B40 | |
| Source: | Code function: | 2_2_02A0C390 | |
| Source: | Code function: | 2_2_02A46160 | |
| Source: | File created: | Jump to behavior | ||
| Source: | Mutant created: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Virustotal: | ||
| Source: | ReversingLabs: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static file information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Code function: | 2_2_02A3C720 | |
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Code function: | 2_2_02ADE4CD | |
| Source: | Code function: | 2_2_0508D082 | |
| Source: | Code function: | 2_2_050B322E | |
| Source: | File created: | Jump to dropped file | ||
Boot Survival | |
|---|
| Source: | Registry value created or modified: | Jump to behavior | ||
| Source: | Registry value created or modified: | Jump to behavior | ||
| Source: | Registry value created or modified: | Jump to behavior | ||
| Source: | Code function: | 2_2_02A829B0 | |
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
Malware Analysis System Evasion | |
|---|
| Source: | Sandbox detection routine: | graph_2-161722 | ||
| Source: | Evasive API call chain: | graph_2-163665 | ||
| Source: | Code function: | 2_2_02A62460 | |
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Code function: | 2_2_02A66760 | |
| Source: | Code function: | 2_2_02A930A0 | |
| Source: | Code function: | 2_2_02A3E200 | |
| Source: | Code function: | 2_2_02ADC3BA | |
| Source: | Code function: | 2_2_02A0E0B0 | |
| Source: | Code function: | 2_2_02A0A6B0 | |
| Source: | Code function: | 2_2_02A20CC3 | |
| Source: | Code function: | 2_2_02ADC440 | |
| Source: | Code function: | 2_2_02A3FD60 | |
| Source: | Code function: | 2_2_0508A17B | |
| Source: | Code function: | 2_2_050590F0 | |
| Source: | Code function: | 2_2_05059990 | |
| Source: | Code function: | 2_2_02A0C390 | |
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Process information queried: | Jump to behavior | ||
| Source: | Code function: | 2_2_02A143F0 | |
| Source: | Code function: | 2_2_02A62F97 | |
| Source: | Code function: | 2_2_02A3C720 | |
| Source: | Code function: | 2_2_02A1C000 | |
| Source: | Code function: | 2_2_02A62460 | |
| Source: | Code function: | 2_2_02A62460 | |
| Source: | Code function: | 2_2_02A6286B | |
| Source: | Code function: | 2_2_02A6286B | |
| Source: | Code function: | 2_2_02A6286B | |
| Source: | Code function: | 2_2_02A6286B | |
| Source: | Code function: | 2_2_02A62F97 | |
| Source: | Code function: | 2_2_02A62F97 | |
| Source: | Code function: | 2_2_02A62F97 | |
| Source: | Code function: | 2_2_02A62F97 | |
| Source: | Code function: | 2_2_02A62F97 | |
| Source: | Code function: | 2_2_02A62F97 | |
| Source: | Code function: | 2_2_02A62F97 | |
| Source: | Code function: | 2_2_02A62F97 | |
| Source: | Code function: | 2_2_02A62F97 | |
| Source: | Code function: | 2_2_02A62F97 | |
| Source: | Code function: | 2_2_02A62F97 | |
| Source: | Code function: | 2_2_02A62F97 | |
| Source: | Code function: | 2_2_02A62F97 | |
| Source: | Code function: | 2_2_02A62F97 | |
| Source: | Code function: | 2_2_02A62F97 | |
| Source: | Code function: | 2_2_02A62F97 | |
| Source: | Code function: | 2_2_02A62F97 | |
| Source: | Code function: | 2_2_02A62F97 | |
| Source: | Code function: | 2_2_02A3D840 | |
| Source: | Code function: | 2_2_02A1C000 | |
| Source: | Code function: | 2_2_02A141E0 | |
| Source: | Code function: | 2_2_02A641C3 | |
| Source: | Code function: | 2_2_02A64405 | |
| Source: | Code function: | 2_2_02A14840 | |
| Source: | Code function: | 2_2_02A14840 | |
| Source: | Code function: | 2_2_02A14840 | |
| Source: | Code function: | 2_2_02A14840 | |
| Source: | Code function: | 2_2_02A14840 | |
| Source: | Code function: | 2_2_02A14840 | |
| Source: | Code function: | 2_2_02A14840 | |
| Source: | Code function: | 2_2_02A14840 | |
| Source: | Code function: | 2_2_02A14840 | |
| Source: | Code function: | 2_2_02A14840 | |
| Source: | Code function: | 2_2_02A14840 | |
| Source: | Code function: | 2_2_02A14840 | |
| Source: | Code function: | 2_2_02A1C000 | |
| Source: | Code function: | 2_2_02A14D29 | |
| Source: | Code function: | 2_2_02A153F8 | |
| Source: | Code function: | 2_2_02A1C000 | |
| Source: | Code function: | 2_2_02A63058 | |
| Source: | Code function: | 2_2_02A15718 | |
| Source: | Code function: | 2_2_02A1C000 | |
| Source: | Code function: | 2_2_02A638E8 | |
| Source: | Code function: | 2_2_02A15970 | |
| Source: | Code function: | 2_2_02A1FF70 | |
| Source: | Code function: | 2_2_02A089A0 | |
| Source: | Code function: | 2_2_02ADE6E4 | |
| Source: | Code function: | 2_2_02ADEA8D | |
| Source: | Code function: | 2_2_02AE2FC4 | |
| Source: | Code function: | 2_2_0508D469 | |
| Source: | Code function: | 2_2_050964F5 | |
| Source: | Code function: | 2_2_0508D756 | |
HIPS / PFW / Operating System Protection Evasion | |
|---|
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Code function: | 2_2_02A19EB0 | |
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Code function: | 2_2_02ADE2E6 | |
| Source: | Code function: | 2_2_02A0C390 | |
| Source: | Code function: | 2_2_02ADC1B6 | |
| Source: | Code function: | 2_2_02AFE6DB | |
| Source: | Code function: | 2_2_02AFEAF8 | |
| Source: | Code function: | 2_2_02AFEA6D | |
| Source: | Code function: | 2_2_02AFE8E0 | |
| Source: | Code function: | 2_2_02AFE987 | |
| Source: | Code function: | 2_2_02AFE9D2 | |
| Source: | Code function: | 2_2_02AFEE74 | |
| Source: | Code function: | 2_2_02AFEF7A | |
| Source: | Code function: | 2_2_02AFED4B | |
| Source: | Code function: | 2_2_02AFF050 | |
| Source: | Code function: | 2_2_02AF596A | |
| Source: | Code function: | 2_2_02AF5EED | |
| Source: | Code function: | 2_2_050A841C | |
| Source: | Code function: | 2_2_050A8117 | |
| Source: | Code function: | 2_2_050A8346 | |
| Source: | Code function: | 2_2_050A8240 | |
| Source: | Code function: | 2_2_050A7D53 | |
| Source: | Code function: | 2_2_050A7D51 | |
| Source: | Code function: | 2_2_050A7D9E | |
| Source: | Code function: | 2_2_0509BD97 | |
| Source: | Code function: | 2_2_05089F98 | |
| Source: | Code function: | 2_2_050A7E39 | |
| Source: | Code function: | 2_2_050A7EC4 | |
| Source: | Code function: | 2_2_0509B82B | |
| Source: | Registry key value queried: | Jump to behavior | ||
| Source: | Registry key value queried: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Code function: | 2_2_02A0C390 | |
| Source: | Code function: | 2_2_02A0C390 | |
| Source: | Code function: | 2_2_02A0C390 | |
| Source: | Code function: | 2_2_02A92B40 | |
| Source: | Key value queried: | Jump to behavior | ||
Stealing of Sensitive Information | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
Remote Access Functionality | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | 1 Valid Accounts | 11 Native API | 1 DLL Side-Loading | 1 DLL Side-Loading | 1 Deobfuscate/Decode Files or Information | 1 OS Credential Dumping | 12 System Time Discovery | Remote Services | 1 Archive Collected Data | 2 Ingress Tool Transfer | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
| Credentials | Domains | Default Accounts | 2 Command and Scripting Interpreter | 1 Create Account | 1 Valid Accounts | 2 Obfuscated Files or Information | LSASS Memory | 1 Account Discovery | Remote Desktop Protocol | 2 Data from Local System | 21 Encrypted Channel | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | 1 Valid Accounts | 1 Access Token Manipulation | 1 DLL Side-Loading | Security Account Manager | 2 File and Directory Discovery | SMB/Windows Admin Shares | 1 Screen Capture | 1 Non-Standard Port | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | 11 Registry Run Keys / Startup Folder | 411 Process Injection | 1 Masquerading | NTDS | 57 System Information Discovery | Distributed Component Object Model | 1 Email Collection | 2 Non-Application Layer Protocol | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | 11 Registry Run Keys / Startup Folder | 1 Valid Accounts | LSA Secrets | 241 Security Software Discovery | SSH | Keylogging | 13 Application Layer Protocol | Scheduled Transfer | Data Encrypted for Impact |
| Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | 1 Access Token Manipulation | Cached Domain Credentials | 111 Virtualization/Sandbox Evasion | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
| DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | 111 Virtualization/Sandbox Evasion | DCSync | 2 Process Discovery | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
| Network Trust Dependencies | Serverless | Drive-by Compromise | Container Orchestration Job | Scheduled Task/Job | Scheduled Task/Job | 411 Process Injection | Proc Filesystem | 1 Application Window Discovery | Cloud Services | Credential API Hooking | Application Layer Protocol | Exfiltration Over Alternative Protocol | Defacement |
| Network Topology | Malvertising | Exploit Public-Facing Application | Command and Scripting Interpreter | At | At | HTML Smuggling | /etc/passwd and /etc/shadow | 1 System Owner/User Discovery | Direct Cloud VM Connections | Data Staged | Web Protocols | Exfiltration Over Symmetric Encrypted Non-C2 Protocol | Internal Defacement |
| IP Addresses | Compromise Infrastructure | Supply Chain Compromise | PowerShell | Cron | Cron | Dynamic API Resolution | Network Sniffing | 1 System Network Configuration Discovery | Shared Webroot | Local Data Staging | File Transfer Protocols | Exfiltration Over Asymmetric Encrypted Non-C2 Protocol | External Defacement |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 36% | Virustotal | Browse | ||
| 42% | ReversingLabs | Win64.Trojan.Generic |
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 42% | ReversingLabs | Win64.Trojan.Generic | ||
| 47% | Virustotal | Browse |
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| ipinfo.io | 34.117.186.192 | true | false | high | |
| db-ip.com | 104.26.5.15 | true | false | high |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| false | high | ||
| false | high |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 34.117.186.192 | ipinfo.io | United States | 139070 | GOOGLE-AS-APGoogleAsiaPacificPteLtdSG | false | |
| 95.216.41.236 | unknown | Germany | 24940 | HETZNER-ASDE | true | |
| 104.26.5.15 | db-ip.com | United States | 13335 | CLOUDFLARENETUS | false |
| Joe Sandbox version: | 40.0.0 Tourmaline |
| Analysis ID: | 1417443 |
| Start date and time: | 2024-03-29 09:51:12 +01:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 11m 14s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 10 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | MXpl6HFisn.exerenamed because original name is a hash value |
| Original Sample Name: | 0aadbca2d0a26b8f90fd4f31cb7f2ffc.exe |
| Detection: | MAL |
| Classification: | mal100.troj.spyw.evad.winEXE@9/24@2/3 |
| EGA Information: |
|
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
- Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
- Execution Graph export aborted for target (0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe, PID 2032 because there are no executed function
- Execution Graph export aborted for target MXpl6HFisn.exe, PID 6880 because there are no executed function
- Not all processes where analyzed, report is missing behavior information
- Report creation exceeded maximum time and may have missing disassembly code information.
