Edit tour
Windows
Analysis Report
YnsEArPlqx.exe
Overview
General Information
| Sample name: | YnsEArPlqx.exerenamed because original name is a hash value |
| Original sample name: | ab8e88bff0b907fc49b949d704490018.exe |
| Analysis ID: | 1460294 |
| MD5: | ab8e88bff0b907fc49b949d704490018 |
| SHA1: | 559f2f2b61bd344293f7cbc78b72d8e368910ae3 |
| SHA256: | 921c5314fc334bac928a8398da1c8341b1021cf92ae83bf8b872d422f2e7ef8f |
| Tags: | exeRiseProStealer |
| Infos: |   |
 | |
Detection
RisePro Stealer
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus detection for URL or domain
Multi AV Scanner detection for dropped file
Snort IDS alert for network traffic
Yara detected RisePro Stealer
AI detected suspicious sample
Connects to many ports of the same IP (likely port scanning)
Contains functionality to inject threads in other processes
Found stalling execution ending in API Sleep call
Machine Learning detection for dropped file
Machine Learning detection for sample
PE file contains section with special chars
Query firmware table information (likely to detect VMs)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Uses schtasks.exe or at.exe to add and modify task schedules
Contains capabilities to detect virtual machines
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to dynamically determine API calls
Contains functionality to query locales information (e.g. system language)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Entry point lies outside standard sections
Found decision node followed by non-executed suspicious APIs
Found evasive API chain (date check)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Classification
- System is w10x64
YnsEArPlqx.exe (PID: 7408 cmdline: "C:\Users\ user\Deskt op\YnsEArP lqx.exe" MD5: AB8E88BFF0B907FC49B949D704490018) 
schtasks.exe (PID: 7528 cmdline: schtasks / create /f /RU "user" /tr "C:\P rogramData \MPGPH131\ MPGPH131.e xe" /tn "M PGPH131 HR " /sc HOUR LY /rl HIG HEST MD5: 48C2FE20575769DE916F48EF0676A965) 
conhost.exe (PID: 7536 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - schtasks.exe (PID: 7576 cmdline:
schtasks / create /f /RU "user" /tr "C:\P rogramData \MPGPH131\ MPGPH131.e xe" /tn "M PGPH131 LG " /sc ONLO GON /rl HI GHEST MD5: 48C2FE20575769DE916F48EF0676A965) - conhost.exe (PID: 7584 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
- MPGPH131.exe (PID: 7632 cmdline:
C:\Program Data\MPGPH 131\MPGPH1 31.exe MD5: AB8E88BFF0B907FC49B949D704490018)
- MPGPH131.exe (PID: 7640 cmdline:
C:\Program Data\MPGPH 131\MPGPH1 31.exe MD5: AB8E88BFF0B907FC49B949D704490018)
- RageMP131.exe (PID: 7852 cmdline:
"C:\Users\ user\AppDa ta\Local\R ageMP131\R ageMP131.e xe" MD5: AB8E88BFF0B907FC49B949D704490018)
- RageMP131.exe (PID: 8008 cmdline:
"C:\Users\ user\AppDa ta\Local\R ageMP131\R ageMP131.e xe" MD5: AB8E88BFF0B907FC49B949D704490018)
- cleanup
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_RiseProStealer | Yara detected RisePro Stealer | Joe Security | ||
| JoeSecurity_RiseProStealer | Yara detected RisePro Stealer | Joe Security | ||
| JoeSecurity_RiseProStealer | Yara detected RisePro Stealer | Joe Security | ||
| JoeSecurity_RiseProStealer | Yara detected RisePro Stealer | Joe Security | ||
| JoeSecurity_RiseProStealer | Yara detected RisePro Stealer | Joe Security |
System Summary |   |
|---|
| Source: | Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): | ||
| Timestamp: | 06/20/24-18:59:13.624078 |
| SID: | 2046269 |
| Source Port: | 49741 |
| Destination Port: | 58709 |
| Protocol: | TCP |
| Classtype: | A Network Trojan was detected |
| Timestamp: | 06/20/24-18:58:58.560662 |
| SID: | 2046269 |
| Source Port: | 49732 |
| Destination Port: | 58709 |
| Protocol: | TCP |
| Classtype: | A Network Trojan was detected |
| Timestamp: | 06/20/24-18:58:52.840391 |
| SID: | 2046269 |
| Source Port: | 49731 |
| Destination Port: | 58709 |
| Protocol: | TCP |
| Classtype: | A Network Trojan was detected |
| Timestamp: | 06/20/24-18:57:14.894991 |
| SID: | 2049060 |
| Source Port: | 49731 |
| Destination Port: | 58709 |
| Protocol: | TCP |
| Classtype: | A Network Trojan was detected |
| Timestamp: | 06/20/24-18:59:07.355875 |
| SID: | 2046269 |
| Source Port: | 49739 |
| Destination Port: | 58709 |
| Protocol: | TCP |
| Classtype: | A Network Trojan was detected |
| Timestamp: | 06/20/24-18:57:18.828226 |
| SID: | 2046266 |
| Source Port: | 58709 |
| Destination Port: | 49732 |
| Protocol: | TCP |
| Classtype: | A Network Trojan was detected |
| Timestamp: | 06/20/24-18:58:03.049093 |
| SID: | 2046267 |
| Source Port: | 58709 |
| Destination Port: | 49741 |
| Protocol: | TCP |
| Classtype: | A Network Trojan was detected |
| Timestamp: | 06/20/24-18:57:35.040865 |
| SID: | 2046266 |
| Source Port: | 58709 |
| Destination Port: | 49741 |
| Protocol: | TCP |
| Classtype: | A Network Trojan was detected |
| Timestamp: | 06/20/24-18:57:15.478080 |
| SID: | 2046266 |
| Source Port: | 58709 |
| Destination Port: | 49731 |
| Protocol: | TCP |
| Classtype: | A Network Trojan was detected |
| Timestamp: | 06/20/24-18:57:18.837910 |
| SID: | 2046266 |
| Source Port: | 58709 |
| Destination Port: | 49733 |
| Protocol: | TCP |
| Classtype: | A Network Trojan was detected |
| Timestamp: | 06/20/24-18:58:58.606045 |
| SID: | 2046269 |
| Source Port: | 49733 |
| Destination Port: | 58709 |
| Protocol: | TCP |
| Classtype: | A Network Trojan was detected |
| Timestamp: | 06/20/24-18:57:40.684951 |
| SID: | 2046267 |
| Source Port: | 58709 |
| Destination Port: | 49739 |
| Protocol: | TCP |
| Classtype: | A Network Trojan was detected |
| Timestamp: | 06/20/24-18:57:26.019896 |
| SID: | 2046266 |
| Source Port: | 58709 |
| Destination Port: | 49739 |
| Protocol: | TCP |
| Classtype: | A Network Trojan was detected |
| Timestamp: | 06/20/24-18:57:40.086663 |
| SID: | 2046267 |
| Source Port: | 58709 |
| Destination Port: | 49731 |
| Protocol: | TCP |
| Classtype: | A Network Trojan was detected |
| Timestamp: | 06/20/24-18:57:40.210568 |
| SID: | 2046267 |
| Source Port: | 58709 |
| Destination Port: | 49732 |
| Protocol: | TCP |
| Classtype: | A Network Trojan was detected |
| Timestamp: | 06/20/24-18:57:40.261626 |
| SID: | 2046267 |
| Source Port: | 58709 |
| Destination Port: | 49733 |
| Protocol: | TCP |
| Classtype: | A Network Trojan was detected |
Click to jump to signature section
Show All Signature Results
AV Detection | |
|---|
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | ReversingLabs: | ||
| Source: | ReversingLabs: | ||
| Source: | Integrated Neural Analysis Model: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Static PE information: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Code function: | 0_2_00431F9C | |
| Source: | Code function: | 6_2_00431F9C | |
| Source: | Code function: | 7_2_00431F9C | |
Networking | |
|---|
| Source: | Snort IDS: | ||
| Source: | Snort IDS: | ||
| Source: | Snort IDS: | ||
| Source: | Snort IDS: | ||
| Source: | Snort IDS: | ||
| Source: | Snort IDS: | ||
| Source: | Snort IDS: | ||
| Source: | Snort IDS: | ||
| Source: | Snort IDS: | ||
| Source: | Snort IDS: | ||
| Source: | Snort IDS: | ||
| Source: | Snort IDS: | ||
| Source: | Snort IDS: | ||
| Source: | Snort IDS: | ||
| Source: | Snort IDS: | ||
| Source: | Snort IDS: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | HTTP traffic detected: | ||
| Source: | IP Address: | ||
| Source: | IP Address: | ||
| Source: | IP Address: | ||
| Source: | IP Address: | ||
| Source: | ASN Name: | ||
| Source: | JA3 fingerprint: | ||
| Source: | DNS query: | ||
| Source: | DNS query: | ||
| Source: | DNS query: | ||
| Source: | DNS query: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | Code function: | 0_2_00409280 | |
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
System Summary | |
|---|
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Code function: | 0_2_0043C960 | |
| Source: | Code function: | 0_2_0043A928 | |
| Source: | Code function: | 0_2_004371A0 | |
| Source: | Code function: | 0_2_0044DA86 | |
| Source: | Code function: | 0_2_0044036F | |
| Source: | Code function: | 0_2_00458BB0 | |
| Source: | Code function: | 0_2_004EFC40 | |
| Source: | Code function: | 0_2_0042F580 | |
| Source: | Code function: | 0_2_00452610 | |
| Source: | Code function: | 0_2_004F2FD0 | |
| Source: | Code function: | 0_2_004547BF | |
| Source: | Code function: | 6_2_0043C960 | |
| Source: | Code function: | 6_2_0043A928 | |
| Source: | Code function: | 6_2_004371A0 | |
| Source: | Code function: | 6_2_0044DA86 | |
| Source: | Code function: | 6_2_0044036F | |
| Source: | Code function: | 6_2_00458BB0 | |
| Source: | Code function: | 6_2_004EFC40 | |
| Source: | Code function: | 6_2_0042F580 | |
| Source: | Code function: | 6_2_00452610 | |
| Source: | Code function: | 6_2_004F2FD0 | |
| Source: | Code function: | 6_2_004547BF | |
| Source: | Code function: | 7_2_0043C960 | |
| Source: | Code function: | 7_2_0043A928 | |
| Source: | Code function: | 7_2_004371A0 | |
| Source: | Code function: | 7_2_0044DA86 | |
| Source: | Code function: | 7_2_0044036F | |
| Source: | Code function: | 7_2_00458BB0 | |
| Source: | Code function: | 7_2_004EFC40 | |
| Source: | Code function: | 7_2_0042F580 | |
| Source: | Code function: | 7_2_00452610 | |
| Source: | Code function: | 7_2_004F2FD0 | |
| Source: | Code function: | 7_2_004547BF | |
| Source: | Code function: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Classification label: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Static file information: | ||
| Source: | Static PE information: | ||
| Source: | Code function: | 0_2_004CF280 | |
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Code function: | 0_2_0058901D | |
| Source: | Code function: | 0_2_00822BC8 | |