- Report size exceeded maximum capacity and may have missing behavior information.
- Report size exceeded maximum capacity and may have missing disassembly code.
- Report size getting too big, too many NtCreateFile calls found.
- Report size getting too big, too many NtOpenKeyEx calls found.
- Report size getting too big, too many NtQueryValueKey calls found.
| Time | Type | Description |
|---|---|---|
| 08:51:57 | Autostart | |
| 08:52:05 | Autostart | |
| 09:52:18 | API Interceptor |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 34.117.186.192 | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Planet Stealer | Browse |
| ||
| Get hash | malicious | Planet Stealer | Browse |
| ||
| Get hash | malicious | Xmrig | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | RedLine | Browse |
| ||
| Get hash | malicious | RedLine | Browse |
| ||
| 104.26.5.15 | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Nemty | Browse |
| ||
| Get hash | malicious | Nemty | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| ipinfo.io | Get hash | malicious | RisePro Stealer | Browse |
| |
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| Get hash | malicious | Amadey, PureLog Stealer, RedLine, RisePro Stealer, zgRAT | Browse |
| ||
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Amadey, Glupteba, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoader | Browse |
| ||
| db-ip.com | Get hash | malicious | RisePro Stealer | Browse |
| |
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| Get hash | malicious | Amadey, PureLog Stealer, RedLine, RisePro Stealer, zgRAT | Browse |
| ||
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| Get hash | malicious | Amadey, Glupteba, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoader | Browse |
| ||
| Get hash | malicious | LummaC, PureLog Stealer, RisePro Stealer | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| GOOGLE-AS-APGoogleAsiaPacificPteLtdSG | Get hash | malicious | Amadey, PureLog Stealer, RedLine, RisePro Stealer, zgRAT | Browse |
| |
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Amadey, PureLog Stealer, RedLine, RisePro Stealer, zgRAT | Browse |
| ||
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| HETZNER-ASDE | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Vidar | Browse |
| ||
| Get hash | malicious | LummaC, Babuk, Clipboard Hijacker, Djvu, Glupteba, LummaC Stealer, SmokeLoader | Browse |
| ||
| Get hash | malicious | LummaC, Babuk, Clipboard Hijacker, Djvu, Glupteba, LummaC Stealer, SmokeLoader | Browse |
| ||
| Get hash | malicious | Vidar | Browse |
| ||
| Get hash | malicious | DCRat | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| CLOUDFLARENETUS | Get hash | malicious | Phisher | Browse |
| |
| Get hash | malicious | LummaC | Browse |
| ||
| Get hash | malicious | Amadey, PureLog Stealer, RedLine, RisePro Stealer, zgRAT | Browse |
| ||
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| Get hash | malicious | AgentTesla, PureLog Stealer | Browse |
| ||
| Get hash | malicious | AgentTesla, PureLog Stealer | Browse |
| ||
| Get hash | malicious | FormBook | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| a0e9f5d64349fb13191bc781f81f42e1 | Get hash | malicious | LummaC | Browse |
| |
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| Get hash | malicious | LummaC | Browse |
| ||
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| Get hash | malicious | Amadey, PureLog Stealer, RedLine, RisePro Stealer, zgRAT | Browse |
| ||
| Get hash | malicious | DBatLoader, Remcos | Browse |
| ||
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| Get hash | malicious | Remcos, DBatLoader | Browse |
|
⊘No context
| Process: | C:\Users\user\Desktop\MXpl6HFisn.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 21056512 |
| Entropy (8bit): | 5.476356034801967 |
| Encrypted: | false |
| SSDEEP: | 98304:rFrNAOGfsjEhnR91LLdASLKR7jjYLgIXW86sfr9rmp4QJEf3v5EzlNTDLjDvIy0:3G0jEhnlLLdAdjjY84NAEf3vaBNHjc |
| MD5: | 0AADBCA2D0A26B8F90FD4F31CB7F2FFC |
| SHA1: | 57246459C3890DFCD49FB792CC55A45E3BD6C48E |
| SHA-256: | 4BEE7D558A5346BFFA5CC2393B579BD8ABBDD6BEEF0EDE8E71AEAE10DD5FF207 |
| SHA-512: | 62D64664DC307C423BCE2EF3BE545026DFDC120598E42B22AB51A2F1C139BE7D2C083E68D03605F8E85CEB764DC8E9B51F6D51F12EA4D67C33123CDF47D99CE3 |
| Malicious: | true |
| Antivirus: |
|
| Reputation: | low |
| Preview: |
| Process: | C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 6085 |
| Entropy (8bit): | 6.038274200863744 |
| Encrypted: | false |
| SSDEEP: | 96:gxsumX/xKO2KbcRfbZJ5Jxjxcx1xcbza5BC126oxgxA26Fxr/CxbTxqCGYURxOeb:gWFXZQHRFJ5Pts7c3avC126Ygb6Lr/WY |
| MD5: | ACB5AD34236C58F9F7D219FB628E3B58 |
| SHA1: | 02E39404CA22F1368C46A7B8398F5F6001DB8F5C |
| SHA-256: | 05E5013B848C2E619226F9E7A084DC7DCD1B3D68EE45108F552DB113D21B49D1 |
| SHA-512: | 5895F39765BA3CEDFD47D57203FD7E716347CD79277EDDCDC83A729A86E2E59F03F0E7B6B0D0E7C7A383755001EDACC82171052BE801E015E6BF7E6B9595767F |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| Preview: |
C:\Users\user\AppData\Local\Temp\adobe3S903DOZntEK\History\Firefox_fqs92o4p.default-release.txt
Download File
| Process: | C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 112 |
| Entropy (8bit): | 4.911305722693245 |
| Encrypted: | false |
| SSDEEP: | 3:N8DSLvIJiMgTE2WdkQUl7R8DSLvIJiMhKVX3L2WdkQUlv:2OLciodq7R8OLciA8dqv |
| MD5: | 978B9515D3688A43726604AC169DF379 |
| SHA1: | D61293AB99332FC45CAE37D78AB17A5DA5BCD189 |
| SHA-256: | CDEF3FB1CE312E4B67DC5F1B1F9FB551241C08564FDB26AFA4CBF448BB02EA65 |
| SHA-512: | 86146AA576129B73743B1EBC0BC60880FDA58A11498048B3C68284C4520F1ADC324D016696B0E995A51AC56966E0F38B0AF12458A986868701C6AAAA89C829CB |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| Preview: |
| Process: | C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 5346 |
| Entropy (8bit): | 5.320945751433256 |
| Encrypted: | false |
| SSDEEP: | 96:xzZPBuRUoQcT4Aisph+9hcmz+GftHToANUbg3x:xyGoQvAtphWhcmz+GHB |
| MD5: | 1223F1E6639681C771D2ACC0A1E3855C |
| SHA1: | BE2B113015854F03D5CFAE4504EED8BA53C83316 |
| SHA-256: | 08861592823B784CF1097B4C30AD16C3C9C006F5740820A91FD856277A9E0333 |
| SHA-512: | CC75082B7D0F62D1CA07D9828975C449E4281AF6233572BCD607D79F811A55DCD054BBF66E651A29F4C79738B7B59EE215594A6D88AF80D35533BA51F3778BB0 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 4897 |
| Entropy (8bit): | 2.518316437186352 |
| Encrypted: | false |
| SSDEEP: | 48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q |
| MD5: | B3E9D0E1B8207AA74CB8812BAAF52EAE |
| SHA1: | A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B |
| SHA-256: | 4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C |
| SHA-512: | B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| Preview: |
| Process: | C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 711390 |
| Entropy (8bit): | 7.926039821425995 |
| Encrypted: | false |
| SSDEEP: | 12288:Yr0TCybz8atmfvuws3ej+LjJP0EMr2NZ61X49kbf+Lef9NvLJ1Dvi:Yr0TCybzZmHuyiPJcEtZ619bBf9Nv3Da |
| MD5: | FC095005D226AFC7C9834E94BDF42A21 |
| SHA1: | 16CC433E86E00617D5B17593FC0C8DB0D89F3A2A |
| SHA-256: | BAE5B778D819BE2AF729DBF18483AC6F8F9ED9E85D0A0E01972C232D26BA6F08 |
| SHA-512: | 964280173F5085E841270A3F7A80447206D09D3949FE0C135A7E6492A7ECAC843CD06B6F1A62CC8043FC82CF72624FB28A8C7F92649B471066476B3398AF1699 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 699426 |
| Entropy (8bit): | 7.997663873659064 |
| Encrypted: | true |
| SSDEEP: | 12288:tyew37DsWKZ2pMzTYoO2kQJHM+RDZoBlWc9jFtL53UJjgfBG5FkT4:tyewrKLYoO2kYDZMlZX95AsZ+Fk8 |
| MD5: | D43F959A9FB0C3623E71D9436F1DBEBD |
| SHA1: | 296E7B8B86AB54598185C99656D15B2C9DCEC0CF |
| SHA-256: | 8CBDA65FA1D7ECF05A2B0171DDC94D7E94FCDC0472607181A0210A6680E78753 |
| SHA-512: | 4590F8EA39A0E826BA5730C74958751E6C9253113F9DF3EEE62270517B92F319CB3D35A898CB9929BBC995ADA5291A5EFE75635463FA9973B5189675A0EDE5AA |
| Malicious: | true |
| Yara Hits: |
|
| Preview: |
| Process: | C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 98304 |
| Entropy (8bit): | 0.08235737944063153 |
| Encrypted: | false |
| SSDEEP: | 12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO |
| MD5: | 369B6DD66F1CAD49D0952C40FEB9AD41 |
| SHA1: | D05B2DE29433FB113EC4C558FF33087ED7481DD4 |
| SHA-256: | 14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D |
| SHA-512: | 771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928 |
| Malicious: | false |
| Preview: |
| Process: | C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 5242880 |
| Entropy (8bit): | 0.037963276276857943 |
| Encrypted: | false |
| SSDEEP: | 192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ |
| MD5: | C0FDF21AE11A6D1FA1201D502614B622 |
| SHA1: | 11724034A1CC915B061316A96E79E9DA6A00ADE8 |
| SHA-256: | FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC |
| SHA-512: | A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B |
| Malicious: | false |
| Preview: |
| Process: | C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 126976 |
| Entropy (8bit): | 0.47147045728725767 |
| Encrypted: | false |
| SSDEEP: | 96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u |
| MD5: | A2D1F4CF66465F9F0CAC61C4A95C7EDE |
| SHA1: | BA6A845E247B221AAEC96C4213E1FD3744B10A27 |
| SHA-256: | B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE |
| SHA-512: | C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838 |
| Malicious: | false |
| Preview: |
| Process: | C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 126976 |
| Entropy (8bit): | 0.47147045728725767 |
| Encrypted: | false |
| SSDEEP: | 96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u |
| MD5: | A2D1F4CF66465F9F0CAC61C4A95C7EDE |
| SHA1: | BA6A845E247B221AAEC96C4213E1FD3744B10A27 |
| SHA-256: | B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE |
| SHA-512: | C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838 |
| Malicious: | false |
| Preview: |
| Process: | C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 5242880 |
| Entropy (8bit): | 0.037963276276857943 |
| Encrypted: | false |
| SSDEEP: | 192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ |
| MD5: | C0FDF21AE11A6D1FA1201D502614B622 |
| SHA1: | 11724034A1CC915B061316A96E79E9DA6A00ADE8 |
| SHA-256: | FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC |
| SHA-512: | A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B |
| Malicious: | false |
| Preview: |
| Process: | C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 106496 |
| Entropy (8bit): | 1.1358696453229276 |
| Encrypted: | false |
| SSDEEP: | 192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544 |
| MD5: | 28591AA4E12D1C4FC761BE7C0A468622 |
| SHA1: | BC4968A84C19377D05A8BB3F208FBFAC49F4820B |
| SHA-256: | 51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9 |
| SHA-512: | 5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB |
| Malicious: | false |
| Preview: |
| Process: | C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 40960 |
| Entropy (8bit): | 0.8553638852307782 |
| Encrypted: | false |
| SSDEEP: | 48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil |
| MD5: | 28222628A3465C5F0D4B28F70F97F482 |
| SHA1: | 1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14 |
| SHA-256: | 93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4 |
| SHA-512: | C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7 |
| Malicious: | false |
| Preview: |
| Process: | C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 114688 |
| Entropy (8bit): | 0.9746603542602881 |
| Encrypted: | false |
| SSDEEP: | 192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn |
| MD5: | 780853CDDEAEE8DE70F28A4B255A600B |
| SHA1: | AD7A5DA33F7AD12946153C497E990720B09005ED |
| SHA-256: | 1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3 |
| SHA-512: | E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8 |
| Malicious: | false |
| Preview: |
| Process: | C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 28672 |
| Entropy (8bit): | 2.5793180405395284 |
| Encrypted: | false |
| SSDEEP: | 96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz |
| MD5: | 41EA9A4112F057AE6BA17E2838AEAC26 |
| SHA1: | F2B389103BFD1A1A050C4857A995B09FEAFE8903 |
| SHA-256: | CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB |
| SHA-512: | 29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103 |
| Malicious: | false |
| Preview: |
| Process: | C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 40960 |
| Entropy (8bit): | 0.8553638852307782 |
| Encrypted: | false |
| SSDEEP: | 48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil |
| MD5: | 28222628A3465C5F0D4B28F70F97F482 |
| SHA1: | 1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14 |
| SHA-256: | 93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4 |
| SHA-512: | C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7 |
| Malicious: | false |
| Preview: |
| Process: | C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 106496 |
| Entropy (8bit): | 1.1358696453229276 |
| Encrypted: | false |
| SSDEEP: | 192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544 |
| MD5: | 28591AA4E12D1C4FC761BE7C0A468622 |
| SHA1: | BC4968A84C19377D05A8BB3F208FBFAC49F4820B |
| SHA-256: | 51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9 |
| SHA-512: | 5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB |
| Malicious: | false |
| Preview: |
| Process: | C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 114688 |
| Entropy (8bit): | 0.9746603542602881 |
| Encrypted: | false |
| SSDEEP: | 192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn |
| MD5: | 780853CDDEAEE8DE70F28A4B255A600B |
| SHA1: | AD7A5DA33F7AD12946153C497E990720B09005ED |
| SHA-256: | 1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3 |
| SHA-512: | E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8 |
| Malicious: | false |
| Preview: |
| Process: | C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 159744 |
| Entropy (8bit): | 0.7873599747470391 |
| Encrypted: | false |
| SSDEEP: | 96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v |
| MD5: | 6A6BAD38068B0F6F2CADC6464C4FE8F0 |
| SHA1: | 4E3B235898D8E900548613DDB6EA59CDA5EB4E68 |
| SHA-256: | 0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982 |
| SHA-512: | BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A |
| Malicious: | false |
| Preview: |
| Process: | C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 49152 |
| Entropy (8bit): | 0.8180424350137764 |
| Encrypted: | false |
| SSDEEP: | 96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG |
| MD5: | 349E6EB110E34A08924D92F6B334801D |
| SHA1: | BDFB289DAFF51890CC71697B6322AA4B35EC9169 |
| SHA-256: | C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A |
| SHA-512: | 2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574 |
| Malicious: | false |
| Preview: |
| Process: | C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 159744 |
| Entropy (8bit): | 0.7873599747470391 |
| Encrypted: | false |
| SSDEEP: | 96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v |
| MD5: | 6A6BAD38068B0F6F2CADC6464C4FE8F0 |
| SHA1: | 4E3B235898D8E900548613DDB6EA59CDA5EB4E68 |
| SHA-256: | 0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982 |
| SHA-512: | BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A |
| Malicious: | false |
| Preview: |
| Process: | C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 106496 |
| Entropy (8bit): | 1.1358696453229276 |
| Encrypted: | false |
| SSDEEP: | 192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544 |
| MD5: | 28591AA4E12D1C4FC761BE7C0A468622 |
| SHA1: | BC4968A84C19377D05A8BB3F208FBFAC49F4820B |
| SHA-256: | 51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9 |
| SHA-512: | 5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB |
| Malicious: | false |
| Preview: |
| Process: | C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 114688 |
| Entropy (8bit): | 0.9746603542602881 |
| Encrypted: | false |
| SSDEEP: | 192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn |
| MD5: | 780853CDDEAEE8DE70F28A4B255A600B |
| SHA1: | AD7A5DA33F7AD12946153C497E990720B09005ED |
| SHA-256: | 1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3 |
| SHA-512: | E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8 |
| Malicious: | false |
| Preview: |
| File type: | |
| Entropy (8bit): | 5.476356034801967 |
| TrID: |
|
| File name: | MXpl6HFisn.exe |
| File size: | 21'056'512 bytes |
| MD5: | 0aadbca2d0a26b8f90fd4f31cb7f2ffc |
| SHA1: | 57246459c3890dfcd49fb792cc55a45e3bd6c48e |
| SHA256: | 4bee7d558a5346bffa5cc2393b579bd8abbdd6beef0ede8e71aeae10dd5ff207 |
| SHA512: | 62d64664dc307c423bce2ef3be545026dfdc120598e42b22ab51a2f1c139be7d2c083e68d03605f8e85ceb764dc8e9b51f6d51f12ea4d67c33123cdf47d99ce3 |
| SSDEEP: | 98304:rFrNAOGfsjEhnR91LLdASLKR7jjYLgIXW86sfr9rmp4QJEf3v5EzlNTDLjDvIy0:3G0jEhnlLLdAdjjY84NAEf3vaBNHjc |
| TLSH: | 9E274943E96544E8C0ADD534C5668262BB71BC488B3137D72BA0FB782F76BD0AE79710 |
| File Content Preview: | MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................$..l..HA................@..............................J......TA...`... ............................ |
 | |
| Icon Hash: | 13459ab2b25a6517 |
| Entrypoint: | 0x1400014c0 |
| Entrypoint Section: | .text |
| Digitally signed: | false |
| Imagebase: | 0x140000000 |
| Subsystem: | windows gui |
| Image File Characteristics: | EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED |
| DLL Characteristics: | HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x0 [Thu Jan 1 00:00:00 1970 UTC] |
| TLS Callbacks: | 0x406c1520, 0x1, 0x406c14f0, 0x1, 0x406c4f90, 0x1 |
| CLR (.Net) Version: | |
| OS Version Major: | 6 |
| OS Version Minor: | 1 |
| File Version Major: | 6 |
| File Version Minor: | 1 |
| Subsystem Version Major: | 6 |
| Subsystem Version Minor: | 1 |
| Import Hash: | c595f1660e1a3c84f4d9b0761d23cd7a |
| Instruction |
|---|
| dec eax |
| sub esp, 28h |
| dec eax |
| mov eax, dword ptr [013B3CD5h] |
| mov dword ptr [eax], 00000001h |
| call 00007F9E14FC56CFh |
| nop |
| nop |
| dec eax |
| add esp, 28h |
| ret |
| nop dword ptr [eax] |
| dec eax |
| sub esp, 28h |
| dec eax |
| mov eax, dword ptr [013B3CB5h] |
| mov dword ptr [eax], 00000000h |
| call 00007F9E14FC56AFh |
| nop |
| nop |
| dec eax |
| add esp, 28h |
| ret |
| nop dword ptr [eax] |
| dec eax |
| sub esp, 28h |
| call 00007F9E1569080Ch |
| dec eax |
| test eax, eax |
| sete al |
| movzx eax, al |
| neg eax |
| dec eax |
| add esp, 28h |
| ret |
| nop |
| nop |
| nop |
| nop |
| nop |
| nop |
| nop |
| dec eax |
| lea ecx, dword ptr [00000009h] |
| jmp 00007F9E14FC59E9h |
| nop dword ptr [eax+00h] |
| ret |
| nop |
| nop |
| nop |
| nop |
| nop |
| nop |
| nop |
| nop |
| nop |
| nop |
| nop |
| nop |
| nop |
| nop |
| nop |
| jmp dword ptr [eax] |
| inc edi |
| outsd |
| and byte ptr [edx+75h], ah |
| imul ebp, dword ptr [esp+20h], 203A4449h |
| and dh, byte ptr [esi] |
| xor byte ptr [eax+35h], cl |
| outsb |
| bound esi, dword ptr [edi] |
| outsb |
| arpl word ptr [esi], si |
| pop edi |
| pop ecx |
| push ecx |
| imul esi, dword ptr [esi], 49597369h |
| push 0000002Fh |
| dec eax |
| xor eax, 4E587041h |
| xor byte ptr [esi+51h], cl |
| insd |
| inc ebp |
| xor byte ptr [36723131h], dh |
| inc edi |
| dec ebx |
| das |
| jne 00007F9E14FC5A64h |
| dec edi |
| cmp byte ptr [ecx+76h], dl |
| cmp dword ptr [esi+35h], esi |
| pop ecx |
| xor eax, 00007237h |
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x1470000 | 0x4e | .edata |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0x1471000 | 0x1458 | .idata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x1475000 | 0x12e98 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x13b6000 | 0x26928 | .pdata |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x1488000 | 0x23f38 | .reloc |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0x13b4b00 | 0x28 | .rdata |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x1471494 | 0x458 | .idata |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x6cbac0 | 0x6cbc00 | 3a3601525da8761b1eb0a340212cf518 | unknown | unknown | unknown | unknown | IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .data | 0x6cd000 | 0x6cdb0 | 0x6ce00 | eb594568ff57faa673dd863ef95ee5e6 | False | 0.31138328788748565 | dBase III DBT, version number 0, next free block index 10, 1st item "nkalti/backoff/v3\011v3.0.0\011h1:ske+9nBpD9qZsTBoF41nW5L+AIuFBKMeze18XQ3eG1c=" | 4.748732255503778 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .rdata | 0x73a000 | 0xc7b930 | 0xc7ba00 | f5aface59debe050022ea8cae52ab5c3 | unknown | unknown | unknown | unknown | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ |
| .pdata | 0x13b6000 | 0x26928 | 0x26a00 | fe29e22ae8b4694fbb9f22ea59540cf7 | False | 0.40243856189320387 | data | 5.940748306238338 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ |
| .xdata | 0x13dd000 | 0xc50 | 0xe00 | c9bbd713e749d858e5a7e9e0e5621a62 | False | 0.25864955357142855 | data | 3.9997040298344486 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ |
| .bss | 0x13de000 | 0x91520 | 0x0 | d41d8cd98f00b204e9800998ecf8427e | False | 0 | empty | 0.0 | IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .edata | 0x1470000 | 0x4e | 0x200 | 29b57eede7f054d66fa260227508fb6d | False | 0.08984375 | data | 0.6553641017611729 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ |
| .idata | 0x1471000 | 0x1458 | 0x1600 | d956be78470099513c0824179955dfe7 | False | 0.29847301136363635 | data | 4.593096815007166 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .CRT | 0x1473000 | 0x70 | 0x200 | 9e58f747daf2242773bf8094b32b8893 | False | 0.083984375 | data | 0.47677526113352753 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .tls | 0x1474000 | 0x10 | 0x200 | bf619eac0cdf3f68d496ea9344137e8b | False | 0.02734375 | data | 0.0 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .rsrc | 0x1475000 | 0x12e98 | 0x13000 | 6b00c9a39872e28f476499762ac7b572 | False | 0.4592542146381579 | data | 5.849528840289981 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .reloc | 0x1488000 | 0x23f38 | 0x24000 | 186f17491d63553ae419bec122302f45 | False | 0.20198567708333334 | data | 5.452114043355917 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| RT_ICON | 0x1475370 | 0x2e8 | Device independent bitmap graphic, 32 x 64 x 4, image size 640 | 0.42338709677419356 | ||
| RT_ICON | 0x1475658 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 192 | 0.5101351351351351 | ||
| RT_ICON | 0x1475780 | 0xea8 | Device independent bitmap graphic, 48 x 96 x 8, image size 2688 | 0.40298507462686567 | ||
| RT_ICON | 0x1476628 | 0x8a8 | Device independent bitmap graphic, 32 x 64 x 8, image size 1152 | 0.5464801444043321 | ||
| RT_ICON | 0x1476ed0 | 0x568 | Device independent bitmap graphic, 16 x 32 x 8, image size 320 | 0.6047687861271677 | ||
| RT_ICON | 0x1477438 | 0x5c48 | PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced | 0.9979258381307146 | ||
| RT_ICON | 0x147d080 | 0x4228 | Device independent bitmap graphic, 64 x 128 x 32, image size 16896 | 0.10640056683986773 | ||
| RT_ICON | 0x14812a8 | 0x25a8 | Device independent bitmap graphic, 48 x 96 x 32, image size 9600 | 0.20715767634854773 | ||
| RT_ICON | 0x1483850 | 0x1a68 | Device independent bitmap graphic, 40 x 80 x 32, image size 6720 | 0.2334319526627219 | ||
| RT_ICON | 0x14852b8 | 0x10a8 | Device independent bitmap graphic, 32 x 64 x 32, image size 4224 | 0.19090056285178236 | ||
| RT_ICON | 0x1486360 | 0x988 | Device independent bitmap graphic, 24 x 48 x 32, image size 2400 | 0.35327868852459016 | ||
| RT_ICON | 0x1486ce8 | 0x6b8 | Device independent bitmap graphic, 20 x 40 x 32, image size 1680 | 0.39127906976744187 | ||
| RT_ICON | 0x14873a0 | 0x468 | Device independent bitmap graphic, 16 x 32 x 32, image size 1088 | 0.3342198581560284 | ||
| RT_GROUP_ICON | 0x1487808 | 0xbc | data | 0.6702127659574468 | ||
| RT_VERSION | 0x14878c4 | 0x2a8 | data | English | United States | 0.47058823529411764 |
| RT_MANIFEST | 0x1487b6c | 0x32c | XML 1.0 document, ASCII text, with CRLF line terminators | English | United States | 0.4642857142857143 |
| DLL | Import |
|---|---|
| KERNEL32.dll | AddAtomA, AddVectoredContinueHandler, AddVectoredExceptionHandler, CloseHandle, CreateEventA, CreateFileA, CreateIoCompletionPort, CreateMutexA, CreateSemaphoreA, CreateThread, CreateWaitableTimerExW, DeleteAtom, DeleteCriticalSection, DuplicateHandle, EnterCriticalSection, ExitProcess, FindAtomA, FormatMessageA, FreeEnvironmentStringsW, GetAtomNameA, GetConsoleMode, GetCurrentProcess, GetCurrentProcessId, GetCurrentThread, GetCurrentThreadId, GetEnvironmentStringsW, GetErrorMode, GetHandleInformation, GetLastError, GetProcAddress, GetProcessAffinityMask, GetQueuedCompletionStatusEx, GetStartupInfoA, GetStdHandle, GetSystemDirectoryA, GetSystemInfo, GetSystemTimeAsFileTime, GetThreadContext, GetThreadPriority, GetTickCount, InitializeCriticalSection, IsDBCSLeadByteEx, IsDebuggerPresent, LeaveCriticalSection, LoadLibraryExW, LoadLibraryW, LocalFree, MultiByteToWideChar, OpenProcess, OutputDebugStringA, PostQueuedCompletionStatus, QueryPerformanceCounter, QueryPerformanceFrequency, RaiseException, RaiseFailFastException, ReleaseMutex, ReleaseSemaphore, RemoveVectoredExceptionHandler, ResetEvent, ResumeThread, RtlLookupFunctionEntry, RtlVirtualUnwind, SetConsoleCtrlHandler, SetErrorMode, SetEvent, SetLastError, SetProcessAffinityMask, SetProcessPriorityBoost, SetThreadContext, SetThreadPriority, SetUnhandledExceptionFilter, SetWaitableTimer, Sleep, SuspendThread, SwitchToThread, TlsAlloc, TlsGetValue, TlsSetValue, TryEnterCriticalSection, VirtualAlloc, VirtualFree, VirtualProtect, VirtualQuery, WaitForMultipleObjects, WaitForSingleObject, WerGetFlags, WerSetFlags, WideCharToMultiByte, WriteConsoleW, WriteFile, __C_specific_handler |
| msvcrt.dll | ___lc_codepage_func, ___mb_cur_max_func, __getmainargs, __initenv, __iob_func, __lconv_init, __set_app_type, __setusermatherr, _acmdln, _amsg_exit, _beginthread, _beginthreadex, _cexit, _commode, _endthreadex, _errno, _fmode, _initterm, _lock, _memccpy, _onexit, _setjmp, _strdup, _ultoa, _unlock, abort, calloc, exit, fprintf, fputc, free, fwrite, localeconv, longjmp, malloc, memcpy, memmove, memset, printf, realloc, signal, strerror, strlen, strncmp, vfprintf, wcslen |
| Language of compilation system | Country where language is spoken | Map |
|---|---|---|
| English | United States |  |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | Protocol | SID | Message | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|---|---|---|
| 03/29/24-09:52:15.811203 | TCP | 2046266 | ET TROJAN [ANY.RUN] RisePro TCP (Token) | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| 03/29/24-09:52:21.606984 | TCP | 2046269 | ET TROJAN [ANY.RUN] RisePro TCP (Activity) | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| 03/29/24-09:52:16.065250 | TCP | 2046267 | ET TROJAN [ANY.RUN] RisePro TCP (External IP) | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| 03/29/24-09:52:25.278346 | TCP | 2046266 | ET TROJAN [ANY.RUN] RisePro TCP (Token) | 50500 | 49739 | 95.216.41.236 | 192.168.2.4 |
| 03/29/24-09:52:33.605110 | TCP | 2046266 | ET TROJAN [ANY.RUN] RisePro TCP (Token) | 50500 | 49743 | 95.216.41.236 | 192.168.2.4 |
| 03/29/24-09:52:25.741725 | TCP | 2046266 | ET TROJAN [ANY.RUN] RisePro TCP (Token) | 50500 | 49740 | 95.216.41.236 | 192.168.2.4 |
| 03/29/24-09:52:15.776952 | TCP | 2049060 | ET TROJAN RisePro TCP Heartbeat Packet | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| 03/29/24-09:52:23.971378 | TCP | 2049660 | ET TROJAN RisePro CnC Activity (Outbound) | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Mar 29, 2024 09:52:15.403074026 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:15.607089043 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:15.607203960 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:15.776952028 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:15.811203003 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:15.861314058 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:15.980807066 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:15.980928898 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:16.065249920 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:16.110129118 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:16.225837946 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:16.240926027 CET | 49732 | 443 | 192.168.2.4 | 34.117.186.192 |
| Mar 29, 2024 09:52:16.240947962 CET | 443 | 49732 | 34.117.186.192 | 192.168.2.4 |
| Mar 29, 2024 09:52:16.241018057 CET | 49732 | 443 | 192.168.2.4 | 34.117.186.192 |
| Mar 29, 2024 09:52:16.243802071 CET | 49732 | 443 | 192.168.2.4 | 34.117.186.192 |
| Mar 29, 2024 09:52:16.243819952 CET | 443 | 49732 | 34.117.186.192 | 192.168.2.4 |
| Mar 29, 2024 09:52:16.514143944 CET | 443 | 49732 | 34.117.186.192 | 192.168.2.4 |
| Mar 29, 2024 09:52:16.514226913 CET | 49732 | 443 | 192.168.2.4 | 34.117.186.192 |
| Mar 29, 2024 09:52:16.516618967 CET | 49732 | 443 | 192.168.2.4 | 34.117.186.192 |
| Mar 29, 2024 09:52:16.516630888 CET | 443 | 49732 | 34.117.186.192 | 192.168.2.4 |
| Mar 29, 2024 09:52:16.516859055 CET | 443 | 49732 | 34.117.186.192 | 192.168.2.4 |
| Mar 29, 2024 09:52:16.559035063 CET | 49732 | 443 | 192.168.2.4 | 34.117.186.192 |
| Mar 29, 2024 09:52:16.559660912 CET | 49732 | 443 | 192.168.2.4 | 34.117.186.192 |
| Mar 29, 2024 09:52:16.604228020 CET | 443 | 49732 | 34.117.186.192 | 192.168.2.4 |
| Mar 29, 2024 09:52:16.793872118 CET | 443 | 49732 | 34.117.186.192 | 192.168.2.4 |
| Mar 29, 2024 09:52:16.793982029 CET | 443 | 49732 | 34.117.186.192 | 192.168.2.4 |
| Mar 29, 2024 09:52:16.794071913 CET | 49732 | 443 | 192.168.2.4 | 34.117.186.192 |
| Mar 29, 2024 09:52:16.801991940 CET | 49732 | 443 | 192.168.2.4 | 34.117.186.192 |
| Mar 29, 2024 09:52:16.802006960 CET | 443 | 49732 | 34.117.186.192 | 192.168.2.4 |
| Mar 29, 2024 09:52:16.802042961 CET | 49732 | 443 | 192.168.2.4 | 34.117.186.192 |
| Mar 29, 2024 09:52:16.802047968 CET | 443 | 49732 | 34.117.186.192 | 192.168.2.4 |