| Source: | Code function: | 0_2_00822C06 | |
| Source: | Code function: | 0_2_00822C19 | |
| Source: | Code function: | 0_2_00822C1D | |
| Source: | Code function: | 0_2_00822C7A | |
| Source: | Code function: | 0_2_00433F6C | |
| Source: | Code function: | 6_2_00822BC8 | |
| Source: | Code function: | 6_2_00822C06 | |
| Source: | Code function: | 6_2_00822C19 | |
| Source: | Code function: | 6_2_00822C1D | |
| Source: | Code function: | 6_2_00822C7A | |
| Source: | Code function: | 6_2_00433F6C | |
| Source: | Code function: | 7_2_00822BC8 | |
| Source: | Code function: | 7_2_00822C06 | |
| Source: | Code function: | 7_2_00822C19 | |
| Source: | Code function: | 7_2_00822C1D | |
| Source: | Code function: | 7_2_00822C7A | |
| Source: | Code function: | 7_2_00433F6C | |
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
Boot Survival | |
|---|
| Source: | Process created: | ||
| Source: | Registry value created or modified: | Jump to behavior | ||
| Source: | Registry value created or modified: | Jump to behavior | ||
Malware Analysis System Evasion | |
|---|
| Source: | Stalling execution: | graph_0-13672 | ||
| Source: | Stalling execution: | graph_6-14101 | ||
| Source: | System information queried: | Jump to behavior | ||
| Source: | System information queried: | Jump to behavior | ||
| Source: | System information queried: | Jump to behavior | ||
| Source: | System information queried: | Jump to behavior | ||
| Source: | System information queried: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Registry key queried: | Jump to behavior | ||
| Source: | Registry key queried: | Jump to behavior | ||
| Source: | Registry key queried: | Jump to behavior | ||
| Source: | Decision node followed by non-executed suspicious API: | graph_0-13677 | ||
| Source: | Decision node followed by non-executed suspicious API: | graph_6-14116 | ||
| Source: | Evasive API call chain: | graph_6-16081 | ||
| Source: | Evasive API call chain: | graph_0-16274 | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Last function: | ||
| Source: | Last function: | ||
| Source: | Last function: | ||
| Source: | Last function: | ||
| Source: | Last function: | ||
| Source: | Last function: | ||
| Source: | Last function: | ||
| Source: | Code function: | 0_2_00431F9C | |
| Source: | Code function: | 6_2_00431F9C | |
| Source: | Code function: | 7_2_00431F9C | |
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Code function: | 0_2_00438A64 | |
| Source: | Code function: | 0_2_004CF280 | |
| Source: | Code function: | 0_2_00438A64 | |
| Source: | Code function: | 0_2_0043451D | |
| Source: | Code function: | 6_2_00438A64 | |
| Source: | Code function: | 6_2_0043451D | |
| Source: | Code function: | 7_2_00438A64 | |
| Source: | Code function: | 7_2_0043451D | |
HIPS / PFW / Operating System Protection Evasion | |
|---|
| Source: | Code function: | 0_2_004CF280 | |
| Source: | Code function: | 6_2_004CF280 | |
| Source: | Code function: | 7_2_004CF280 | |
| Source: | Code function: | 0_2_004531CA | |
| Source: | Code function: | 0_2_0044B1B1 | |
| Source: | Code function: | 0_2_004532F3 | |
| Source: | Code function: | 0_2_00452B5A | |
| Source: | Code function: | 0_2_004533F9 | |
| Source: | Code function: | 0_2_004534CF | |
| Source: | Code function: | 0_2_00452D5F | |
| Source: | Code function: | 0_2_00452E51 | |
| Source: | Code function: | 0_2_00452E06 | |
| Source: | Code function: | 0_2_00452EEC | |
| Source: | Code function: | 0_2_00452F77 | |
| Source: | Code function: | 0_2_0044B734 | |
| Source: | Code function: | 6_2_004531CA | |
| Source: | Code function: | 6_2_0044B1B1 | |
| Source: | Code function: | 6_2_004532F3 | |
| Source: | Code function: | 6_2_00452B5A | |
| Source: | Code function: | 6_2_004533F9 | |
| Source: | Code function: | 6_2_004534CF | |
| Source: | Code function: | 6_2_00452D5F | |
| Source: | Code function: | 6_2_00452E51 | |
| Source: | Code function: | 6_2_00452E06 | |
| Source: | Code function: | 6_2_00452EEC | |
| Source: | Code function: | 6_2_00452F77 | |
| Source: | Code function: | 6_2_0044B734 | |
| Source: | Code function: | 7_2_004531CA | |
| Source: | Code function: | 7_2_0044B1B1 | |
| Source: | Code function: | 7_2_004532F3 | |
| Source: | Code function: | 7_2_00452B5A | |
| Source: | Code function: | 7_2_004533F9 | |
| Source: | Code function: | 7_2_004534CF | |
| Source: | Code function: | 7_2_00452D5F | |
| Source: | Code function: | 7_2_00452E51 | |
| Source: | Code function: | 7_2_00452E06 | |
| Source: | Code function: | 7_2_00452EEC | |
| Source: | Code function: | 7_2_00452F77 | |
| Source: | Code function: | 7_2_0044B734 | |
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Code function: | 0_2_0043361D | |
| Source: | Key value queried: | Jump to behavior | ||
Stealing of Sensitive Information | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
Remote Access Functionality | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | 2 Command and Scripting Interpreter | 1 Scheduled Task/Job | 11 Process Injection | 1 Masquerading | OS Credential Dumping | 1 System Time Discovery | Remote Services | 1 Archive Collected Data | 11 Encrypted Channel | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
| Credentials | Domains | Default Accounts | 1 Scheduled Task/Job | 1 Registry Run Keys / Startup Folder | 1 Scheduled Task/Job | 12 Virtualization/Sandbox Evasion | LSASS Memory | 321 Security Software Discovery | Remote Desktop Protocol | Data from Removable Media | 1 Non-Standard Port | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | 2 Native API | 1 DLL Side-Loading | 1 Registry Run Keys / Startup Folder | 11 Process Injection | Security Account Manager | 12 Virtualization/Sandbox Evasion | SMB/Windows Admin Shares | Data from Network Shared Drive | 2 Ingress Tool Transfer | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | 1 DLL Side-Loading | 1 Deobfuscate/Decode Files or Information | NTDS | 1 System Network Configuration Discovery | Distributed Component Object Model | Input Capture | 2 Non-Application Layer Protocol | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | Network Logon Script | 3 Obfuscated Files or Information | LSA Secrets | 1 File and Directory Discovery | SSH | Keylogging | 13 Application Layer Protocol | Scheduled Transfer | Data Encrypted for Impact |
| Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | 2 Software Packing | Cached Domain Credentials | 23 System Information Discovery | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
| DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | 1 DLL Side-Loading | DCSync | Remote System Discovery | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 100% | Joe Sandbox ML |
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 100% | Joe Sandbox ML | |||
| 100% | Joe Sandbox ML | |||
| 55% | ReversingLabs | Win32.Trojan.RiseProStealer | ||
| 55% | ReversingLabs | Win32.Trojan.RiseProStealer |
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | URL Reputation | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 100% | Avira URL Cloud | phishing | ||
| 100% | Avira URL Cloud | phishing | ||
| 100% | Avira URL Cloud | phishing | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 100% | Avira URL Cloud | phishing | ||
| 100% | Avira URL Cloud | phishing | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 100% | Avira URL Cloud | phishing | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 100% | Avira URL Cloud | phishing | ||
| 0% | Avira URL Cloud | safe | ||
| 100% | Avira URL Cloud | phishing | ||
| 0% | Avira URL Cloud | safe | ||
| 100% | Avira URL Cloud | phishing | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 100% | Avira URL Cloud | phishing | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 100% | Avira URL Cloud | phishing | ||
| 100% | Avira URL Cloud | phishing | ||
| 100% | Avira URL Cloud | phishing | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 100% | Avira URL Cloud | phishing | ||
| 100% | Avira URL Cloud | phishing | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 100% | Avira URL Cloud | malware | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| ipinfo.io | 34.117.186.192 | true | false | unknown | |
| db-ip.com | 172.67.75.166 | true | false | unknown |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| false |
| unknown | |
| false |
| unknown | |
| false |
| unknown |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 34.117.186.192 | ipinfo.io | United States | 139070 | GOOGLE-AS-APGoogleAsiaPacificPteLtdSG | false | |
| 172.67.75.166 | db-ip.com | United States | 13335 | CLOUDFLARENETUS | false | |
| 77.91.77.66 | unknown | Russian Federation | 42861 | FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU | true |
| Joe Sandbox version: | 40.0.0 Tourmaline |
| Analysis ID: | 1460294 |
| Start date and time: | 2024-06-20 18:56:06 +02:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 8m 34s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 14 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | YnsEArPlqx.exerenamed because original name is a hash value |
| Original Sample Name: | ab8e88bff0b907fc49b949d704490018.exe |
| Detection: | MAL |
| Classification: | mal100.troj.evad.winEXE@11/5@3/3 |
| EGA Information: |
|
| HCA Information: | Failed |
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
- Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
- Not all processes where analyzed, report is missing behavior information
- Report creation exceeded maximum time and may have missing disassembly code information.
- Report size exceeded maximum capacity and may have missing behavior information.
- Report size getting too big, too many NtOpenKeyEx calls found.
- Report size getting too big, too many NtQueryValueKey calls found.
- VT rate limit hit for: YnsEArPlqx.exe
| Time | Type | Description |
|---|---|---|
| 12:58:13 | API Interceptor | |
| 12:58:13 | API Interceptor | |
| 12:58:13 | API Interceptor | |
| 17:57:14 | Task Scheduler | |
| 17:57:14 | Task Scheduler | |
| 17:57:14 | Autostart | |
| 17:57:22 | Autostart |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 34.117.186.192 | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Planet Stealer | Browse |
| ||
| Get hash | malicious | Planet Stealer | Browse |
| ||
| Get hash | malicious | Xmrig | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| 172.67.75.166 | Get hash | malicious | RisePro Stealer | Browse | ||
| Get hash | malicious | RisePro Stealer | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | RisePro Stealer | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Amadey, RisePro Stealer | Browse | |||
| Get hash | malicious | RisePro Stealer | Browse | |||
| Get hash | malicious | RisePro Stealer | Browse | |||
| Get hash | malicious | RisePro Stealer | Browse | |||
| 77.91.77.66 | Get hash | malicious | RisePro Stealer | Browse | ||
| Get hash | malicious | Amadey, RisePro Stealer | Browse | |||
| Get hash | malicious | RisePro Stealer | Browse | |||
| Get hash | malicious | RisePro Stealer | Browse | |||
| Get hash | malicious | RisePro Stealer | Browse | |||
| Get hash | malicious | RisePro Stealer | Browse |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| ipinfo.io | Get hash | malicious | Amadey, RisePro Stealer | Browse |
| |
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| Get hash | malicious | LummaC, RisePro Stealer, Vidar | Browse |
| ||
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | NovaSentinel | Browse |
| ||
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| db-ip.com | Get hash | malicious | Amadey, RisePro Stealer | Browse |
| |
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| Get hash | malicious | LummaC, RisePro Stealer, Vidar | Browse |
| ||
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | RisePro Stealer | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU | Get hash | malicious | RisePro Stealer | Browse |
| |
| Get hash | malicious | Amadey, RisePro Stealer | Browse |
| ||
| Get hash | malicious | Python Stealer, Amadey, Monster Stealer, PureLog Stealer, RedLine, XWorm, zgRAT | Browse |
| ||
| Get hash | malicious | RedLine | Browse |
| ||
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| GOOGLE-AS-APGoogleAsiaPacificPteLtdSG | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Amadey, RisePro Stealer | Browse |
| ||
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| Get hash | malicious | LummaC, RisePro Stealer, Vidar | Browse |
| ||
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| Get hash | malicious | RisePro Stealer | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| CLOUDFLARENETUS | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | AgentTesla | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | FormBook | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| a0e9f5d64349fb13191bc781f81f42e1 | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | LummaC, PureLog Stealer, zgRAT | Browse |
| ||
| Get hash | malicious | LummaC, Amadey, LummaC Stealer | Browse |
| ||
| Get hash | malicious | Amadey, RisePro Stealer | Browse |
| ||
| Get hash | malicious | LummaC | Browse |
| ||
| Get hash | malicious | LummaC | Browse |
| ||
| Get hash | malicious | LummaC, Xmrig | Browse |
| ||
| Get hash | malicious | LummaC | Browse |
| ||
| Get hash | malicious | LummaC | Browse |
| ||
| Get hash | malicious | LummaC | Browse |
|
⊘No context
| Process: | C:\Users\user\Desktop\YnsEArPlqx.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 3270672 |
| Entropy (8bit): | 7.967404431164332 |
| Encrypted: | false |
| SSDEEP: | 98304:e5tF1/fIhf2JK5KtqWaUMrXYQjC4fbEaSNthtA:Ib4haKUt1aUWI4xfbnSHhu |
| MD5: | AB8E88BFF0B907FC49B949D704490018 |
| SHA1: | 559F2F2B61BD344293F7CBC78B72D8E368910AE3 |
| SHA-256: | 921C5314FC334BAC928A8398DA1C8341B1021CF92AE83BF8B872D422F2E7EF8F |
| SHA-512: | C2388EDC661CBAAECCF2FF9A2C153B5D201CF7A2C605570EB992AFA3878A0F24C96E1443713E9330833001A4D2BE245E6F49F281C663118ADEB76ECF7D2E41B5 |
| Malicious: | true |
| Antivirus: |
|
| Reputation: | low |
| Preview: |
| Process: | C:\Users\user\Desktop\YnsEArPlqx.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 26 |
| Entropy (8bit): | 3.95006375643621 |
| Encrypted: | false |
| SSDEEP: | 3:ggPYV:rPYV |
| MD5: | 187F488E27DB4AF347237FE461A079AD |
| SHA1: | 6693BA299EC1881249D59262276A0D2CB21F8E64 |
| SHA-256: | 255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309 |
| SHA-512: | 89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E |
| Malicious: | true |
| Reputation: | high, very likely benign file |
| Preview: |
| Process: | C:\Users\user\Desktop\YnsEArPlqx.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 3270672 |
| Entropy (8bit): | 7.967404431164332 |
| Encrypted: | false |
| SSDEEP: | 98304:e5tF1/fIhf2JK5KtqWaUMrXYQjC4fbEaSNthtA:Ib4haKUt1aUWI4xfbnSHhu |
| MD5: | AB8E88BFF0B907FC49B949D704490018 |
| SHA1: | 559F2F2B61BD344293F7CBC78B72D8E368910AE3 |
| SHA-256: | 921C5314FC334BAC928A8398DA1C8341B1021CF92AE83BF8B872D422F2E7EF8F |
| SHA-512: | C2388EDC661CBAAECCF2FF9A2C153B5D201CF7A2C605570EB992AFA3878A0F24C96E1443713E9330833001A4D2BE245E6F49F281C663118ADEB76ECF7D2E41B5 |
| Malicious: | true |
| Antivirus: |
|
| Reputation: | low |
| Preview: |
| Process: | C:\Users\user\Desktop\YnsEArPlqx.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 26 |
| Entropy (8bit): | 3.95006375643621 |
| Encrypted: | false |
| SSDEEP: | 3:ggPYV:rPYV |
| MD5: | 187F488E27DB4AF347237FE461A079AD |
| SHA1: | 6693BA299EC1881249D59262276A0D2CB21F8E64 |
| SHA-256: | 255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309 |
| SHA-512: | 89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E |
| Malicious: | true |
| Reputation: | high, very likely benign file |
| Preview: |
| Process: | C:\Users\user\Desktop\YnsEArPlqx.exe |
| File Type: | |
| Category: | modified |
| Size (bytes): | 13 |
| Entropy (8bit): | 2.8731406795131336 |
| Encrypted: | false |
| SSDEEP: | 3:L1VcuRn:TRRn |
| MD5: | D2322FA1329556D66DDD87C7F6D2456D |
| SHA1: | FEFE77CAE67D8ADEECAC37F97DA6B7BB3CF2CA4F |
| SHA-256: | 382F74819EB312810D9DC06212DFCACFE2AB3B3585DB98DFA83BB35EF0396E70 |
| SHA-512: | BD20A13F63A556FF645BC9FE1E5CC59E7B160C106207B2999881F8B4D661A597850A2BE1FA24A9E8FB6F6E4DCCB109EDF327A5E313F80054EC296F5715551970 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| File type: | |
| Entropy (8bit): | 7.967404431164332 |
| TrID: |
|
| File name: | YnsEArPlqx.exe |
| File size: | 3'270'672 bytes |
| MD5: | ab8e88bff0b907fc49b949d704490018 |
| SHA1: | 559f2f2b61bd344293f7cbc78b72d8e368910ae3 |
| SHA256: | 921c5314fc334bac928a8398da1c8341b1021cf92ae83bf8b872d422f2e7ef8f |
| SHA512: | c2388edc661cbaaeccf2ff9a2c153b5d201cf7a2c605570eb992afa3878a0f24c96e1443713e9330833001a4d2be245e6f49f281c663118adeb76ecf7d2e41b5 |
| SSDEEP: | 98304:e5tF1/fIhf2JK5KtqWaUMrXYQjC4fbEaSNthtA:Ib4haKUt1aUWI4xfbnSHhu |
| TLSH: | C0E53367CC66D2E5F27D54332B36890CA63A91A26E2355B5782F133068F2C4D87E1DCE |
| File Content Preview: | MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j.....s...s...s.e.p.%.s.e.v...s.e.t./.s..y..*.s..yw.=.s..yp.4.s..yv.u.s.e.w.6.s.e.u./.s.e.r.5.s...r...s..zz.2.s..z../.s...../.s |
 | |
| Icon Hash: | 8596a1a0a1a1b171 |
| Entrypoint: | 0x980058 |
| Entrypoint Section: | .boot |
| Digitally signed: | false |
| Imagebase: | 0x400000 |
| Subsystem: | windows gui |
| Image File Characteristics: | EXECUTABLE_IMAGE, 32BIT_MACHINE |
| DLL Characteristics: | TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x664C6914 [Tue May 21 09:27:48 2024 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 6 |
| OS Version Minor: | 0 |
| File Version Major: | 6 |
| File Version Minor: | 0 |
| Subsystem Version Major: | 6 |
| Subsystem Version Minor: | 0 |
| Import Hash: | 63814aaf116ba6abb6496ce4bcad24c6 |
| Instruction |
|---|
| call 00007FE248B82EC0h |
| push ebx |
| mov ebx, esp |
| push ebx |
| mov esi, dword ptr [ebx+08h] |
| mov edi, dword ptr [ebx+10h] |
| cld |
| mov dl, 80h |
| mov al, byte ptr [esi] |
| inc esi |
| mov byte ptr [edi], al |
| inc edi |
| mov ebx, 00000002h |
| add dl, dl |
| jne 00007FE248B82D77h |
| mov dl, byte ptr [esi] |
| inc esi |
| adc dl, dl |
| jnc 00007FE248B82D5Ch |
| add dl, dl |
| jne 00007FE248B82D77h |
| mov dl, byte ptr [esi] |
| inc esi |
| adc dl, dl |
| jnc 00007FE248B82DC3h |
| xor eax, eax |
| add dl, dl |
| jne 00007FE248B82D77h |
| mov dl, byte ptr [esi] |
| inc esi |
| adc dl, dl |
| jnc 00007FE248B82E57h |
| add dl, dl |
| jne 00007FE248B82D77h |
| mov dl, byte ptr [esi] |
| inc esi |
| adc dl, dl |
| adc eax, eax |
| add dl, dl |
| jne 00007FE248B82D77h |
| mov dl, byte ptr [esi] |
| inc esi |
| adc dl, dl |
| adc eax, eax |
| add dl, dl |
| jne 00007FE248B82D77h |
| mov dl, byte ptr [esi] |
| inc esi |
| adc dl, dl |
| adc eax, eax |
| add dl, dl |
| jne 00007FE248B82D77h |
| mov dl, byte ptr [esi] |
| inc esi |
| adc dl, dl |
| adc eax, eax |
| je 00007FE248B82D7Ah |
| push edi |
| mov eax, eax |
| sub edi, eax |
| mov al, byte ptr [edi] |
| pop edi |
| mov byte ptr [edi], al |
| inc edi |
| mov ebx, 00000002h |
| jmp 00007FE248B82D0Bh |
| mov eax, 00000001h |
| add dl, dl |
| jne 00007FE248B82D77h |
| mov dl, byte ptr [esi] |
| inc esi |
| adc dl, dl |
| adc eax, eax |
| add dl, dl |
| jne 00007FE248B82D77h |
| mov dl, byte ptr [esi] |
| inc esi |
| adc dl, dl |
| jc 00007FE248B82D5Ch |
| sub eax, ebx |
| mov ebx, 00000001h |
| jne 00007FE248B82D9Ah |
| mov ecx, 00000001h |
| add dl, dl |
| jne 00007FE248B82D77h |
| mov dl, byte ptr [esi] |
| inc esi |
| adc dl, dl |
| adc ecx, ecx |
| add dl, dl |
| jne 00007FE248B82D77h |
| mov dl, byte ptr [esi] |
| inc esi |
| adc dl, dl |
| jc 00007FE248B82D5Ch |
| push esi |
| mov esi, edi |
| sub esi, ebp |
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0x19618b | 0x184 | .idata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x18a000 | 0x1638 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x7e7000 | 0x10 | .reloc |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0x197018 | 0x18 | .tls |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x18369c | 0x40 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| 0x1000 | 0x15bbc8 | 0x9d200 | 261dcbc24cbc9eb16e95b23575219f53 | False | 0.9987973597852029 | data | 7.981638520890903 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | |
| 0x15d000 | 0x27e32 | 0x10a00 | 9c4edc30bf568b4831d47c2fa8adcade | False | 0.994140625 | data | 7.943472834836404 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | |
| 0x185000 | 0x4930 | 0x800 | b28ebea9ebe41ba142a74e93b46ebac9 | False | 0.98681640625 | data | 7.721777854568001 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | |
| .rsrc | 0x18a000 | 0x1638 | 0x1800 | fe6f3fdb9e7e97cba92d8ce4e4fcc95b | False | 0.7220052083333334 | data | 6.54017046361188 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| 0x18c000 | 0x9858 | 0x7200 | 55d409a165ae6286b51388ca331aeab8 | False | 0.9794750548245614 | data | 7.934264573672369 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | |
| .idata | 0x196000 | 0x1000 | 0x400 | 1b20e07443fa333ff9692026d1e6c6c2 | False | 0.3984375 | data | 3.42439969016873 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .tls | 0x197000 | 0x1000 | 0x200 | 54a50a058e0f3b6aa2fe1b22e2033106 | False | 0.056640625 | data | 0.18120187678200297 | IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .themida | 0x198000 | 0x3e8000 | 0x0 | d41d8cd98f00b204e9800998ecf8427e | unknown | unknown | unknown | unknown | IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .boot | 0x580000 | 0x267000 | 0x267000 | 0a00394383a54186173259ab3252cfac | unknown | unknown | unknown | unknown | IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .reloc | 0x7e7000 | 0x1000 | 0x10 | f5bc99b71bad9e8a775cc32747e3ca58 | False | 1.5 | GLS_BINARY_LSB_FIRST | 2.474601752714581 | IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| RT_ICON | 0x18a440 | 0x1060 | PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced | Russian | Russia | 0.8838263358778626 |