| Mar 29, 2024 09:52:16.907232046 CET | 49734 | 443 | 192.168.2.4 | 104.26.5.15 |
| Mar 29, 2024 09:52:16.907263994 CET | 443 | 49734 | 104.26.5.15 | 192.168.2.4 |
| Mar 29, 2024 09:52:16.907330990 CET | 49734 | 443 | 192.168.2.4 | 104.26.5.15 |
| Mar 29, 2024 09:52:16.907660007 CET | 49734 | 443 | 192.168.2.4 | 104.26.5.15 |
| Mar 29, 2024 09:52:16.907670021 CET | 443 | 49734 | 104.26.5.15 | 192.168.2.4 |
| Mar 29, 2024 09:52:17.110066891 CET | 443 | 49734 | 104.26.5.15 | 192.168.2.4 |
| Mar 29, 2024 09:52:17.110129118 CET | 49734 | 443 | 192.168.2.4 | 104.26.5.15 |
| Mar 29, 2024 09:52:17.111785889 CET | 49734 | 443 | 192.168.2.4 | 104.26.5.15 |
| Mar 29, 2024 09:52:17.111793995 CET | 443 | 49734 | 104.26.5.15 | 192.168.2.4 |
| Mar 29, 2024 09:52:17.112020016 CET | 443 | 49734 | 104.26.5.15 | 192.168.2.4 |
| Mar 29, 2024 09:52:17.113066912 CET | 49734 | 443 | 192.168.2.4 | 104.26.5.15 |
| Mar 29, 2024 09:52:17.156244993 CET | 443 | 49734 | 104.26.5.15 | 192.168.2.4 |
| Mar 29, 2024 09:52:17.381699085 CET | 443 | 49734 | 104.26.5.15 | 192.168.2.4 |
| Mar 29, 2024 09:52:17.381774902 CET | 443 | 49734 | 104.26.5.15 | 192.168.2.4 |
| Mar 29, 2024 09:52:17.381850004 CET | 49734 | 443 | 192.168.2.4 | 104.26.5.15 |
| Mar 29, 2024 09:52:17.381994963 CET | 49734 | 443 | 192.168.2.4 | 104.26.5.15 |
| Mar 29, 2024 09:52:17.382005930 CET | 443 | 49734 | 104.26.5.15 | 192.168.2.4 |
| Mar 29, 2024 09:52:17.382029057 CET | 49734 | 443 | 192.168.2.4 | 104.26.5.15 |
| Mar 29, 2024 09:52:17.382035017 CET | 443 | 49734 | 104.26.5.15 | 192.168.2.4 |
| Mar 29, 2024 09:52:17.382339954 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:17.590552092 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:17.595273972 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:17.804805994 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:17.811084032 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:18.023627043 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:18.044038057 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:18.252588987 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:18.267838955 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:18.476484060 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:18.517755985 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:19.900731087 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:19.906291962 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.110332966 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.110402107 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.110438108 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.110450983 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.110502005 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.110516071 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.110539913 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.110563993 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.110603094 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.150521994 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.150619984 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.314565897 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.314578056 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.314631939 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.314913988 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.314954996 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.315009117 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.315057039 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.315095901 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.315140009 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.315164089 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.315221071 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.315279007 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.315331936 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.315388918 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.315432072 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.315563917 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.315608025 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.354368925 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.354419947 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.518640041 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.518657923 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.518671036 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.518681049 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.518723011 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.518740892 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.518786907 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.518862009 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.519020081 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.519105911 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.519303083 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.519360065 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.519386053 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.519429922 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.519464016 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.519521952 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.519568920 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.519658089 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.519706011 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.519799948 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.519825935 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.519850969 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.519876957 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.558377981 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.558576107 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.723084927 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.723104954 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.723169088 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.723201036 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.723241091 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.723278046 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.723325014 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.723328114 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.723449945 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.723500013 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.723709106 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.723763943 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.723764896 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.723892927 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.723953962 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.723998070 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.724083900 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.724128962 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.724255085 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.724306107 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.724505901 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.724534035 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.724551916 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.724577904 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.724664927 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.724775076 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.724889994 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.724939108 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.724968910 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.725012064 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.725054026 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.725117922 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.725159883 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.725203991 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.725235939 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.725307941 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.725434065 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.725476980 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.725548029 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.725564003 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.725610971 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.725687981 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.725733995 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.725923061 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.725985050 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.726003885 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.726073027 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.726083040 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.726121902 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.726351976 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.726392984 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.726418018 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.726449966 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.726480961 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.726496935 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.726614952 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.726672888 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.726763964 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.726809978 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.726860046 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.726949930 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.727037907 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.727088928 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.727358103 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.727399111 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.727411032 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.727437973 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.762423038 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.762475014 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.762481928 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.762525082 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.762654066 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.762722015 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.762782097 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.762991905 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.927229881 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.927247047 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.927265882 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.927284002 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.927300930 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.927320957 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.927366018 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.927385092 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.927421093 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.927483082 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.927500010 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.927546978 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.927759886 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.927802086 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.927825928 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.927892923 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.928040028 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.928098917 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.928121090 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.928209066 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.928232908 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.928250074 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.928343058 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.928378105 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.928389072 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.928412914 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.928438902 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.928462982 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.928538084 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.928601980 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.928625107 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.928659916 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.928682089 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.928735971 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.928806067 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.928827047 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.928874016 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.928930044 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.928965092 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.929019928 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.929039955 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.929054976 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.929162025 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.929189920 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.929208040 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.929233074 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.929286003 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.929347038 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.929374933 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.929450989 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.929462910 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.929511070 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.929569006 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.929640055 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.929698944 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.929708958 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.929764032 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.929832935 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.929850101 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.929883957 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.929902077 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.929922104 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.929991961 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.930012941 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.930085897 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.930134058 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.930167913 