| RT_GROUP_ICON | 0x18b4a0 | 0x14 | data | Russian | Russia | 1.05 |
| RT_VERSION | 0x18a130 | 0x310 | data | Russian | Russia | 0.45408163265306123 |
| RT_MANIFEST | 0x18b4b8 | 0x17d | XML 1.0 document, ASCII text, with CRLF line terminators | English | United States | 0.5931758530183727 |
| DLL | Import |
|---|---|
| kernel32.dll | GetModuleHandleA |
| USER32.dll | wsprintfA |
| GDI32.dll | CreateCompatibleBitmap |
| ADVAPI32.dll | RegQueryValueExA |
| SHELL32.dll | ShellExecuteA |
| ole32.dll | CoInitialize |
| WS2_32.dll | WSAStartup |
| CRYPT32.dll | CryptUnprotectData |
| SHLWAPI.dll | PathFindExtensionA |
| gdiplus.dll | GdipGetImageEncoders |
| SETUPAPI.dll | SetupDiEnumDeviceInfo |
| ntdll.dll | RtlUnicodeStringToAnsiString |
| RstrtMgr.DLL | RmStartSession |
| Language of compilation system | Country where language is spoken | Map |
|---|---|---|
| Russian | Russia |  |
| English | United States |  |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | Protocol | SID | Message | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|---|---|---|
| 06/20/24-18:59:13.624078 | TCP | 2046269 | ET TROJAN [ANY.RUN] RisePro TCP (Activity) | 49741 | 58709 | 192.168.2.4 | 77.91.77.66 |
| 06/20/24-18:58:58.560662 | TCP | 2046269 | ET TROJAN [ANY.RUN] RisePro TCP (Activity) | 49732 | 58709 | 192.168.2.4 | 77.91.77.66 |
| 06/20/24-18:58:52.840391 | TCP | 2046269 | ET TROJAN [ANY.RUN] RisePro TCP (Activity) | 49731 | 58709 | 192.168.2.4 | 77.91.77.66 |
| 06/20/24-18:57:14.894991 | TCP | 2049060 | ET TROJAN RisePro TCP Heartbeat Packet | 49731 | 58709 | 192.168.2.4 | 77.91.77.66 |
| 06/20/24-18:59:07.355875 | TCP | 2046269 | ET TROJAN [ANY.RUN] RisePro TCP (Activity) | 49739 | 58709 | 192.168.2.4 | 77.91.77.66 |
| 06/20/24-18:57:18.828226 | TCP | 2046266 | ET TROJAN [ANY.RUN] RisePro TCP (Token) | 58709 | 49732 | 77.91.77.66 | 192.168.2.4 |
| 06/20/24-18:58:03.049093 | TCP | 2046267 | ET TROJAN [ANY.RUN] RisePro TCP (External IP) | 58709 | 49741 | 77.91.77.66 | 192.168.2.4 |
| 06/20/24-18:57:35.040865 | TCP | 2046266 | ET TROJAN [ANY.RUN] RisePro TCP (Token) | 58709 | 49741 | 77.91.77.66 | 192.168.2.4 |
| 06/20/24-18:57:15.478080 | TCP | 2046266 | ET TROJAN [ANY.RUN] RisePro TCP (Token) | 58709 | 49731 | 77.91.77.66 | 192.168.2.4 |
| 06/20/24-18:57:18.837910 | TCP | 2046266 | ET TROJAN [ANY.RUN] RisePro TCP (Token) | 58709 | 49733 | 77.91.77.66 | 192.168.2.4 |
| 06/20/24-18:58:58.606045 | TCP | 2046269 | ET TROJAN [ANY.RUN] RisePro TCP (Activity) | 49733 | 58709 | 192.168.2.4 | 77.91.77.66 |
| 06/20/24-18:57:40.684951 | TCP | 2046267 | ET TROJAN [ANY.RUN] RisePro TCP (External IP) | 58709 | 49739 | 77.91.77.66 | 192.168.2.4 |
| 06/20/24-18:57:26.019896 | TCP | 2046266 | ET TROJAN [ANY.RUN] RisePro TCP (Token) | 58709 | 49739 | 77.91.77.66 | 192.168.2.4 |
| 06/20/24-18:57:40.086663 | TCP | 2046267 | ET TROJAN [ANY.RUN] RisePro TCP (External IP) | 58709 | 49731 | 77.91.77.66 | 192.168.2.4 |
| 06/20/24-18:57:40.210568 | TCP | 2046267 | ET TROJAN [ANY.RUN] RisePro TCP (External IP) | 58709 | 49732 | 77.91.77.66 | 192.168.2.4 |
| 06/20/24-18:57:40.261626 | TCP | 2046267 | ET TROJAN [ANY.RUN] RisePro TCP (External IP) | 58709 | 49733 | 77.91.77.66 | 192.168.2.4 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Jun 20, 2024 18:57:14.867392063 CEST | 49731 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:57:14.872680902 CEST | 58709 | 49731 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:57:14.872773886 CEST | 49731 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:57:14.894990921 CEST | 49731 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:57:14.900186062 CEST | 58709 | 49731 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:57:15.478080034 CEST | 58709 | 49731 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:57:15.526962996 CEST | 49731 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:57:18.209875107 CEST | 49732 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:57:18.215310097 CEST | 58709 | 49732 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:57:18.215409994 CEST | 49732 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:57:18.219486952 CEST | 49733 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:57:18.224916935 CEST | 58709 | 49733 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:57:18.225008965 CEST | 49733 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:57:18.238785982 CEST | 49732 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:57:18.239044905 CEST | 49733 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:57:18.244168043 CEST | 58709 | 49732 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:57:18.244507074 CEST | 58709 | 49733 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:57:18.605303049 CEST | 49731 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:57:18.610707045 CEST | 58709 | 49731 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:57:18.828226089 CEST | 58709 | 49732 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:57:18.837909937 CEST | 58709 | 49733 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:57:18.870759964 CEST | 49732 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:57:18.886356115 CEST | 49733 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:57:21.949140072 CEST | 49732 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:57:21.949143887 CEST | 49733 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:57:21.954988956 CEST | 58709 | 49732 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:57:21.955049992 CEST | 58709 | 49733 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:57:25.393862963 CEST | 49739 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:57:25.398869991 CEST | 58709 | 49739 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:57:25.398960114 CEST | 49739 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:57:25.410298109 CEST | 49739 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:57:25.415654898 CEST | 58709 | 49739 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:57:26.019896030 CEST | 58709 | 49739 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:57:26.073909998 CEST | 49739 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:57:29.136550903 CEST | 49739 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:57:29.141423941 CEST | 58709 | 49739 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:57:34.425412893 CEST | 49741 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:57:34.430507898 CEST | 58709 | 49741 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:57:34.430629015 CEST | 49741 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:57:34.440203905 CEST | 49741 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:57:34.445101023 CEST | 58709 | 49741 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:57:35.040864944 CEST | 58709 | 49741 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:57:35.089631081 CEST | 49741 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:57:38.168387890 CEST | 49741 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:57:38.173934937 CEST | 58709 | 49741 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:57:40.086663008 CEST | 58709 | 49731 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:57:40.136542082 CEST | 49731 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:57:40.189471960 CEST | 49742 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 20, 2024 18:57:40.189557076 CEST | 443 | 49742 | 34.117.186.192 | 192.168.2.4 |
| Jun 20, 2024 18:57:40.189647913 CEST | 49742 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 20, 2024 18:57:40.190637112 CEST | 49742 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 20, 2024 18:57:40.190690041 CEST | 443 | 49742 | 34.117.186.192 | 192.168.2.4 |
| Jun 20, 2024 18:57:40.210567951 CEST | 58709 | 49732 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:57:40.261501074 CEST | 49732 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:57:40.261626005 CEST | 58709 | 49733 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:57:40.269562006 CEST | 49743 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 20, 2024 18:57:40.269599915 CEST | 443 | 49743 | 34.117.186.192 | 192.168.2.4 |
| Jun 20, 2024 18:57:40.269674063 CEST | 49743 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 20, 2024 18:57:40.270838976 CEST | 49743 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 20, 2024 18:57:40.270886898 CEST | 443 | 49743 | 34.117.186.192 | 192.168.2.4 |
| Jun 20, 2024 18:57:40.290296078 CEST | 49744 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 20, 2024 18:57:40.290406942 CEST | 443 | 49744 | 34.117.186.192 | 192.168.2.4 |
| Jun 20, 2024 18:57:40.290482998 CEST | 49744 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 20, 2024 18:57:40.291460991 CEST | 49744 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 20, 2024 18:57:40.291516066 CEST | 443 | 49744 | 34.117.186.192 | 192.168.2.4 |
| Jun 20, 2024 18:57:40.308362961 CEST | 49733 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:57:40.684951067 CEST | 58709 | 49739 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:57:40.706904888 CEST | 443 | 49742 | 34.117.186.192 | 192.168.2.4 |
| Jun 20, 2024 18:57:40.707005024 CEST | 49742 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 20, 2024 18:57:40.711128950 CEST | 49742 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 20, 2024 18:57:40.711186886 CEST | 443 | 49742 | 34.117.186.192 | 192.168.2.4 |
| Jun 20, 2024 18:57:40.711622000 CEST | 443 | 49742 | 34.117.186.192 | 192.168.2.4 |
| Jun 20, 2024 18:57:40.727715969 CEST | 49745 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 20, 2024 18:57:40.727813005 CEST | 443 | 49745 | 34.117.186.192 | 192.168.2.4 |
| Jun 20, 2024 18:57:40.727895975 CEST | 49745 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 20, 2024 18:57:40.728888035 CEST | 49745 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 20, 2024 18:57:40.728923082 CEST | 443 | 49745 | 34.117.186.192 | 192.168.2.4 |
| Jun 20, 2024 18:57:40.730259895 CEST | 49739 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:57:40.755664110 CEST | 49742 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 20, 2024 18:57:40.790704012 CEST | 443 | 49744 | 34.117.186.192 | 192.168.2.4 |
| Jun 20, 2024 18:57:40.790915966 CEST | 49744 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 20, 2024 18:57:40.791215897 CEST | 443 | 49743 | 34.117.186.192 | 192.168.2.4 |
| Jun 20, 2024 18:57:40.791320086 CEST | 49743 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 20, 2024 18:57:40.792150021 CEST | 49744 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 20, 2024 18:57:40.792197943 CEST | 443 | 49744 | 34.117.186.192 | 192.168.2.4 |
| Jun 20, 2024 18:57:40.792450905 CEST | 49743 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 20, 2024 18:57:40.792462111 CEST | 443 | 49743 | 34.117.186.192 | 192.168.2.4 |
| Jun 20, 2024 18:57:40.792578936 CEST | 443 | 49744 | 34.117.186.192 | 192.168.2.4 |
| Jun 20, 2024 18:57:40.792800903 CEST | 443 | 49743 | 34.117.186.192 | 192.168.2.4 |
| Jun 20, 2024 18:57:40.796545982 CEST | 443 | 49742 | 34.117.186.192 | 192.168.2.4 |
| Jun 20, 2024 18:57:40.839626074 CEST | 49744 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 20, 2024 18:57:40.842360973 CEST | 49743 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 20, 2024 18:57:40.860759020 CEST | 49744 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 20, 2024 18:57:40.869853973 CEST | 49743 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 20, 2024 18:57:40.883080959 CEST | 443 | 49742 | 34.117.186.192 | 192.168.2.4 |
| Jun 20, 2024 18:57:40.883428097 CEST | 443 | 49742 | 34.117.186.192 | 192.168.2.4 |
| Jun 20, 2024 18:57:40.883512020 CEST | 49742 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 20, 2024 18:57:40.886112928 CEST | 49742 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 20, 2024 18:57:40.886162043 CEST | 443 | 49742 | 34.117.186.192 | 192.168.2.4 |