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.930179119 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.930227995 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.930275917 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.930330038 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.930383921 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.930447102 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.930454969 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.930509090 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.930557966 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:20.930597067 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.930682898 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.930841923 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.931168079 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.931253910 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.931269884 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.931339025 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.931410074 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.931484938 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.931579113 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.966511011 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.966597080 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.966707945 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.966933966 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.966985941 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.967363119 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.967411041 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:20.967458010 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.131603956 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.131622076 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.131639004 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.131697893 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.131776094 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.131921053 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.131979942 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.131994009 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.132188082 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.132323980 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.132427931 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.132529974 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.132582903 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.132664919 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.132742882 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.132817030 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.132880926 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.132972956 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.133024931 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.133137941 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.133235931 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.133306026 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.133430004 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.133512974 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.133554935 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.133650064 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.133758068 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.133816004 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.133856058 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.134016037 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.134032965 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.134103060 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.134186983 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.134306908 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.134385109 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.134483099 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.134582996 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.134697914 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.134746075 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.134768963 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.134902000 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.134952068 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.135020018 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.135245085 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.135327101 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.135390997 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.135441065 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.135550022 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.135643005 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.135776043 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.135853052 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.135931015 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.136034012 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.136096954 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.136195898 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.136250973 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.136382103 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.136588097 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.136640072 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.136907101 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.137068033 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.137181044 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.137193918 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.137345076 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.137568951 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.137600899 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.137689114 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.137856960 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.137934923 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.138005018 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.138092041 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.138175964 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.138254881 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.138329983 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.138421059 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.138477087 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.138580084 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.138670921 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.138870001 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.138881922 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.138906956 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.139034033 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.139081001 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.139112949 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:21.139195919 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.139213085 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.343008041 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.343024015 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:21.606983900 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:21.851656914 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:23.959110975 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:23.971378088 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:23.971400023 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:23.971426010 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:23.971467018 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:23.971518040 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:23.971555948 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:23.971563101 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:23.971630096 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:23.971666098 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:23.971674919 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:23.971712112 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:23.971750021 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:23.971762896 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:23.971798897 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:23.971801043 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:23.971827984 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:23.971919060 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.176160097 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.176183939 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.176235914 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.176256895 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.176326036 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.176368952 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.176383972 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.176434040 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.176476955 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.176517010 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.176598072 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.176652908 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.176656008 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.176676989 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.176718950 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.176981926 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.177026033 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.177062988 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.177071095 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.177151918 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.177174091 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.177191973 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.177249908 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.177289963 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.177303076 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.177437067 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.177481890 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.177511930 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.177545071 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.177584887 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.177648067 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.177696943 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.177737951 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.380006075 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.380022049 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.380033016 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.380043983 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.380058050 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.380086899 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.380095959 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.380110025 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.380145073 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.380157948 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.380158901 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.380192041 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.380192995 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.380501032 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.380513906 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.380527020 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.380553961 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.380562067 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.380564928 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.380573988 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.380605936 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.380610943 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.380636930 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.380650043 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.380676031 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.380706072 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.380711079 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.380733967 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.380748034 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.380779982 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.380806923 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.380827904 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.380867958 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.380877018 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.380888939 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.380925894 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.380939007 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.380944967 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.380953074 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.380973101 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.381016970 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.381072044 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.381079912 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.381118059 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.381130934 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.381165028 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.381165028 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.381174088 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.381186008 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.381197929 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.381211042 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.381222010 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.381238937 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.381309986 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.381347895 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.381362915 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.381398916 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.381510019 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.381705999 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.381747961 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.381817102 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.381865978 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.381879091 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.381911993 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.381911993 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.583936930 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.584372044 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.584412098 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.584427118 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.584431887 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.584438086 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.584461927 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.584491968 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.584503889 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.584513903 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.584525108 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.584533930 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.584574938 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.584583998 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.584585905 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.584610939 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.584634066 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.584692955 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.584741116 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.584769964 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.584800959 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.584822893 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.584846020 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.584857941 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.584886074 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.584938049 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.585001945 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.585014105 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.585043907 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.585088015 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.585088968 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.585156918 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.585213900 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.585258007 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.585273981 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.585305929 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.585342884 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.585376978 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.585413933 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.585417986 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.585472107 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.585514069 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.585561037 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.585562944 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.585621119 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.585668087 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.585669994 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.585712910 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.585721970 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.585763931 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.585803986 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.585834026 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.585877895 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.585925102 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.585928917 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.585985899 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.586029053 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.586076975 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.586077929 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.586142063 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.586189032 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.586189985 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.586237907 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.586250067 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.586287975 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.586338997 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.586342096 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.586410046 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.586431980 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.586474895 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.586488008 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.586498976 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.586509943 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.586541891 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.586541891 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.586555004 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.586566925 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.586602926 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.586647987 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.586658001 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.586668015 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.586679935 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.586707115 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.586734056 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.586743116 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.586755037 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.586764097 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.586795092 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.586846113 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.586858988 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.586869001 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.586879969 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.586889982 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.586890936 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.586900949 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.586920977 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.586930990 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.586930990 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.586937904 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.586962938 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.586966991 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.586990118 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.587001085 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.587033033 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.587050915 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.587050915 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.587055922 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.587084055 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.587097883 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.587110043 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.587142944 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.587142944 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.587156057 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.587198973 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.587204933 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.587218046 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.587239027 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.587249994 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.587260008 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.587260008 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.587297916 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.587304115 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.587344885 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.587348938 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.587389946 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.587400913 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.587429047 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.587447882 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.587486982 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.587495089 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.587502956 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.587657928 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.788114071 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.788131952 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.788144112 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.788198948 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.788212061 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.788228989 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.788240910 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.788244009 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.788253069 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.788280010 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.788280964 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.788301945 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.788309097 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.788413048 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.788425922 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.788436890 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.788450956 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.788460970 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.788472891 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.788475990 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.788475990 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.788491011 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.788512945 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.788532972 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.788544893 CET | 50500 | 49730 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:24.788558006 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.788598061 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:24.870301962 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:25.074090958 CET | 50500 | 49739 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:25.074197054 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:25.278346062 CET | 50500 | 49739 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:25.279201984 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:25.324819088 CET | 49740 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:25.483218908 CET | 50500 | 49739 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:25.483356953 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:25.533127069 CET | 50500 | 49740 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:25.533267021 CET | 49740 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:25.555130959 CET | 49740 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:25.727751017 CET | 50500 | 49739 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:25.741724968 CET | 50500 | 49740 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:25.763021946 CET | 50500 | 49740 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:25.763155937 CET | 49740 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:25.861428022 CET | 49740 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:25.971051931 CET | 50500 | 49740 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:26.017575026 CET | 49740 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:26.110364914 CET | 50500 | 49740 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:26.230674982 CET | 49741 | 443 | 192.168.2.4 | 34.117.186.192 |
| Mar 29, 2024 09:52:26.230705023 CET | 443 | 49741 | 34.117.186.192 | 192.168.2.4 |
| Mar 29, 2024 09:52:26.230884075 CET | 49741 | 443 | 192.168.2.4 | 34.117.186.192 |
| Mar 29, 2024 09:52:26.231795073 CET | 49741 | 443 | 192.168.2.4 | 34.117.186.192 |
| Mar 29, 2024 09:52:26.231806040 CET | 443 | 49741 | 34.117.186.192 | 192.168.2.4 |
| Mar 29, 2024 09:52:26.499058008 CET | 443 | 49741 | 34.117.186.192 | 192.168.2.4 |
| Mar 29, 2024 09:52:26.499154091 CET | 49741 | 443 | 192.168.2.4 | 34.117.186.192 |
| Mar 29, 2024 09:52:26.524405956 CET | 49741 | 443 | 192.168.2.4 | 34.117.186.192 |
| Mar 29, 2024 09:52:26.524420023 CET | 443 | 49741 | 34.117.186.192 | 192.168.2.4 |
| Mar 29, 2024 09:52:26.524610043 CET | 443 | 49741 | 34.117.186.192 | 192.168.2.4 |
| Mar 29, 2024 09:52:26.575359106 CET | 49741 | 443 | 192.168.2.4 | 34.117.186.192 |
| Mar 29, 2024 09:52:26.620240927 CET | 443 | 49741 | 34.117.186.192 | 192.168.2.4 |
| Mar 29, 2024 09:52:26.783081055 CET | 443 | 49741 | 34.117.186.192 | 192.168.2.4 |
| Mar 29, 2024 09:52:26.783188105 CET | 443 | 49741 | 34.117.186.192 | 192.168.2.4 |
| Mar 29, 2024 09:52:26.783312082 CET | 49741 | 443 | 192.168.2.4 | 34.117.186.192 |
| Mar 29, 2024 09:52:26.783554077 CET | 49741 | 443 | 192.168.2.4 | 34.117.186.192 |
| Mar 29, 2024 09:52:26.783567905 CET | 443 | 49741 | 34.117.186.192 | 192.168.2.4 |
| Mar 29, 2024 09:52:26.783585072 CET | 49741 | 443 | 192.168.2.4 | 34.117.186.192 |
| Mar 29, 2024 09:52:26.783590078 CET | 443 | 49741 | 34.117.186.192 | 192.168.2.4 |
| Mar 29, 2024 09:52:26.784960985 CET | 49742 | 443 | 192.168.2.4 | 104.26.5.15 |
| Mar 29, 2024 09:52:26.784992933 CET | 443 | 49742 | 104.26.5.15 | 192.168.2.4 |
| Mar 29, 2024 09:52:26.785063982 CET | 49742 | 443 | 192.168.2.4 | 104.26.5.15 |
| Mar 29, 2024 09:52:26.785335064 CET | 49742 | 443 | 192.168.2.4 | 104.26.5.15 |
| Mar 29, 2024 09:52:26.785346031 CET | 443 | 49742 | 104.26.5.15 | 192.168.2.4 |
| Mar 29, 2024 09:52:26.983164072 CET | 443 | 49742 | 104.26.5.15 | 192.168.2.4 |
| Mar 29, 2024 09:52:26.983270884 CET | 49742 | 443 | 192.168.2.4 | 104.26.5.15 |
| Mar 29, 2024 09:52:26.984348059 CET | 49742 | 443 | 192.168.2.4 | 104.26.5.15 |
| Mar 29, 2024 09:52:26.984354019 CET | 443 | 49742 | 104.26.5.15 | 192.168.2.4 |
| Mar 29, 2024 09:52:26.984560013 CET | 443 | 49742 | 104.26.5.15 | 192.168.2.4 |
| Mar 29, 2024 09:52:26.985836029 CET | 49742 | 443 | 192.168.2.4 | 104.26.5.15 |
| Mar 29, 2024 09:52:27.028234959 CET | 443 | 49742 | 104.26.5.15 | 192.168.2.4 |
| Mar 29, 2024 09:52:27.259219885 CET | 443 | 49742 | 104.26.5.15 | 192.168.2.4 |
| Mar 29, 2024 09:52:27.259305954 CET | 443 | 49742 | 104.26.5.15 | 192.168.2.4 |
| Mar 29, 2024 09:52:27.259404898 CET | 49742 | 443 | 192.168.2.4 | 104.26.5.15 |
| Mar 29, 2024 09:52:27.259758949 CET | 49742 | 443 | 192.168.2.4 | 104.26.5.15 |
| Mar 29, 2024 09:52:27.259773970 CET | 443 | 49742 | 104.26.5.15 | 192.168.2.4 |
| Mar 29, 2024 09:52:27.259790897 CET | 49742 | 443 | 192.168.2.4 | 104.26.5.15 |
| Mar 29, 2024 09:52:27.259794950 CET | 443 | 49742 | 104.26.5.15 | 192.168.2.4 |