| Jun 20, 2024 18:57:40.886192083 CEST | 49742 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 20, 2024 18:57:40.886209965 CEST | 443 | 49742 | 34.117.186.192 | 192.168.2.4 |
| Jun 20, 2024 18:57:40.896604061 CEST | 49746 | 443 | 192.168.2.4 | 172.67.75.166 |
| Jun 20, 2024 18:57:40.896667957 CEST | 443 | 49746 | 172.67.75.166 | 192.168.2.4 |
| Jun 20, 2024 18:57:40.896748066 CEST | 49746 | 443 | 192.168.2.4 | 172.67.75.166 |
| Jun 20, 2024 18:57:40.897015095 CEST | 49746 | 443 | 192.168.2.4 | 172.67.75.166 |
| Jun 20, 2024 18:57:40.897043943 CEST | 443 | 49746 | 172.67.75.166 | 192.168.2.4 |
| Jun 20, 2024 18:57:40.904494047 CEST | 443 | 49744 | 34.117.186.192 | 192.168.2.4 |
| Jun 20, 2024 18:57:40.912532091 CEST | 443 | 49743 | 34.117.186.192 | 192.168.2.4 |
| Jun 20, 2024 18:57:41.000684023 CEST | 443 | 49744 | 34.117.186.192 | 192.168.2.4 |
| Jun 20, 2024 18:57:41.000818014 CEST | 443 | 49744 | 34.117.186.192 | 192.168.2.4 |
| Jun 20, 2024 18:57:41.001025915 CEST | 49744 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 20, 2024 18:57:41.001121044 CEST | 49744 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 20, 2024 18:57:41.001121044 CEST | 49744 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 20, 2024 18:57:41.001166105 CEST | 443 | 49744 | 34.117.186.192 | 192.168.2.4 |
| Jun 20, 2024 18:57:41.001205921 CEST | 443 | 49744 | 34.117.186.192 | 192.168.2.4 |
| Jun 20, 2024 18:57:41.002507925 CEST | 49747 | 443 | 192.168.2.4 | 172.67.75.166 |
| Jun 20, 2024 18:57:41.002594948 CEST | 443 | 49747 | 172.67.75.166 | 192.168.2.4 |
| Jun 20, 2024 18:57:41.002676010 CEST | 49747 | 443 | 192.168.2.4 | 172.67.75.166 |
| Jun 20, 2024 18:57:41.003042936 CEST | 49747 | 443 | 192.168.2.4 | 172.67.75.166 |
| Jun 20, 2024 18:57:41.003132105 CEST | 443 | 49747 | 172.67.75.166 | 192.168.2.4 |
| Jun 20, 2024 18:57:41.009438038 CEST | 443 | 49743 | 34.117.186.192 | 192.168.2.4 |
| Jun 20, 2024 18:57:41.009916067 CEST | 443 | 49743 | 34.117.186.192 | 192.168.2.4 |
| Jun 20, 2024 18:57:41.009967089 CEST | 49743 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 20, 2024 18:57:41.010067940 CEST | 49743 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 20, 2024 18:57:41.010082960 CEST | 443 | 49743 | 34.117.186.192 | 192.168.2.4 |
| Jun 20, 2024 18:57:41.010093927 CEST | 49743 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 20, 2024 18:57:41.010099888 CEST | 443 | 49743 | 34.117.186.192 | 192.168.2.4 |
| Jun 20, 2024 18:57:41.011152983 CEST | 49748 | 443 | 192.168.2.4 | 172.67.75.166 |
| Jun 20, 2024 18:57:41.011173010 CEST | 443 | 49748 | 172.67.75.166 | 192.168.2.4 |
| Jun 20, 2024 18:57:41.011234999 CEST | 49748 | 443 | 192.168.2.4 | 172.67.75.166 |
| Jun 20, 2024 18:57:41.011461020 CEST | 49748 | 443 | 192.168.2.4 | 172.67.75.166 |
| Jun 20, 2024 18:57:41.011472940 CEST | 443 | 49748 | 172.67.75.166 | 192.168.2.4 |
| Jun 20, 2024 18:57:41.334681034 CEST | 443 | 49745 | 34.117.186.192 | 192.168.2.4 |
| Jun 20, 2024 18:57:41.334783077 CEST | 49745 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 20, 2024 18:57:41.335994005 CEST | 49745 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 20, 2024 18:57:41.336009979 CEST | 443 | 49745 | 34.117.186.192 | 192.168.2.4 |
| Jun 20, 2024 18:57:41.336256027 CEST | 443 | 49745 | 34.117.186.192 | 192.168.2.4 |
| Jun 20, 2024 18:57:41.384072065 CEST | 49745 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 20, 2024 18:57:41.424527884 CEST | 443 | 49745 | 34.117.186.192 | 192.168.2.4 |
| Jun 20, 2024 18:57:41.508068085 CEST | 443 | 49745 | 34.117.186.192 | 192.168.2.4 |
| Jun 20, 2024 18:57:41.508239985 CEST | 443 | 49745 | 34.117.186.192 | 192.168.2.4 |
| Jun 20, 2024 18:57:41.508344889 CEST | 49745 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 20, 2024 18:57:41.508753061 CEST | 49745 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 20, 2024 18:57:41.508790016 CEST | 443 | 49745 | 34.117.186.192 | 192.168.2.4 |
| Jun 20, 2024 18:57:41.508824110 CEST | 49745 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 20, 2024 18:57:41.508838892 CEST | 443 | 49745 | 34.117.186.192 | 192.168.2.4 |
| Jun 20, 2024 18:57:41.510406971 CEST | 49749 | 443 | 192.168.2.4 | 172.67.75.166 |
| Jun 20, 2024 18:57:41.510494947 CEST | 443 | 49749 | 172.67.75.166 | 192.168.2.4 |
| Jun 20, 2024 18:57:41.510646105 CEST | 49749 | 443 | 192.168.2.4 | 172.67.75.166 |
| Jun 20, 2024 18:57:41.510972023 CEST | 49749 | 443 | 192.168.2.4 | 172.67.75.166 |
| Jun 20, 2024 18:57:41.511009932 CEST | 443 | 49749 | 172.67.75.166 | 192.168.2.4 |
| Jun 20, 2024 18:57:41.516624928 CEST | 443 | 49747 | 172.67.75.166 | 192.168.2.4 |
| Jun 20, 2024 18:57:41.516690969 CEST | 49747 | 443 | 192.168.2.4 | 172.67.75.166 |
| Jun 20, 2024 18:57:41.518430948 CEST | 49747 | 443 | 192.168.2.4 | 172.67.75.166 |
| Jun 20, 2024 18:57:41.518444061 CEST | 443 | 49747 | 172.67.75.166 | 192.168.2.4 |
| Jun 20, 2024 18:57:41.518704891 CEST | 443 | 49747 | 172.67.75.166 | 192.168.2.4 |
| Jun 20, 2024 18:57:41.520112991 CEST | 49747 | 443 | 192.168.2.4 | 172.67.75.166 |
| Jun 20, 2024 18:57:41.525110006 CEST | 443 | 49746 | 172.67.75.166 | 192.168.2.4 |
| Jun 20, 2024 18:57:41.525235891 CEST | 49746 | 443 | 192.168.2.4 | 172.67.75.166 |
| Jun 20, 2024 18:57:41.526875973 CEST | 49746 | 443 | 192.168.2.4 | 172.67.75.166 |
| Jun 20, 2024 18:57:41.526887894 CEST | 443 | 49746 | 172.67.75.166 | 192.168.2.4 |
| Jun 20, 2024 18:57:41.527396917 CEST | 443 | 49746 | 172.67.75.166 | 192.168.2.4 |
| Jun 20, 2024 18:57:41.528537035 CEST | 49746 | 443 | 192.168.2.4 | 172.67.75.166 |
| Jun 20, 2024 18:57:41.533680916 CEST | 443 | 49748 | 172.67.75.166 | 192.168.2.4 |
| Jun 20, 2024 18:57:41.533914089 CEST | 49748 | 443 | 192.168.2.4 | 172.67.75.166 |
| Jun 20, 2024 18:57:41.534756899 CEST | 49748 | 443 | 192.168.2.4 | 172.67.75.166 |
| Jun 20, 2024 18:57:41.534763098 CEST | 443 | 49748 | 172.67.75.166 | 192.168.2.4 |
| Jun 20, 2024 18:57:41.535790920 CEST | 443 | 49748 | 172.67.75.166 | 192.168.2.4 |
| Jun 20, 2024 18:57:41.536973000 CEST | 49748 | 443 | 192.168.2.4 | 172.67.75.166 |
| Jun 20, 2024 18:57:41.560578108 CEST | 443 | 49747 | 172.67.75.166 | 192.168.2.4 |
| Jun 20, 2024 18:57:41.572501898 CEST | 443 | 49746 | 172.67.75.166 | 192.168.2.4 |
| Jun 20, 2024 18:57:41.580496073 CEST | 443 | 49748 | 172.67.75.166 | 192.168.2.4 |
| Jun 20, 2024 18:57:41.670669079 CEST | 443 | 49747 | 172.67.75.166 | 192.168.2.4 |
| Jun 20, 2024 18:57:41.670747042 CEST | 443 | 49747 | 172.67.75.166 | 192.168.2.4 |
| Jun 20, 2024 18:57:41.670828104 CEST | 49747 | 443 | 192.168.2.4 | 172.67.75.166 |
| Jun 20, 2024 18:57:41.671272993 CEST | 49747 | 443 | 192.168.2.4 | 172.67.75.166 |
| Jun 20, 2024 18:57:41.671322107 CEST | 443 | 49747 | 172.67.75.166 | 192.168.2.4 |
| Jun 20, 2024 18:57:41.671353102 CEST | 49747 | 443 | 192.168.2.4 | 172.67.75.166 |
| Jun 20, 2024 18:57:41.671370029 CEST | 443 | 49747 | 172.67.75.166 | 192.168.2.4 |
| Jun 20, 2024 18:57:41.671797037 CEST | 49733 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:57:41.677098989 CEST | 58709 | 49733 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:57:41.707526922 CEST | 443 | 49746 | 172.67.75.166 | 192.168.2.4 |
| Jun 20, 2024 18:57:41.707797050 CEST | 443 | 49746 | 172.67.75.166 | 192.168.2.4 |
| Jun 20, 2024 18:57:41.707895994 CEST | 49746 | 443 | 192.168.2.4 | 172.67.75.166 |
| Jun 20, 2024 18:57:41.708054066 CEST | 49746 | 443 | 192.168.2.4 | 172.67.75.166 |
| Jun 20, 2024 18:57:41.708096981 CEST | 443 | 49746 | 172.67.75.166 | 192.168.2.4 |
| Jun 20, 2024 18:57:41.708134890 CEST | 49746 | 443 | 192.168.2.4 | 172.67.75.166 |
| Jun 20, 2024 18:57:41.708153009 CEST | 443 | 49746 | 172.67.75.166 | 192.168.2.4 |
| Jun 20, 2024 18:57:41.708522081 CEST | 49731 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:57:41.709861994 CEST | 443 | 49748 | 172.67.75.166 | 192.168.2.4 |
| Jun 20, 2024 18:57:41.710084915 CEST | 443 | 49748 | 172.67.75.166 | 192.168.2.4 |
| Jun 20, 2024 18:57:41.710143089 CEST | 49748 | 443 | 192.168.2.4 | 172.67.75.166 |
| Jun 20, 2024 18:57:41.710211039 CEST | 49748 | 443 | 192.168.2.4 | 172.67.75.166 |
| Jun 20, 2024 18:57:41.710232019 CEST | 443 | 49748 | 172.67.75.166 | 192.168.2.4 |
| Jun 20, 2024 18:57:41.710256100 CEST | 49748 | 443 | 192.168.2.4 | 172.67.75.166 |
| Jun 20, 2024 18:57:41.710268021 CEST | 443 | 49748 | 172.67.75.166 | 192.168.2.4 |
| Jun 20, 2024 18:57:41.711057901 CEST | 49732 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:57:41.713349104 CEST | 58709 | 49731 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:57:41.716022968 CEST | 58709 | 49732 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:57:41.985795021 CEST | 443 | 49749 | 172.67.75.166 | 192.168.2.4 |
| Jun 20, 2024 18:57:41.985903025 CEST | 49749 | 443 | 192.168.2.4 | 172.67.75.166 |
| Jun 20, 2024 18:57:41.987131119 CEST | 49749 | 443 | 192.168.2.4 | 172.67.75.166 |
| Jun 20, 2024 18:57:41.987164021 CEST | 443 | 49749 | 172.67.75.166 | 192.168.2.4 |
| Jun 20, 2024 18:57:41.987513065 CEST | 443 | 49749 | 172.67.75.166 | 192.168.2.4 |
| Jun 20, 2024 18:57:41.991270065 CEST | 49749 | 443 | 192.168.2.4 | 172.67.75.166 |
| Jun 20, 2024 18:57:42.036530018 CEST | 443 | 49749 | 172.67.75.166 | 192.168.2.4 |
| Jun 20, 2024 18:57:42.152816057 CEST | 443 | 49749 | 172.67.75.166 | 192.168.2.4 |
| Jun 20, 2024 18:57:42.153099060 CEST | 443 | 49749 | 172.67.75.166 | 192.168.2.4 |
| Jun 20, 2024 18:57:42.153202057 CEST | 49749 | 443 | 192.168.2.4 | 172.67.75.166 |
| Jun 20, 2024 18:57:42.153469086 CEST | 49749 | 443 | 192.168.2.4 | 172.67.75.166 |
| Jun 20, 2024 18:57:42.153507948 CEST | 443 | 49749 | 172.67.75.166 | 192.168.2.4 |
| Jun 20, 2024 18:57:42.153534889 CEST | 49749 | 443 | 192.168.2.4 | 172.67.75.166 |
| Jun 20, 2024 18:57:42.153549910 CEST | 443 | 49749 | 172.67.75.166 | 192.168.2.4 |
| Jun 20, 2024 18:57:42.153923035 CEST | 49739 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:57:42.159673929 CEST | 58709 | 49739 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:57:49.464940071 CEST | 49731 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:57:49.470344067 CEST | 58709 | 49731 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:57:52.715127945 CEST | 49732 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:57:52.720165014 CEST | 58709 | 49732 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:57:52.808721066 CEST | 49733 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:57:52.814178944 CEST | 58709 | 49733 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:57:59.480479002 CEST | 49739 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:57:59.485503912 CEST | 58709 | 49739 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:58:02.366193056 CEST | 58709 | 49731 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:58:02.417916059 CEST | 49731 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:58:02.451795101 CEST | 58709 | 49732 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:58:02.465960026 CEST | 58709 | 49733 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:58:02.496141911 CEST | 49732 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:58:02.511650085 CEST | 49733 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:58:02.721391916 CEST | 58709 | 49739 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:58:02.761667967 CEST | 49739 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:58:03.049093008 CEST | 58709 | 49741 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:58:03.105618000 CEST | 49741 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:58:03.190819979 CEST | 49751 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 20, 2024 18:58:03.190865040 CEST | 443 | 49751 | 34.117.186.192 | 192.168.2.4 |
| Jun 20, 2024 18:58:03.190953970 CEST | 49751 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 20, 2024 18:58:03.191906929 CEST | 49751 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 20, 2024 18:58:03.191932917 CEST | 443 | 49751 | 34.117.186.192 | 192.168.2.4 |
| Jun 20, 2024 18:58:03.659512997 CEST | 443 | 49751 | 34.117.186.192 | 192.168.2.4 |
| Jun 20, 2024 18:58:03.659627914 CEST | 49751 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 20, 2024 18:58:03.660859108 CEST | 49751 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 20, 2024 18:58:03.660887957 CEST | 443 | 49751 | 34.117.186.192 | 192.168.2.4 |
| Jun 20, 2024 18:58:03.661843061 CEST | 443 | 49751 | 34.117.186.192 | 192.168.2.4 |
| Jun 20, 2024 18:58:03.701503992 CEST | 49751 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 20, 2024 18:58:03.748549938 CEST | 443 | 49751 | 34.117.186.192 | 192.168.2.4 |
| Jun 20, 2024 18:58:03.828887939 CEST | 443 | 49751 | 34.117.186.192 | 192.168.2.4 |
| Jun 20, 2024 18:58:03.829221010 CEST | 443 | 49751 | 34.117.186.192 | 192.168.2.4 |
| Jun 20, 2024 18:58:03.829324007 CEST | 49751 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 20, 2024 18:58:03.829612017 CEST | 49751 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 20, 2024 18:58:03.829665899 CEST | 443 | 49751 | 34.117.186.192 | 192.168.2.4 |
| Jun 20, 2024 18:58:03.829696894 CEST | 49751 | 443 | 192.168.2.4 | 34.117.186.192 |
| Jun 20, 2024 18:58:03.829714060 CEST | 443 | 49751 | 34.117.186.192 | 192.168.2.4 |
| Jun 20, 2024 18:58:03.832252026 CEST | 49752 | 443 | 192.168.2.4 | 172.67.75.166 |
| Jun 20, 2024 18:58:03.832298994 CEST | 443 | 49752 | 172.67.75.166 | 192.168.2.4 |
| Jun 20, 2024 18:58:03.832386017 CEST | 49752 | 443 | 192.168.2.4 | 172.67.75.166 |
| Jun 20, 2024 18:58:03.832801104 CEST | 49752 | 443 | 192.168.2.4 | 172.67.75.166 |
| Jun 20, 2024 18:58:03.832832098 CEST | 443 | 49752 | 172.67.75.166 | 192.168.2.4 |
| Jun 20, 2024 18:58:04.384896994 CEST | 443 | 49752 | 172.67.75.166 | 192.168.2.4 |
| Jun 20, 2024 18:58:04.385020018 CEST | 49752 | 443 | 192.168.2.4 | 172.67.75.166 |
| Jun 20, 2024 18:58:04.386295080 CEST | 49752 | 443 | 192.168.2.4 | 172.67.75.166 |
| Jun 20, 2024 18:58:04.386311054 CEST | 443 | 49752 | 172.67.75.166 | 192.168.2.4 |
| Jun 20, 2024 18:58:04.387135983 CEST | 443 | 49752 | 172.67.75.166 | 192.168.2.4 |
| Jun 20, 2024 18:58:04.388725996 CEST | 49752 | 443 | 192.168.2.4 | 172.67.75.166 |
| Jun 20, 2024 18:58:04.436502934 CEST | 443 | 49752 | 172.67.75.166 | 192.168.2.4 |
| Jun 20, 2024 18:58:04.556865931 CEST | 443 | 49752 | 172.67.75.166 | 192.168.2.4 |
| Jun 20, 2024 18:58:04.557096958 CEST | 443 | 49752 | 172.67.75.166 | 192.168.2.4 |
| Jun 20, 2024 18:58:04.557162046 CEST | 49752 | 443 | 192.168.2.4 | 172.67.75.166 |
| Jun 20, 2024 18:58:04.557215929 CEST | 49752 | 443 | 192.168.2.4 | 172.67.75.166 |
| Jun 20, 2024 18:58:04.557245016 CEST | 443 | 49752 | 172.67.75.166 | 192.168.2.4 |
| Jun 20, 2024 18:58:04.557271004 CEST | 49752 | 443 | 192.168.2.4 | 172.67.75.166 |
| Jun 20, 2024 18:58:04.557285070 CEST | 443 | 49752 | 172.67.75.166 | 192.168.2.4 |
| Jun 20, 2024 18:58:04.557780981 CEST | 49741 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:58:04.562638998 CEST | 58709 | 49741 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:58:09.293189049 CEST | 49741 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:58:09.298407078 CEST | 58709 | 49741 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:58:18.632580042 CEST | 58709 | 49731 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:58:18.683968067 CEST | 49731 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:58:18.699707985 CEST | 49731 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:58:18.704699993 CEST | 58709 | 49731 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:58:18.746516943 CEST | 58709 | 49732 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:58:18.793112040 CEST | 49732 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:58:18.808842897 CEST | 49732 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:58:18.813803911 CEST | 58709 | 49732 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:58:18.814426899 CEST | 58709 | 49733 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:58:18.840141058 CEST | 49733 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:58:18.845093012 CEST | 58709 | 49733 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:58:19.420250893 CEST | 58709 | 49739 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:58:19.449507952 CEST | 49739 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:58:19.454644918 CEST | 58709 | 49739 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:58:19.634773016 CEST | 58709 | 49741 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:58:19.683732986 CEST | 49741 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:58:21.761961937 CEST | 49731 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:58:21.769064903 CEST | 58709 | 49731 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:58:25.012032032 CEST | 49732 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:58:25.017864943 CEST | 58709 | 49732 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:58:25.058866024 CEST | 49733 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:58:25.064270020 CEST | 58709 | 49733 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:58:31.965137959 CEST | 49739 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:58:31.970119953 CEST | 58709 | 49739 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:58:35.120271921 CEST | 58709 | 49731 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:58:35.168335915 CEST | 49731 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:58:36.594540119 CEST | 58709 | 49732 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:58:36.608009100 CEST | 58709 | 49733 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:58:36.637063026 CEST | 49732 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:58:36.652693033 CEST | 49733 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:58:38.152647018 CEST | 58709 | 49739 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:58:38.202181101 CEST | 49739 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:58:38.512538910 CEST | 58709 | 49741 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:58:38.543402910 CEST | 49741 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:58:38.548664093 CEST | 58709 | 49741 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:58:41.654438019 CEST | 49741 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:58:41.659532070 CEST | 58709 | 49741 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:58:46.579662085 CEST | 58709 | 49731 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:58:46.615417004 CEST | 58709 | 49732 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:58:46.621339083 CEST | 49731 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:58:46.625395060 CEST | 58709 | 49733 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:58:46.668185949 CEST | 49733 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:58:46.668193102 CEST | 49732 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:58:46.684319973 CEST | 49732 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:58:46.684467077 CEST | 49731 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:58:46.684617996 CEST | 49733 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:58:46.689163923 CEST | 58709 | 49732 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:58:46.689290047 CEST | 58709 | 49731 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:58:46.689438105 CEST | 58709 | 49733 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:58:46.800071955 CEST | 58709 | 49739 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:58:46.855700016 CEST | 49739 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:58:46.856758118 CEST | 49739 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:58:46.862021923 CEST | 58709 | 49739 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:58:48.391851902 CEST | 58709 | 49741 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:58:48.433866978 CEST | 49741 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:58:52.840390921 CEST | 49731 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:58:52.847284079 CEST | 58709 | 49731 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:58:55.355422974 CEST | 58709 | 49731 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:58:55.402640104 CEST | 49731 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:58:55.439012051 CEST | 58709 | 49732 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:58:55.464445114 CEST | 58709 | 49733 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:58:55.480784893 CEST | 49732 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:58:55.513658047 CEST | 49733 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:58:55.705344915 CEST | 58709 | 49739 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:58:55.748805046 CEST | 49739 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:58:55.837332010 CEST | 58709 | 49741 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:58:55.887082100 CEST | 49741 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:58:55.934210062 CEST | 49741 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:58:55.939651012 CEST | 58709 | 49741 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:58:58.560662031 CEST | 49732 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:58:58.566133976 CEST | 58709 | 49732 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:58:58.606045008 CEST | 49733 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:58:58.611638069 CEST | 58709 | 49733 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:03.855362892 CEST | 58709 | 49731 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:03.855537891 CEST | 58709 | 49731 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:03.855609894 CEST | 49731 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:03.855878115 CEST | 58709 | 49731 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:03.855892897 CEST | 58709 | 49731 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:03.855909109 CEST | 58709 | 49731 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:03.855936050 CEST | 58709 | 49731 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:03.855950117 CEST | 49731 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:03.855951071 CEST | 58709 | 49731 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:03.855989933 CEST | 49731 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:03.856003046 CEST | 58709 | 49731 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:03.856019020 CEST | 58709 | 49731 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:03.856050968 CEST | 49731 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:03.856446981 CEST | 58709 | 49731 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:03.856463909 CEST | 58709 | 49731 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:03.856478930 CEST | 58709 | 49731 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:03.856616974 CEST | 49731 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:03.856981993 CEST | 58709 | 49731 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:03.856995106 CEST | 58709 | 49731 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:03.857064009 CEST | 49731 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:03.857400894 CEST | 58709 | 49731 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:03.857465982 CEST | 58709 | 49731 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:03.857481003 CEST | 58709 | 49731 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:03.857518911 CEST | 49731 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:03.890222073 CEST | 58709 | 49732 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:03.890256882 CEST | 58709 | 49732 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:03.890310049 CEST | 58709 | 49732 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:03.890326977 CEST | 58709 | 49732 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:03.890341997 CEST | 58709 | 49732 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:03.890355110 CEST | 49732 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:03.890439987 CEST | 49732 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:03.890707970 CEST | 58709 | 49732 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:03.890753031 CEST | 49732 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:03.891439915 CEST | 58709 | 49732 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:03.891453981 CEST | 58709 | 49732 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:03.891468048 CEST | 58709 | 49732 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:03.891484022 CEST | 58709 | 49732 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:03.891495943 CEST | 49732 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:03.891498089 CEST | 58709 | 49732 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:03.891515017 CEST | 58709 | 49732 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:03.891529083 CEST | 49732 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:03.891557932 CEST | 49732 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:03.891727924 CEST | 58709 | 49732 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:03.891753912 CEST | 58709 | 49732 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:03.891768932 CEST | 58709 | 49732 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:03.891793966 CEST | 49732 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:03.902725935 CEST | 49731 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:03.902962923 CEST | 58709 | 49733 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:03.903286934 CEST | 58709 | 49733 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:03.903357983 CEST | 49733 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:03.903570890 CEST | 58709 | 49733 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:03.903584957 CEST | 58709 | 49733 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:03.903636932 CEST | 49733 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:03.903678894 CEST | 58709 | 49733 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:03.903692961 CEST | 58709 | 49733 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:03.903740883 CEST | 49733 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:03.904050112 CEST | 58709 | 49733 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:03.904494047 CEST | 58709 | 49733 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:03.904544115 CEST | 49733 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:03.904566050 CEST | 58709 | 49733 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:03.904578924 CEST | 58709 | 49733 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:03.904620886 CEST | 49733 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:03.904733896 CEST | 58709 | 49733 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:03.904901028 CEST | 58709 | 49733 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:03.904913902 CEST | 58709 | 49733 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:03.904938936 CEST | 58709 | 49733 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:03.904952049 CEST | 49733 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:03.904953957 CEST | 58709 | 49733 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:03.904972076 CEST | 58709 | 49733 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:03.904997110 CEST | 49733 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:03.905028105 CEST | 49733 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:03.905575037 CEST | 58709 | 49733 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:03.908236980 CEST | 58709 | 49733 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:03.908297062 CEST | 49733 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:03.933921099 CEST | 49732 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:03.982393026 CEST | 58709 | 49731 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:03.982443094 CEST | 58709 | 49731 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:03.982479095 CEST | 58709 | 49731 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:03.982513905 CEST | 49731 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:03.982515097 CEST | 58709 | 49731 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:03.982577085 CEST | 49731 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:04.012788057 CEST | 58709 | 49732 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:04.012854099 CEST | 58709 | 49732 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:04.012885094 CEST | 58709 | 49732 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:04.012924910 CEST | 49732 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:04.012958050 CEST | 58709 | 49732 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:04.012991905 CEST | 58709 | 49732 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:04.013025999 CEST | 49732 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:04.013029099 CEST | 58709 | 49732 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:04.013098001 CEST | 49732 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:04.021223068 CEST | 58709 | 49733 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:04.021384001 CEST | 58709 | 49733 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:04.021418095 CEST | 58709 | 49733 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:04.021451950 CEST | 58709 | 49733 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:04.021461010 CEST | 49733 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:04.021488905 CEST | 58709 | 49733 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:04.021500111 CEST | 49733 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:04.027765989 CEST | 49733 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:04.027870893 CEST | 49732 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:04.032684088 CEST | 58709 | 49733 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:04.032716990 CEST | 58709 | 49732 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:04.070729017 CEST | 58709 | 49739 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:04.070976973 CEST | 58709 | 49739 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:04.071012974 CEST | 58709 | 49739 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:04.071059942 CEST | 49739 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:04.071085930 CEST | 58709 | 49739 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:04.071141005 CEST | 49739 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:04.071779966 CEST | 58709 | 49739 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:04.071832895 CEST | 58709 | 49739 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:04.071888924 CEST | 49739 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:04.073100090 CEST | 58709 | 49739 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:04.073129892 CEST | 58709 | 49739 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:04.073189020 CEST | 49739 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:04.073784113 CEST | 58709 | 49739 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:04.073813915 CEST | 58709 | 49739 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:04.073868990 CEST | 49739 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:04.073923111 CEST | 58709 | 49739 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:04.073993921 CEST | 58709 | 49739 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:04.074023962 CEST | 58709 | 49731 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:04.074044943 CEST | 49739 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:04.074179888 CEST | 58709 | 49739 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:04.074297905 CEST | 58709 | 49739 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:04.074331045 CEST | 58709 | 49739 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:04.074354887 CEST | 49739 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:04.074811935 CEST | 58709 | 49739 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:04.074863911 CEST | 49739 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:04.075196981 CEST | 58709 | 49739 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:04.076070070 CEST | 58709 | 49739 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:04.076132059 CEST | 49739 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:04.076296091 CEST | 58709 | 49739 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:04.121471882 CEST | 49731 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:04.121541977 CEST | 49739 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:04.137613058 CEST | 49731 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:04.142573118 CEST | 58709 | 49731 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:04.157079935 CEST | 58709 | 49741 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:04.187741995 CEST | 58709 | 49739 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:04.188908100 CEST | 58709 | 49739 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:04.188963890 CEST | 49739 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:04.188966036 CEST | 58709 | 49739 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:04.189017057 CEST | 58709 | 49739 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:04.189065933 CEST | 58709 | 49739 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:04.189066887 CEST | 49739 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:04.189116001 CEST | 58709 | 49739 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:04.189173937 CEST | 49739 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:04.199547052 CEST | 49741 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:04.247224092 CEST | 49739 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:04.252103090 CEST | 58709 | 49739 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:07.355875015 CEST | 49739 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:07.362529039 CEST | 58709 | 49739 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:10.077682018 CEST | 58709 | 49731 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:10.108182907 CEST | 58709 | 49732 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:10.121596098 CEST | 49731 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:10.138931036 CEST | 58709 | 49733 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:10.152730942 CEST | 49732 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:10.184130907 CEST | 49733 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:10.267925024 CEST | 58709 | 49739 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:10.277990103 CEST | 49739 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:10.282882929 CEST | 58709 | 49739 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:10.357955933 CEST | 58709 | 49741 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:10.358006954 CEST | 58709 | 49741 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:10.358066082 CEST | 49741 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:10.358159065 CEST | 58709 | 49741 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:10.358189106 CEST | 58709 | 49741 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:10.358246088 CEST | 49741 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:10.358541012 CEST | 58709 | 49741 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:10.358577013 CEST | 58709 | 49741 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:10.358612061 CEST | 58709 | 49741 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:10.358663082 CEST | 49741 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:10.358700037 CEST | 58709 | 49741 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:10.358757973 CEST | 49741 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:10.358772039 CEST | 58709 | 49741 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:10.359008074 CEST | 58709 | 49741 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:10.359038115 CEST | 58709 | 49741 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:10.359069109 CEST | 49741 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:10.359175920 CEST | 58709 | 49741 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:10.359204054 CEST | 58709 | 49741 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:10.359231949 CEST | 49741 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:10.359621048 CEST | 58709 | 49741 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:10.359648943 CEST | 58709 | 49741 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:10.359690905 CEST | 49741 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:10.359745026 CEST | 58709 | 49741 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:10.359778881 CEST | 58709 | 49741 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:10.359802008 CEST | 49741 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:10.364290953 CEST | 58709 | 49741 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:10.364351988 CEST | 49741 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:10.482995987 CEST | 58709 | 49741 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:10.483170033 CEST | 58709 | 49741 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:10.483205080 CEST | 58709 | 49741 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:10.483239889 CEST | 58709 | 49741 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:10.483252048 CEST | 49741 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:10.483297110 CEST | 49741 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:10.488450050 CEST | 58709 | 49741 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:10.488501072 CEST | 58709 | 49741 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:10.488565922 CEST | 49741 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:10.496721029 CEST | 49741 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:10.501696110 CEST | 58709 | 49741 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:13.624078035 CEST | 49741 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:13.629488945 CEST | 58709 | 49741 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:15.470177889 CEST | 58709 | 49731 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:15.528093100 CEST | 49731 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:15.533096075 CEST | 58709 | 49731 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:15.538882017 CEST | 58709 | 49732 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:15.554799080 CEST | 58709 | 49733 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:15.590244055 CEST | 49732 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:15.605875969 CEST | 49733 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:15.637245893 CEST | 49733 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:15.637370110 CEST | 49732 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:15.642118931 CEST | 58709 | 49733 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:15.642208099 CEST | 58709 | 49732 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:15.685239077 CEST | 58709 | 49739 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:15.730901003 CEST | 49739 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:15.943691015 CEST | 58709 | 49741 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:15.943802118 CEST | 58709 | 49739 | 77.91.77.66 | 192.168.2.4 |
| Jun 20, 2024 18:59:15.943872929 CEST | 49739 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:15.965406895 CEST | 49741 | 58709 | 192.168.2.4 | 77.91.77.66 |
| Jun 20, 2024 18:59:15.970355988 CEST | 58709 | 49741 | 77.91.77.66 | 192.168.2.4 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Jun 20, 2024 18:57:40.177056074 CEST | 62226 | 53 | 192.168.2.4 | 1.1.1.1 |
| Jun 20, 2024 18:57:40.185633898 CEST | 53 | 62226 | 1.1.1.1 | 192.168.2.4 |
| Jun 20, 2024 18:57:40.888211966 CEST | 59892 | 53 | 192.168.2.4 | 1.1.1.1 |
| Jun 20, 2024 18:57:40.896069050 CEST | 53 | 59892 | 1.1.1.1 | 192.168.2.4 |
| Jun 20, 2024 18:58:03.178292036 CEST | 54465 | 53 | 192.168.2.4 | 1.1.1.1 |
| Jun 20, 2024 18:58:03.186853886 CEST | 53 | 54465 | 1.1.1.1 | 192.168.2.4 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Jun 20, 2024 18:57:40.177056074 CEST | 192.168.2.4 | 1.1.1.1 | 0x3b85 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Jun 20, 2024 18:57:40.888211966 CEST | 192.168.2.4 | 1.1.1.1 | 0x2b33 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Jun 20, 2024 18:58:03.178292036 CEST | 192.168.2.4 | 1.1.1.1 | 0x3f5b | Standard query (0) | A (IP address) | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Jun 20, 2024 18:57:40.185633898 CEST | 1.1.1.1 | 192.168.2.4 | 0x3b85 | No error (0) | 34.117.186.192 | A (IP address) | IN (0x0001) | false | ||
| Jun 20, 2024 18:57:40.896069050 CEST | 1.1.1.1 | 192.168.2.4 | 0x2b33 | No error (0) | 172.67.75.166 | A (IP address) | IN (0x0001) | false | ||
| Jun 20, 2024 18:57:40.896069050 CEST | 1.1.1.1 | 192.168.2.4 | 0x2b33 | No error (0) | 104.26.5.15 | A (IP address) | IN (0x0001) | false | ||
| Jun 20, 2024 18:57:40.896069050 CEST | 1.1.1.1 | 192.168.2.4 | 0x2b33 | No error (0) | 104.26.4.15 | A (IP address) | IN (0x0001) | false | ||
| Jun 20, 2024 18:58:03.186853886 CEST | 1.1.1.1 | 192.168.2.4 | 0x3f5b | No error (0) | 34.117.186.192 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port |
|---|---|---|---|---|
| 0 | 192.168.2.4 | 49730 | 34.117.186.192 | 443 |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-06-20 16:56:58 UTC | 59 | OUT | |
| 2024-06-20 16:56:58 UTC | 513 | IN | |
| 2024-06-20 16:56:58 UTC | 319 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.4 | 49742 | 34.117.186.192 | 443 | 7408 | C:\Users\user\Desktop\YnsEArPlqx.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-06-20 16:57:40 UTC | 236 | OUT | |
| 2024-06-20 16:57:40 UTC | 514 | IN | |
| 2024-06-20 16:57:40 UTC | 876 | IN | |
| 2024-06-20 16:57:40 UTC | 149 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 2 | 192.168.2.4 | 49744 | 34.117.186.192 | 443 | 7632 | C:\ProgramData\MPGPH131\MPGPH131.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-06-20 16:57:40 UTC | 236 | OUT | |
| 2024-06-20 16:57:40 UTC | 514 | IN | |
| 2024-06-20 16:57:40 UTC | 876 | IN | |
| 2024-06-20 16:57:40 UTC | 149 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 3 | 192.168.2.4 | 49743 | 34.117.186.192 | 443 | 7640 | C:\ProgramData\MPGPH131\MPGPH131.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-06-20 16:57:40 UTC | 236 | OUT | |
| 2024-06-20 16:57:41 UTC | 514 | IN | |
| 2024-06-20 16:57:41 UTC | 876 | IN | |
| 2024-06-20 16:57:41 UTC | 149 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 4 | 192.168.2.4 | 49745 | 34.117.186.192 | 443 | 7852 | C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-06-20 16:57:41 UTC | 236 | OUT | |
| 2024-06-20 16:57:41 UTC | 514 | IN | |
| 2024-06-20 16:57:41 UTC | 876 | IN | |
| 2024-06-20 16:57:41 UTC | 149 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 5 | 192.168.2.4 | 49747 | 172.67.75.166 | 443 | 7632 | C:\ProgramData\MPGPH131\MPGPH131.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-06-20 16:57:41 UTC | 260 | OUT | |
| 2024-06-20 16:57:41 UTC | 655 | IN | |
| 2024-06-20 16:57:41 UTC | 85 | IN | |
| 2024-06-20 16:57:41 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 6 | 192.168.2.4 | 49746 | 172.67.75.166 | 443 | 7408 | C:\Users\user\Desktop\YnsEArPlqx.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-06-20 16:57:41 UTC | 260 | OUT | |
| 2024-06-20 16:57:41 UTC | 667 | IN | |
| 2024-06-20 16:57:41 UTC | 85 | IN | |
| 2024-06-20 16:57:41 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 7 | 192.168.2.4 | 49748 | 172.67.75.166 | 443 | 7640 | C:\ProgramData\MPGPH131\MPGPH131.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-06-20 16:57:41 UTC | 260 | OUT | |
| 2024-06-20 16:57:41 UTC | 653 | IN | |
| 2024-06-20 16:57:41 UTC | 85 | IN | |
| 2024-06-20 16:57:41 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 8 | 192.168.2.4 | 49749 | 172.67.75.166 | 443 | 7852 | C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-06-20 16:57:41 UTC | 260 | OUT | |
| 2024-06-20 16:57:42 UTC | 659 | IN | |
| 2024-06-20 16:57:42 UTC | 85 | IN | |
| 2024-06-20 16:57:42 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 9 | 192.168.2.4 | 49751 | 34.117.186.192 | 443 | 8008 | C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-06-20 16:58:03 UTC | 236 | OUT | |
| 2024-06-20 16:58:03 UTC | 514 | IN | |
| 2024-06-20 16:58:03 UTC | 876 | IN | |
| 2024-06-20 16:58:03 UTC | 149 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 10 | 192.168.2.4 | 49752 | 172.67.75.166 | 443 | 8008 | C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-06-20 16:58:04 UTC | 260 | OUT | |
| 2024-06-20 16:58:04 UTC | 657 | IN | |
| 2024-06-20 16:58:04 UTC | 85 | IN | |
| 2024-06-20 16:58:04 UTC | 5 | IN |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
| Target ID: | 0 |
| Start time: | 12:57:10 |
| Start date: | 20/06/2024 |
| Path: | C:\Users\user\Desktop\YnsEArPlqx.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x400000 |
| File size: | 3'270'672 bytes |
| MD5 hash: | AB8E88BFF0B907FC49B949D704490018 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | low |
| Has exited: | false |
| Target ID: | 2 |
| Start time: | 12:57:13 |
| Start date: | 20/06/2024 |
| Path: | C:\Windows\SysWOW64\schtasks.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x1c0000 |
| File size: | 187'904 bytes |
| MD5 hash: | 48C2FE20575769DE916F48EF0676A965 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 3 |
| Start time: | 12:57:13 |
| Start date: | 20/06/2024 |
| Path: | C:\Windows\System32\conhost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff7699e0000 |
| File size: | 862'208 bytes |
| MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 4 |
| Start time: | 12:57:13 |
| Start date: | 20/06/2024 |
| Path: | C:\Windows\SysWOW64\schtasks.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x1c0000 |
| File size: | 187'904 bytes |
| MD5 hash: | 48C2FE20575769DE916F48EF0676A965 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 5 |
| Start time: | 12:57:13 |
| Start date: | 20/06/2024 |
| Path: | C:\Windows\System32\conhost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff7699e0000 |
| File size: | 862'208 bytes |
| MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 6 |
| Start time: | 12:57:14 |
| Start date: | 20/06/2024 |
| Path: | C:\ProgramData\MPGPH131\MPGPH131.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x400000 |
| File size: | 3'270'672 bytes |
| MD5 hash: | AB8E88BFF0B907FC49B949D704490018 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Antivirus matches: |
|
| Reputation: | low |
| Has exited: | false |
| Target ID: | 7 |
| Start time: | 12:57:14 |
| Start date: | 20/06/2024 |
| Path: | C:\ProgramData\MPGPH131\MPGPH131.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x400000 |
| File size: | 3'270'672 bytes |
| MD5 hash: | AB8E88BFF0B907FC49B949D704490018 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | low |
| Has exited: | false |
| Target ID: | 11 |
| Start time: | 12:57:22 |
| Start date: | 20/06/2024 |
| Path: | C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x400000 |
| File size: | 3'270'672 bytes |
| MD5 hash: | AB8E88BFF0B907FC49B949D704490018 |
| Has elevated privileges: | false |
| Has administrator privileges: | false |
| Programmed in: | C, C++ or other language |
| Antivirus matches: |
|
| Reputation: | low |
| Has exited: | false |
| Target ID: | 12 |
| Start time: | 12:57:30 |
| Start date: | 20/06/2024 |
| Path: | C:\Users\user\AppData\Local\RageMP131\RageMP131.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x400000 |
| File size: | 3'270'672 bytes |
| MD5 hash: | AB8E88BFF0B907FC49B949D704490018 |
| Has elevated privileges: | false |
| Has administrator privileges: | false |
| Programmed in: | C, C++ or other language |
| Reputation: | low |
| Has exited: | false |