| Mar 29, 2024 09:52:27.260297060 CET | 49740 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:27.474915028 CET | 50500 | 49740 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:27.486480951 CET | 49740 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:27.699157000 CET | 50500 | 49740 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:27.705178976 CET | 49740 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:27.861443043 CET | 49730 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:27.918617010 CET | 50500 | 49740 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:27.924113989 CET | 49740 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:28.137654066 CET | 50500 | 49740 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:28.142750025 CET | 49740 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:28.356585026 CET | 50500 | 49740 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:28.408198118 CET | 49740 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:28.533381939 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:28.579868078 CET | 49740 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:28.744523048 CET | 50500 | 49739 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:28.798820972 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:33.185117006 CET | 49743 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:33.395116091 CET | 50500 | 49743 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:33.395231009 CET | 49743 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:33.414874077 CET | 49743 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:33.605109930 CET | 50500 | 49743 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:33.624623060 CET | 50500 | 49743 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:33.624780893 CET | 49743 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:33.721302986 CET | 49743 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:33.834753990 CET | 50500 | 49743 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:33.877491951 CET | 49743 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:33.972068071 CET | 50500 | 49743 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:34.089683056 CET | 49744 | 443 | 192.168.2.4 | 34.117.186.192 |
| Mar 29, 2024 09:52:34.089714050 CET | 443 | 49744 | 34.117.186.192 | 192.168.2.4 |
| Mar 29, 2024 09:52:34.089843988 CET | 49744 | 443 | 192.168.2.4 | 34.117.186.192 |
| Mar 29, 2024 09:52:34.090833902 CET | 49744 | 443 | 192.168.2.4 | 34.117.186.192 |
| Mar 29, 2024 09:52:34.090850115 CET | 443 | 49744 | 34.117.186.192 | 192.168.2.4 |
| Mar 29, 2024 09:52:34.357686996 CET | 443 | 49744 | 34.117.186.192 | 192.168.2.4 |
| Mar 29, 2024 09:52:34.357769966 CET | 49744 | 443 | 192.168.2.4 | 34.117.186.192 |
| Mar 29, 2024 09:52:34.358900070 CET | 49744 | 443 | 192.168.2.4 | 34.117.186.192 |
| Mar 29, 2024 09:52:34.358911037 CET | 443 | 49744 | 34.117.186.192 | 192.168.2.4 |
| Mar 29, 2024 09:52:34.359144926 CET | 443 | 49744 | 34.117.186.192 | 192.168.2.4 |
| Mar 29, 2024 09:52:34.400988102 CET | 49744 | 443 | 192.168.2.4 | 34.117.186.192 |
| Mar 29, 2024 09:52:34.448236942 CET | 443 | 49744 | 34.117.186.192 | 192.168.2.4 |
| Mar 29, 2024 09:52:34.691363096 CET | 443 | 49744 | 34.117.186.192 | 192.168.2.4 |
| Mar 29, 2024 09:52:34.691472054 CET | 443 | 49744 | 34.117.186.192 | 192.168.2.4 |
| Mar 29, 2024 09:52:34.691523075 CET | 49744 | 443 | 192.168.2.4 | 34.117.186.192 |
| Mar 29, 2024 09:52:34.691951990 CET | 49744 | 443 | 192.168.2.4 | 34.117.186.192 |
| Mar 29, 2024 09:52:34.691967010 CET | 443 | 49744 | 34.117.186.192 | 192.168.2.4 |
| Mar 29, 2024 09:52:34.691977978 CET | 49744 | 443 | 192.168.2.4 | 34.117.186.192 |
| Mar 29, 2024 09:52:34.691986084 CET | 443 | 49744 | 34.117.186.192 | 192.168.2.4 |
| Mar 29, 2024 09:52:34.693756104 CET | 49745 | 443 | 192.168.2.4 | 104.26.5.15 |
| Mar 29, 2024 09:52:34.693784952 CET | 443 | 49745 | 104.26.5.15 | 192.168.2.4 |
| Mar 29, 2024 09:52:34.693844080 CET | 49745 | 443 | 192.168.2.4 | 104.26.5.15 |
| Mar 29, 2024 09:52:34.694108009 CET | 49745 | 443 | 192.168.2.4 | 104.26.5.15 |
| Mar 29, 2024 09:52:34.694125891 CET | 443 | 49745 | 104.26.5.15 | 192.168.2.4 |
| Mar 29, 2024 09:52:34.891283035 CET | 443 | 49745 | 104.26.5.15 | 192.168.2.4 |
| Mar 29, 2024 09:52:34.891382933 CET | 49745 | 443 | 192.168.2.4 | 104.26.5.15 |
| Mar 29, 2024 09:52:34.892350912 CET | 49745 | 443 | 192.168.2.4 | 104.26.5.15 |
| Mar 29, 2024 09:52:34.892358065 CET | 443 | 49745 | 104.26.5.15 | 192.168.2.4 |
| Mar 29, 2024 09:52:34.892577887 CET | 443 | 49745 | 104.26.5.15 | 192.168.2.4 |
| Mar 29, 2024 09:52:34.893893957 CET | 49745 | 443 | 192.168.2.4 | 104.26.5.15 |
| Mar 29, 2024 09:52:34.940238953 CET | 443 | 49745 | 104.26.5.15 | 192.168.2.4 |
| Mar 29, 2024 09:52:35.155411959 CET | 443 | 49745 | 104.26.5.15 | 192.168.2.4 |
| Mar 29, 2024 09:52:35.155486107 CET | 443 | 49745 | 104.26.5.15 | 192.168.2.4 |
| Mar 29, 2024 09:52:35.155531883 CET | 49745 | 443 | 192.168.2.4 | 104.26.5.15 |
| Mar 29, 2024 09:52:35.155734062 CET | 49745 | 443 | 192.168.2.4 | 104.26.5.15 |
| Mar 29, 2024 09:52:35.155741930 CET | 443 | 49745 | 104.26.5.15 | 192.168.2.4 |
| Mar 29, 2024 09:52:35.155775070 CET | 49745 | 443 | 192.168.2.4 | 104.26.5.15 |
| Mar 29, 2024 09:52:35.155780077 CET | 443 | 49745 | 104.26.5.15 | 192.168.2.4 |
| Mar 29, 2024 09:52:35.156440020 CET | 49743 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:35.371289968 CET | 50500 | 49743 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:35.377690077 CET | 49743 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:35.592302084 CET | 50500 | 49743 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:35.596426010 CET | 49743 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:35.811886072 CET | 50500 | 49743 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:35.815062046 CET | 49743 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:36.029678106 CET | 50500 | 49743 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:36.040684938 CET | 49743 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:36.256264925 CET | 50500 | 49743 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:52:36.299329996 CET | 49743 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:36.497826099 CET | 49743 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:59.785238981 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:52:59.996463060 CET | 50500 | 49739 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:53:00.049362898 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:53:15.252811909 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:53:15.462970972 CET | 50500 | 49739 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:53:15.518178940 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:53:21.549491882 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:53:21.761274099 CET | 50500 | 49739 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:53:21.814986944 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:53:25.025491953 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:53:25.238485098 CET | 50500 | 49739 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:53:25.283745050 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:53:28.283864975 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:53:28.495157957 CET | 50500 | 49739 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:53:28.549364090 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:53:31.549534082 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:53:31.761509895 CET | 50500 | 49739 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:53:31.814963102 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:53:34.815105915 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:53:35.026787043 CET | 50500 | 49739 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:53:35.080615997 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:53:38.080696106 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:53:38.292431116 CET | 50500 | 49739 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:53:38.346312046 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:53:41.346355915 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:53:41.560314894 CET | 50500 | 49739 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:53:41.658716917 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:53:44.830986977 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:53:45.043648958 CET | 50500 | 49739 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:53:45.143245935 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:53:48.080950022 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:53:48.291970015 CET | 50500 | 49739 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:53:48.455594063 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:53:51.330846071 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:53:51.541327000 CET | 50500 | 49739 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:53:51.658720970 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:53:54.580775976 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:53:54.792592049 CET | 50500 | 49739 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:53:54.846220970 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:53:55.280529022 CET | 50500 | 49739 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:53:55.280685902 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:53:55.525907993 CET | 50500 | 49739 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:53:58.315921068 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:53:58.527532101 CET | 50500 | 49739 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:53:58.658725023 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:54:01.580230951 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:54:01.792102098 CET | 50500 | 49739 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:54:01.961574078 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:54:04.910082102 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:54:05.121825933 CET | 50500 | 49739 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:54:05.349014044 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:54:08.174408913 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:54:08.385802984 CET | 50500 | 49739 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:54:08.455595970 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:54:11.424418926 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:54:11.635817051 CET | 50500 | 49739 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:54:11.846220016 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:54:14.676002979 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:54:14.886895895 CET | 50500 | 49739 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:54:14.955600023 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:54:17.928812027 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:54:18.140894890 CET | 50500 | 49739 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:54:18.252485991 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:54:22.127553940 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:54:22.339287996 CET | 50500 | 49739 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:54:22.455715895 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:54:25.393405914 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:54:25.604224920 CET | 50500 | 49739 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:54:25.752573013 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:54:28.645076990 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:54:28.856411934 CET | 50500 | 49739 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:54:28.955595970 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:54:31.895070076 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:54:32.106734991 CET | 50500 | 49739 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:54:32.252492905 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:54:35.164869070 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:54:35.376229048 CET | 50500 | 49739 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:54:35.455610991 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:54:38.652957916 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:54:38.863168955 CET | 50500 | 49739 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:54:38.955614090 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:54:42.143204927 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:54:42.354347944 CET | 50500 | 49739 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:54:42.455598116 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:54:45.393176079 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:54:45.604057074 CET | 50500 | 49739 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:54:45.661122084 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:54:48.644686937 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:54:48.855670929 CET | 50500 | 49739 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:54:49.050008059 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:54:51.893184900 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:54:52.105062962 CET | 50500 | 49739 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:54:52.158720016 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:54:55.143279076 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:54:55.354548931 CET | 50500 | 49739 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:54:55.455647945 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:54:58.409810066 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:54:58.619815111 CET | 50500 | 49739 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:54:58.846257925 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:55:01.662570953 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:55:01.872827053 CET | 50500 | 49739 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:55:01.955588102 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:55:04.908973932 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:55:05.119431019 CET | 50500 | 49739 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:55:05.346225023 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:55:08.177366972 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:55:08.388556004 CET | 50500 | 49739 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:55:08.456573963 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:55:11.440179110 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:55:11.650518894 CET | 50500 | 49739 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:55:11.752479076 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:55:14.707612038 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:55:14.919862986 CET | 50500 | 49739 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:55:15.174442053 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:55:18.587019920 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:55:18.797868013 CET | 50500 | 49739 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:55:18.861855030 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:55:21.846363068 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:55:22.057012081 CET | 50500 | 49739 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:55:22.158718109 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:55:25.117132902 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:55:25.281995058 CET | 50500 | 49739 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:55:25.346282005 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:55:25.363209963 CET | 50500 | 49739 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:55:25.363449097 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:55:25.551270008 CET | 50500 | 49739 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:55:25.607762098 CET | 50500 | 49739 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:55:25.658729076 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:55:28.580676079 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:55:28.792134047 CET | 50500 | 49739 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:55:28.846230984 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:55:31.849064112 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:55:32.060343981 CET | 50500 | 49739 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:55:32.158736944 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:55:35.137706995 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:55:35.347902060 CET | 50500 | 49739 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:55:35.455600977 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:55:38.471355915 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:55:38.682786942 CET | 50500 | 49739 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:55:38.846239090 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:55:41.721306086 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:55:41.932992935 CET | 50500 | 49739 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:55:42.158726931 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:55:44.987236023 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:55:45.198513031 CET | 50500 | 49739 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:55:45.346230030 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:55:48.236948967 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:55:48.448401928 CET | 50500 | 49739 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:55:48.658751011 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:55:51.490940094 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:55:51.701431990 CET | 50500 | 49739 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:55:51.861891031 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:55:54.783850908 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:55:54.995332956 CET | 50500 | 49739 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:55:55.151170969 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:55:58.050062895 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:55:58.262820959 CET | 50500 | 49739 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:55:58.455607891 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:56:01.301414967 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Mar 29, 2024 09:56:01.513436079 CET | 50500 | 49739 | 95.216.41.236 | 192.168.2.4 |
| Mar 29, 2024 09:56:01.643199921 CET | 49739 | 50500 | 192.168.2.4 | 95.216.41.236 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Mar 29, 2024 09:52:16.139003992 CET | 51947 | 53 | 192.168.2.4 | 1.1.1.1 |
| Mar 29, 2024 09:52:16.234750986 CET | 53 | 51947 | 1.1.1.1 | 192.168.2.4 |
| Mar 29, 2024 09:52:16.809196949 CET | 64801 | 53 | 192.168.2.4 | 1.1.1.1 |
| Mar 29, 2024 09:52:16.906254053 CET | 53 | 64801 | 1.1.1.1 | 192.168.2.4 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Mar 29, 2024 09:52:16.139003992 CET | 192.168.2.4 | 1.1.1.1 | 0xb79a | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Mar 29, 2024 09:52:16.809196949 CET | 192.168.2.4 | 1.1.1.1 | 0x498b | Standard query (0) | A (IP address) | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Mar 29, 2024 09:52:16.234750986 CET | 1.1.1.1 | 192.168.2.4 | 0xb79a | No error (0) | 34.117.186.192 | A (IP address) | IN (0x0001) | false | ||
| Mar 29, 2024 09:52:16.906254053 CET | 1.1.1.1 | 192.168.2.4 | 0x498b | No error (0) | 104.26.5.15 | A (IP address) | IN (0x0001) | false | ||
| Mar 29, 2024 09:52:16.906254053 CET | 1.1.1.1 | 192.168.2.4 | 0x498b | No error (0) | 172.67.75.166 | A (IP address) | IN (0x0001) | false | ||
| Mar 29, 2024 09:52:16.906254053 CET | 1.1.1.1 | 192.168.2.4 | 0x498b | No error (0) | 104.26.4.15 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.4 | 49732 | 34.117.186.192 | 443 | 2004 | C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-03-29 08:52:16 UTC | 238 | OUT | |
| 2024-03-29 08:52:16 UTC | 514 | IN | |
| 2024-03-29 08:52:16 UTC | 738 | IN | |
| 2024-03-29 08:52:16 UTC | 283 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.4 | 49734 | 104.26.5.15 | 443 | 2004 | C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-03-29 08:52:17 UTC | 262 | OUT | |
| 2024-03-29 08:52:17 UTC | 650 | IN | |
| 2024-03-29 08:52:17 UTC | 85 | IN | |
| 2024-03-29 08:52:17 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 2 | 192.168.2.4 | 49741 | 34.117.186.192 | 443 | 6884 | C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-03-29 08:52:26 UTC | 238 | OUT | |
| 2024-03-29 08:52:26 UTC | 514 | IN | |
| 2024-03-29 08:52:26 UTC | 738 | IN | |
| 2024-03-29 08:52:26 UTC | 283 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 3 | 192.168.2.4 | 49742 | 104.26.5.15 | 443 | 6884 | C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-03-29 08:52:26 UTC | 262 | OUT | |
| 2024-03-29 08:52:27 UTC | 652 | IN | |
| 2024-03-29 08:52:27 UTC | 85 | IN | |
| 2024-03-29 08:52:27 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 4 | 192.168.2.4 | 49744 | 34.117.186.192 | 443 | 5500 | C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-03-29 08:52:34 UTC | 238 | OUT | |
| 2024-03-29 08:52:34 UTC | 515 | IN | |
| 2024-03-29 08:52:34 UTC | 737 | IN | |
| 2024-03-29 08:52:34 UTC | 284 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 5 | 192.168.2.4 | 49745 | 104.26.5.15 | 443 | 5500 | C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-03-29 08:52:34 UTC | 262 | OUT | |
| 2024-03-29 08:52:35 UTC | 656 | IN | |
| 2024-03-29 08:52:35 UTC | 85 | IN | |
| 2024-03-29 08:52:35 UTC | 5 | IN |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
| Target ID: | 0 |
| Start time: | 09:51:55 |
| Start date: | 29/03/2024 |
| Path: | C:\Users\user\Desktop\MXpl6HFisn.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff6a5780000 |
| File size: | 21'056'512 bytes |
| MD5 hash: | 0AADBCA2D0A26B8F90FD4F31CB7F2FFC |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | Go lang |
| Yara matches: |
|
| Reputation: | low |
| Has exited: | true |
| Target ID: | 1 |
| Start time: | 09:52:06 |
| Start date: | 29/03/2024 |
| Path: | C:\Users\Public\Libraries\(0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff7b7920000 |
| File size: | 21'056'512 bytes |
| MD5 hash: | 0AADBCA2D0A26B8F90FD4F31CB7F2FFC |
| Has elevated privileges: | false |
| Has administrator privileges: | false |
| Programmed in: | Go lang |
| Yara matches: |
|
| Antivirus matches: |
|
| Reputation: | low |
| Has exited: | true |
| Target ID: | 2 |
| Start time: | 09:52:11 |
| Start date: | 29/03/2024 |
| Path: | C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x670000 |
| File size: | 231'736 bytes |
| MD5 hash: | A64BEAB5D4516BECA4C40B25DC0C1CD8 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Reputation: | moderate |
| Has exited: | false |
| Target ID: | 4 |
| Start time: | 09:52:14 |
| Start date: | 29/03/2024 |
| Path: | C:\Users\Public\Libraries\(0aadbca2d0a26b8f90fd4f31cb7f2ffc)MXpl6HFisn.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff7b7920000 |
| File size: | 21'056'512 bytes |
| MD5 hash: | 0AADBCA2D0A26B8F90FD4F31CB7F2FFC |
| Has elevated privileges: | false |
| Has administrator privileges: | false |
| Programmed in: | Go lang |
| Yara matches: |
|
| Reputation: | low |
| Has exited: | true |
| Target ID: | 5 |
| Start time: | 09:52:21 |
| Start date: | 29/03/2024 |
| Path: | C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x670000 |
| File size: | 231'736 bytes |
| MD5 hash: | A64BEAB5D4516BECA4C40B25DC0C1CD8 |
| Has elevated privileges: | false |
| Has administrator privileges: | false |
| Programmed in: | C, C++ or other language |
| Reputation: | moderate |
| Has exited: | true |
| Target ID: | 8 |
| Start time: | 09:52:28 |
| Start date: | 29/03/2024 |
| Path: | C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x670000 |
| File size: | 231'736 bytes |
| MD5 hash: | A64BEAB5D4516BECA4C40B25DC0C1CD8 |
| Has elevated privileges: | false |
| Has administrator privileges: | false |
| Programmed in: | C, C++ or other language |
| Reputation: | moderate |
| Has exited: | true |
Execution Graph
| Execution Coverage: | 9.4% |
| Dynamic/Decrypted Code Coverage: | 4.9% |
| Signature Coverage: | 14.5% |
| Total number of Nodes: | 2000 |
| Total number of Limit Nodes: | 170 |
Graph
Function 02A0C390 Relevance: 95.9, APIs: 43, Strings: 11, Instructions: 1449registryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 02A43090 Relevance: 93.6, APIs: 40, Strings: 12, Instructions: 2579fileCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 02A0E0B0 Relevance: 91.0, APIs: 48, Strings: 3, Instructions: 1776fileCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 02A5D4C0 Relevance: 72.8, APIs: 25, Strings: 15, Instructions: 2783COMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 02A49480 Relevance: 54.6, APIs: 14, Strings: 14, Instructions: 5600COMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 02A44387 Relevance: 43.6, APIs: 20, Strings: 4, Instructions: 1609fileCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 02A28069 Relevance: 34.5, Strings: 26, Instructions: 1993COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 02A357D0 Relevance: 29.9, APIs: 6, Strings: 10, Instructions: 1946stringCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 02A41150 Relevance: 25.5, APIs: 13, Strings: 1, Instructions: 963registryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Control-flow Graph
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 02A2E048 Relevance: 12.7, Strings: 9, Instructions: 1446COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 02A2E169 Relevance: 12.7, Strings: 9, Instructions: 1445COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 02A561A0 Relevance: 11.5, Strings: 8, Instructions: 1548COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 02A641C3 Relevance: 11.0, APIs: 5, Strings: 1, Instructions: 470threadsynchronizationCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 02A64405 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 346threadsynchronizationCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 02A1C000 Relevance: 8.8, Strings: 6, Instructions: 1274COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 02A62460 Relevance: 7.7, APIs: 5, Instructions: 156sleepCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 02ACC4A0 Relevance: 7.0, Strings: 4, Instructions: 2001COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 02A23A68 Relevance: 4.7, Strings: 3, Instructions: 922COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 02ADC3BA Relevance: 4.5, APIs: 3, Instructions: 35COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 02A596F9 Relevance: 1.7, Strings: 1, Instructions: 433COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 02A1F5F0 Relevance: 1.6, APIs: 1, Instructions: 137COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 02AEA58E Relevance: 1.6, Strings: 1, Instructions: 318COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 02A331C6 Relevance: .9, Instructions: 937COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 02A8D5A0 Relevance: .6, Instructions: 648COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 02A8E240 Relevance: .3, Instructions: 300COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 02A8D340 Relevance: .1, Instructions: 76COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Control-flow Graph
| APIs |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 02A0C0F0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 176registryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 02AED234 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273COMMONLIBRARYCODE
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 02A0B790 Relevance: 16.4, APIs: 5, Strings: 4, Instructions: 668registryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 02A1E140 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 363libraryloadernetworkCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 02A92210 Relevance: 6.1, APIs: 4, Instructions: 66fileCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 02A0A5F0 Relevance: 4.6, APIs: 3, Instructions: 60COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 02A921C0 Relevance: 4.5, APIs: 3, Instructions: 31sleepCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 02AF6189 Relevance: 4.5, APIs: 3, Instructions: 17fileCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 02A676D0 Relevance: 3.2, APIs: 2, Instructions: 187COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 02A05340 Relevance: 3.1, APIs: 2, Instructions: 103COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 02A1F7E0 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 33sleepCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 02A1F770 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 33sleepCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 02A0A670 Relevance: 3.0, APIs: 2, Instructions: 30COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 02AF57D3 Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 02A316B0 Relevance: 2.0, APIs: 1, Instructions: 542COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 02A97240 Relevance: 2.0, APIs: 1, Instructions: 454COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 02AE3362 Relevance: 1.7, APIs: 1, Instructions: 157COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 02A0A170 Relevance: 1.6, APIs: 1, Instructions: 140COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 02A69190 Relevance: 1.6, APIs: 1, Instructions: 116COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 02A02AE0 Relevance: 1.6, APIs: 1, Instructions: 88COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 02AF5438 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Function 02A0B260 Relevance: 1.5, APIs: 1, Instructions: 36COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |