Edit tour
Windows
Analysis Report
BtCQu5APhK.exe
Overview
General Information
| Sample name: | BtCQu5APhK.exerenamed because original name is a hash value |
| Original sample name: | 225c26cf877ca85f63e80f878609f6dd2cf2ce717d4885f88a7a442d8bee03ad.exe |
| Analysis ID: | 1632373 |
| MD5: | c80150383af692d52bc33e7857b5724d |
| SHA1: | c9fc133a61844c2abe2095f803d6c6bb2ae944d0 |
| SHA256: | 225c26cf877ca85f63e80f878609f6dd2cf2ce717d4885f88a7a442d8bee03ad |
| Tags: | exeVIPKeyloggeruser-adrian__luca |
| Infos: |  |
 | |
Detection
GuLoader, Snake Keylogger
| Score: | 100 |
| Range: | 0 - 100 |
| Confidence: | 100% |
Signatures
Antivirus / Scanner detection for submitted sample
Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected GuLoader
Yara detected Snake Keylogger
Joe Sandbox ML detected suspicious sample
Switches to a custom stack to bypass stack traces
Tries to detect the country of the analysis system (by using the IP)
Tries to detect virtualization through RDTSC time measurements
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Contains functionality for read data from the clipboard
Contains functionality to dynamically determine API calls
Contains functionality to shutdown / reboot the system
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Stores files to the Windows start menu directory
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Classification
- System is w10x64
BtCQu5APhK.exe (PID: 6908 cmdline: "C:\Users\ user\Deskt op\BtCQu5A PhK.exe" MD5: C80150383AF692D52BC33E7857B5724D) - BtCQu5APhK.exe (PID: 2760 cmdline:
"C:\Users\ user\Deskt op\BtCQu5A PhK.exe" MD5: C80150383AF692D52BC33E7857B5724D)
- cleanup
| Name | Description | Attribution | Blogpost URLs | Link |
|---|---|---|---|---|
| CloudEyE, GuLoader | CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored. | No Attribution |
| Name | Description | Attribution | Blogpost URLs | Link |
|---|---|---|---|---|
| 404 Keylogger, Snake Keylogger | Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram. | No Attribution |
{"Exfil Mode": "SMTP", "Username": "report4log@tonicables.top", "Password": "7213575aceACE@", "Host": "tonicables.top", "Port": "587", "Version": "4.4"}| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_SnakeKeylogger | Yara detected Snake Keylogger | Joe Security | ||
| JoeSecurity_GuLoader_2 | Yara detected GuLoader | Joe Security | ||
| JoeSecurity_GuLoader_3 | Yara detected GuLoader | Joe Security |
⊘No Sigma rule has matched
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2025-03-07T23:01:20.495274+0100 | 2803305 | 3 | Unknown Traffic | 192.168.2.7 | 49692 | 104.21.80.1 | 443 | TCP |
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2025-03-07T23:01:15.548465+0100 | 2803274 | 2 | Potentially Bad Traffic | 192.168.2.7 | 49690 | 193.122.6.168 | 80 | TCP |
| 2025-03-07T23:01:18.392259+0100 | 2803274 | 2 | Potentially Bad Traffic | 192.168.2.7 | 49690 | 193.122.6.168 | 80 | TCP |
| 2025-03-07T23:01:21.204733+0100 | 2803274 | 2 | Potentially Bad Traffic | 192.168.2.7 | 49693 | 193.122.6.168 | 80 | TCP |
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2025-03-07T23:01:08.248611+0100 | 2803270 | 2 | Potentially Bad Traffic | 192.168.2.7 | 49688 | 142.250.184.206 | 443 | TCP |
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | Avira: | ||
| Source: | Malware Configuration Extractor: | ||
| Source: | Virustotal: | Perma Link | ||
| Source: | ReversingLabs: | |||
| Source: | Integrated Neural Analysis Model: | ||
Location Tracking | |
|---|
| Source: | DNS query: | ||
| Source: | Static PE information: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Code function: | 0_2_0040276E | |
| Source: | Code function: | 0_2_00405770 | |
| Source: | Code function: | 0_2_0040622B | |
| Source: | Code function: | 8_2_0040276E | |
| Source: | Code function: | 8_2_00405770 | |
| Source: | Code function: | 8_2_0040622B | |
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | IP Address: | ||
| Source: | IP Address: | ||
| Source: | IP Address: | ||
| Source: | JA3 fingerprint: | ||
| Source: | JA3 fingerprint: | ||
| Source: | DNS query: | ||
| Source: | DNS query: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Code function: | 0_2_004052D1 | |
| Source: | Process Stats: | ||
| Source: | Code function: | 0_2_00403358 | |
| Source: | Code function: | 8_2_00403358 | |
| Source: | File created: | Jump to behavior | ||
| Source: | Code function: | 0_2_00404B0E | |
| Source: | Code function: | 0_2_0040653D | |
| Source: | Code function: | 8_2_00404B0E | |
| Source: | Code function: | 8_2_0040653D | |
| Source: | Code function: | 8_2_0763C738 | |
| Source: | Code function: | 8_2_07636FC8 | |
| Source: | Code function: | 8_2_07639DE0 | |
| Source: | Code function: | 8_2_0763C468 | |
| Source: | Code function: | 8_2_07635362 | |
| Source: | Code function: | 8_2_0763CA08 | |
| Source: | Code function: | 8_2_0763C146 | |
| Source: | Code function: | 8_2_076369A0 | |
| Source: | Code function: | 8_2_07633E09 | |
| Source: | Code function: | 8_2_07633AB3 | |
| Source: | Code function: | 8_2_076329EC | |
| Source: | Code function: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Static PE information: | ||
| Source: | Classification label: | ||
| Source: | Code function: | 0_2_004045C8 | |
| Source: | Code function: | 0_2_0040206A | |
| Source: | File created: | Jump to behavior | ||
| Source: | Mutant created: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Virustotal: | ||
| Source: | ReversingLabs: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Key value queried: | Jump to behavior | ||
| Source: | File written: | Jump to behavior | ||
| Source: | Static file information: | ||
Data Obfuscation | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | Code function: | 0_2_00406252 | |
| Source: | Code function: | 0_2_10002DDE | |
| Source: | Code function: | 8_3_0767CF4D | |
| Source: | Code function: | 8_3_0767EE65 | |
| Source: | Code function: | 8_3_0767EEA9 | |
| Source: | Code function: | 8_2_07639D55 | |
| Source: | Code function: | 8_2_07638DE0 | |
| Source: | Code function: | 8_2_07638C30 | |
| Source: | Code function: | 8_2_0763891F | |
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
Malware Analysis System Evasion | |
|---|
| Source: | API/Special instruction interceptor: | ||
| Source: | API/Special instruction interceptor: | ||
| Source: | RDTSC instruction interceptor: | ||
| Source: | RDTSC instruction interceptor: | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Code function: | 0_2_0040276E | |
| Source: | Code function: | 0_2_00405770 | |
| Source: | Code function: | 0_2_0040622B | |
| Source: | Code function: | 8_2_0040276E | |
| Source: | Code function: | 8_2_00405770 | |
| Source: | Code function: | 8_2_0040622B | |
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | API call chain: | graph_0-4511 | ||
| Source: | API call chain: | graph_0-4516 | ||
| Source: | Code function: | 0_2_00406252 | |
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Code function: | 0_2_00405F0A | |
| Source: | Key value queried: | Jump to behavior | ||
Stealing of Sensitive Information | |
|---|
| Source: | File source: | ||
Remote Access Functionality | |
|---|
| Source: | File source: | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | 1 Native API | 1 Registry Run Keys / Startup Folder | 11 Process Injection | 11 Masquerading | OS Credential Dumping | 21 Security Software Discovery | Remote Services | 1 Archive Collected Data | 11 Encrypted Channel | Exfiltration Over Other Network Medium | 1 System Shutdown/Reboot |
| Credentials | Domains | Default Accounts | Scheduled Task/Job | 1 DLL Side-Loading | 1 Registry Run Keys / Startup Folder | 1 Disable or Modify Tools | LSASS Memory | 31 Virtualization/Sandbox Evasion | Remote Desktop Protocol | 1 Clipboard Data | 1 Ingress Tool Transfer | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | 1 DLL Side-Loading | 31 Virtualization/Sandbox Evasion | Security Account Manager | 1 Application Window Discovery | SMB/Windows Admin Shares | Data from Network Shared Drive | 2 Non-Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | 11 Process Injection | NTDS | 1 System Network Configuration Discovery | Distributed Component Object Model | Input Capture | 13 Application Layer Protocol | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | Network Logon Script | 1 Deobfuscate/Decode Files or Information | LSA Secrets | 3 File and Directory Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
| Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | 2 Obfuscated Files or Information | Cached Domain Credentials | 214 System Information Discovery | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
| DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | 1 DLL Side-Loading | DCSync | Remote System Discovery | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 76% | Virustotal | Browse | ||
| 66% | ReversingLabs | Win32.Trojan.Guloader | ||
| 100% | Avira | TR/AD.NsisInject.dsenc |
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | ReversingLabs | |||
| 0% | Virustotal | Browse |
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| drive.google.com | 142.250.184.206 | true | false | high | |
| drive.usercontent.google.com | 172.217.16.193 | true | false | high | |
| reallyfreegeoip.org | 104.21.80.1 | true | false | high | |
| checkip.dyndns.com | 193.122.6.168 | true | false | high | |
| checkip.dyndns.org | unknown | unknown | false | high |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| false | high | ||
| false | high |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 193.122.6.168 | checkip.dyndns.com | United States | 31898 | ORACLE-BMC-31898US | false | |
| 142.250.184.206 | drive.google.com | United States | 15169 | GOOGLEUS | false | |
| 172.217.16.193 | drive.usercontent.google.com | United States | 15169 | GOOGLEUS | false | |
| 104.21.80.1 | reallyfreegeoip.org | United States | 13335 | CLOUDFLARENETUS | false |
| Joe Sandbox version: | 42.0.0 Malachite |
| Analysis ID: | 1632373 |
| Start date and time: | 2025-03-07 22:58:29 +01:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 6m 59s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 11 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | BtCQu5APhK.exerenamed because original name is a hash value |
| Original Sample Name: | 225c26cf877ca85f63e80f878609f6dd2cf2ce717d4885f88a7a442d8bee03ad.exe |
| Detection: | MAL |
| Classification: | mal100.troj.evad.winEXE@3/30@4/4 |
| EGA Information: |
|
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): MpCmdRun.exe, sppsvc.exe, SgrmBroker.exe, conhost.exe, svchost.exe
- Excluded IPs from analysis (whitelisted): 23.60.203.209
- Excluded domains from analysis (whitelisted): fs.microsoft.com, ctldl.windowsupdate.com, c.pki.goog
- Execution Graph export aborted for target BtCQu5APhK.exe, PID 2760 because it is empty
- Not all processes where analyzed, report is missing behavior information
- Report size getting too big, too many NtOpenKeyEx calls found.
- Report size getting too big, too many NtQueryValueKey calls found.
- Report size getting too big, too many NtReadVirtualMemory calls found.
- Report size getting too big, too many NtSetInformationFile calls found.
- Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
| Time | Type | Description |
|---|---|---|
| 17:01:17 | API Interceptor |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 193.122.6.168 | Get hash | malicious | MSIL Logger, MassLogger RAT | Browse |
| |
| Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
| Get hash | malicious | MSIL Logger, MassLogger RAT | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger | Browse |
| ||
| 104.21.80.1 | Get hash | malicious | FormBook | Browse |
| |
| Get hash | malicious | FormBook | Browse |
| ||
| Get hash | malicious | FormBook | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Lokibot | Browse |
| ||
| Get hash | malicious | Lokibot | Browse |
| ||
| Get hash | malicious | FormBook | Browse |
| ||
| Get hash | malicious | FormBook | Browse |
| ||
| Get hash | malicious | FormBook | Browse |
| ||
| Get hash | malicious | FormBook | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| checkip.dyndns.com | Get hash | malicious | MSIL Logger, MassLogger RAT | Browse |
| |
| Get hash | malicious | MSIL Logger, MassLogger RAT | Browse |
| ||
| Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
| Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
| Get hash | malicious | GuLoader | Browse |
| ||
| Get hash | malicious | MSIL Logger, MassLogger RAT | Browse |
| ||
| Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
| Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
| Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| reallyfreegeoip.org | Get hash | malicious | MSIL Logger, MassLogger RAT | Browse |
| |
| Get hash | malicious | MSIL Logger, MassLogger RAT | Browse |
| ||
| Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
| Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
| Get hash | malicious | GuLoader | Browse |
| ||
| Get hash | malicious | MSIL Logger, MassLogger RAT | Browse |
| ||
| Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
| Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
| Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| ORACLE-BMC-31898US | Get hash | malicious | MSIL Logger, MassLogger RAT | Browse |
| |
| Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
| Get hash | malicious | GuLoader | Browse |
| ||
| Get hash | malicious | MSIL Logger, MassLogger RAT | Browse |
| ||
| Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger | Browse |
| ||
| Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
| Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
| CLOUDFLARENETUS | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | MSIL Logger, MassLogger RAT | Browse |
| ||
| Get hash | malicious | MSIL Logger, MassLogger RAT | Browse |
| ||
| Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
| Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
| Get hash | malicious | AgentTesla | Browse |
| ||
| Get hash | malicious | AgentTesla | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | GuLoader | Browse |
| ||
| Get hash | malicious | AgentTesla | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 54328bd36c14bd82ddaa0c04b25ed9ad | Get hash | malicious | MSIL Logger, MassLogger RAT | Browse |
| |
| Get hash | malicious | MSIL Logger, MassLogger RAT | Browse |
| ||
| Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
| Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
| Get hash | malicious | GuLoader | Browse |
| ||
| Get hash | malicious | GuLoader | Browse |
| ||
| Get hash | malicious | MSIL Logger, MassLogger RAT | Browse |
| ||
| Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
| Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
| Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
| 37f463bf4616ecd445d4a1937da06e19 | Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| |
| Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
| Get hash | malicious | GuLoader | Browse |
| ||
| Get hash | malicious | GuLoader | Browse |
| ||
| Get hash | malicious | GuLoader | Browse |
| ||
| Get hash | malicious | GuLoader | Browse |
| ||
| Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
| Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
| Get hash | malicious | GuLoader | Browse |
| ||
| Get hash | malicious | GuLoader | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| C:\Users\user\AppData\Local\Temp\nsg9317.tmp\System.dll | Get hash | malicious | GuLoader, Snake Keylogger | Browse | ||
| Get hash | malicious | FormBook, GuLoader | Browse | |||
| Get hash | malicious | FormBook, GuLoader | Browse | |||
| Get hash | malicious | GuLoader | Browse | |||
| Get hash | malicious | GuLoader | Browse | |||
| Get hash | malicious | Remcos, GuLoader | Browse | |||
| Get hash | malicious | GuLoader, MassLogger RAT | Browse | |||
| Get hash | malicious | GuLoader, Snake Keylogger | Browse | |||
| Get hash | malicious | GuLoader, Snake Keylogger | Browse | |||
| Get hash | malicious | Mindspark | Browse |
| Process: | C:\Users\user\Desktop\BtCQu5APhK.exe |
| File Type: | |
| Category: | modified |
| Size (bytes): | 33 |
| Entropy (8bit): | 4.33197669498491 |
| Encrypted: | false |
| SSDEEP: | 3:U4ooQGRDWh:hooQh |
| MD5: | 340AD700CF73B73EA2313C044D40EA9A |
| SHA1: | 9B90CC3147D140FA936E308C2C320BDC385DA93A |
| SHA-256: | 55A2B8F5EF1D17023FD8245E69830CC961C0CE629EDDC7AC1043C288CB3915B5 |
| SHA-512: | 4B31D10B80AE71197AC367C868569949224A4CD542BF0E9C188B816348EC8958F952525F939C827BDDC8610F268DD12E310D6D2FC99071C741B3A38E062542B4 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Users\user\Desktop\BtCQu5APhK.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 47 |
| Entropy (8bit): | 4.628848957968553 |
| Encrypted: | false |
| SSDEEP: | 3:YOm45GXQLQIfLBJXmgxv:5TGXQkIP2I |
| MD5: | B895D576D6637A778B387B2FCA0F56EC |
| SHA1: | E78D2BE4D94673D612C16D29C330BB0C78778429 |
| SHA-256: | BFEC1E97ED5D34825521D60B98986D1564CD159B4D1F9569EAE4C3464D2F5C47 |
| SHA-512: | B4A771D1B517A2776BA440F79F168306C244DF1A6DE1966313157154D8D52BEAD8131B95F846C2F55C15382E04284FFFC6CF6ABF3F6FCFCB259DF2EA58D769E5 |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| Preview: |
| Process: | C:\Users\user\Desktop\BtCQu5APhK.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2168953 |
| Entropy (8bit): | 5.527460080693035 |
| Encrypted: | false |
| SSDEEP: | 49152:m53wBV6bRPEd1UObFu0mBFmvYFe0m40mD0mbXCP:ewgRKbwRrgoTU |
| MD5: | 91BC96A65AB1300C21CF6C0023657621 |
| SHA1: | 9E8294A9A29F907CA9B5684B5771D8575C128EDC |
| SHA-256: | 46FFABB04FA940662609C2B73B7023AD190041FDE9B99102968AD50DB7A49AF7 |
| SHA-512: | 2CBACFCDEAC69754302F247088ABF9CFB466AA6A52468E4E591DF2E5A64CE4DBDFA61600C80218455230687D96363138846EE4CF9A975DA57B6C92F6C6891A53 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Users\user\Desktop\BtCQu5APhK.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 74 |
| Entropy (8bit): | 3.9637832956585757 |
| Encrypted: | false |
| SSDEEP: | 3:sRQE1wFEt/ijNJyI3dj2+n:aQEGiwh3D |
| MD5: | 16D513397F3C1F8334E8F3E4FC49828F |
| SHA1: | 4EE15AFCA81CA6A13AF4E38240099B730D6931F0 |
| SHA-256: | D3C781A1855C8A70F5ACA88D9E2C92AFFFA80541334731F62CAA9494AA8A0C36 |
| SHA-512: | 4A350B790FDD2FE957E9AB48D5969B217AB19FC7F93F3774F1121A5F140FF9A9EAAA8FA30E06A9EF40AD776E698C2E65A05323C3ADF84271DA1716E75F5183C3 |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| Preview: |
| Process: | C:\Users\user\Desktop\BtCQu5APhK.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 11264 |
| Entropy (8bit): | 5.813979271513012 |
| Encrypted: | false |
| SSDEEP: | 192:eF2HS5ih/7i00dWz9T7PH6lOFcQMI5+Vw+bPFomi7dJWsP:rSUmlw9T7DmnI5+N273FP |
| MD5: | 7399323923E3946FE9140132AC388132 |
| SHA1: | 728257D06C452449B1241769B459F091AABCFFC5 |
| SHA-256: | 5A1C20A3E2E2EB182976977669F2C5D9F3104477E98F74D69D2434E79B92FDC3 |
| SHA-512: | D6F28BA761351F374AE007C780BE27758AEA7B9F998E2A88A542EEDE459D18700ADFFE71ABCB52B8A8C00695EFB7CCC280175B5EEB57CA9A645542EDFABB64F1 |
| Malicious: | false |
| Antivirus: |
|
| Joe Sandbox View: |
|
| Reputation: | moderate, very likely benign file |
| Preview: |
| Process: | C:\Users\user\Desktop\BtCQu5APhK.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 30 |
| Entropy (8bit): | 4.256564762130954 |
| Encrypted: | false |
| SSDEEP: | 3:DyWgLQIfLBJXmgU:mkIP25 |
| MD5: | F15BFDEBB2DF02D02C8491BDE1B4E9BD |
| SHA1: | 93BD46F57C3316C27CAD2605DDF81D6C0BDE9301 |
| SHA-256: | C87F2FF45BB530577FB8856DF1760EDAF1060AE4EE2934B17FDD21B7D116F043 |
| SHA-512: | 1757ED4AE4D47D0C839511C18BE5D75796224D4A3049E2D8853650ACE2C5057C42040DE6450BF90DD4969862E9EBB420CD8A34F8DD9C970779ED2E5459E8F2F1 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\BtCQu5APhK.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 52 |
| Entropy (8bit): | 4.0914493934217315 |
| Encrypted: | false |
| SSDEEP: | 3:sBa99k1NoCFOn:KankVg |
| MD5: | 5D04A35D3950677049C7A0CF17E37125 |
| SHA1: | CAFDD49A953864F83D387774B39B2657A253470F |
| SHA-256: | A9493973DD293917F3EBB932AB255F8CAC40121707548DE100D5969956BB1266 |
| SHA-512: | C7B1AFD95299C0712BDBC67F9D2714926D6EC9F71909AF615AFFC400D8D2216AB76F6AC35057088836435DE36E919507E1B25BE87B07C911083F964EB67E003B |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\BtCQu5APhK.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 56 |
| Entropy (8bit): | 4.179475288865995 |
| Encrypted: | false |
| SSDEEP: | 3:sAAEVvjsaVBE584n:fLFVuP |
| MD5: | B525A5D1C0208D1745A1AB10F9BBEE5A |
| SHA1: | C236A0FEA985E2043789DA048DBD1787A7692E73 |
| SHA-256: | B451DA2920871A367FE8FDFE9E2237BCB8B399389A8C467BF2948EF37089DC21 |
| SHA-512: | 891717B067AEC0532982915DB6B6C5634A204D81C2370D32BB8EC2320C32DF75F2BCA958B5346B79895637AB13F2D454F0C0FEE820CCB8C7C0B727F869507159 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\BtCQu5APhK.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 60 |
| Entropy (8bit): | 4.417155962520948 |
| Encrypted: | false |
| SSDEEP: | 3:sEMBQEJkJVEjXcaVLMFVUxQoXUn:zaV4FmxvUn |
| MD5: | 4C43945AF25751D98ACE9DB9E05D0EFB |
| SHA1: | B94B1F2D5B01AEFE74671797F02AEA92804A5AC6 |
| SHA-256: | 95830571793B3D7318EBBD38A93FE6FA4A4DB24FBE282088CC6225E47104AFA3 |
| SHA-512: | 77063395B5B87092524F390E35E3AD7BCC5D8012CA2AD5E179A9EC94395E60E626B6FFDF54F053601FD938236960D1469D905DB2E6922EED453018127D0D555F |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\BtCQu5APhK.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 6266 |
| Entropy (8bit): | 7.934604994452403 |
| Encrypted: | false |
| SSDEEP: | 192:LageUe3z8q30+rTymq37MvDe0QQCtvOdjxvIqwgOdTsx3W:OQeJ3trT1cMvD2jvO7vIqwgOdTaW |
| MD5: | D154965D450CABB2873570BBB6BCEE1F |
| SHA1: | B69F899F37D407E34F7391B278C08140F22A8D4F |
| SHA-256: | 8EAF9B50CE1AE80F9A033C88D393FABFF9033E1D8485B411594889DD23AEEB48 |
| SHA-512: | 6483603905A6B6566F45C7F26EFC549D371A96DEFD57B29DD96AE8890EE481964C9E682A1077AEFC8D10F8366FADEAFE9FC0DE12477D0265C70D3BC629E53B3E |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\modstaaet.jpg
Download File
| Process: | C:\Users\user\Desktop\BtCQu5APhK.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 77820 |
| Entropy (8bit): | 7.966308391338044 |
| Encrypted: | false |
| SSDEEP: | 1536:0aI5v5+r/WGPIAVQIhrVMZXPizutOFGlin5ZSk2iFJNfgJSYrLfEXWMz:I55e/pVQIhrqKusGkmkPnNYhX2r |
| MD5: | 69FAD6C6022F82800FD9AA55EAFF43DF |
| SHA1: | C34951D82990B356BCB2CAE1B24690AAA9A558AB |
| SHA-256: | D765417E77F1604852B08BF8E3FC78B08DB3947AE0456B7DA5A7E272D83B1426 |
| SHA-512: | 324D713ECDE5AAFCEE49721D65936E3B8646F482521D971059E4D90908EAAA0CD7F0FE47159529935C3589F5892AB9F930AE74630EDBECC81CC68B7FC5FBA227 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\musicianer.spi
Download File
| Process: | C:\Users\user\Desktop\BtCQu5APhK.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 252988 |
| Entropy (8bit): | 1.258435768634305 |
| Encrypted: | false |
| SSDEEP: | 1536:Ffup5V9mQ4FqyWKrbCGsV2kLUY+mvKDFHHe4w/Lm65l32C+8zQNrpQJu0jx23uf5:1lMpKEfpd |
| MD5: | E19F0FF07EFE63E8B30B92E64C3279C1 |
| SHA1: | 7855F6FBD8FC96F485B4140A85A4D5CBD31F1AF9 |
| SHA-256: | 4CE892AA1B8B8CFFC9835C703FABC69087F82490FB46E889D6C07280DCE64E03 |
| SHA-512: | 030264903EFB58841058997648E112F3AC89EE4D9EA038D96F1CD132A59B2B0A3D6BCB4DD99DA62279835408453F84CF3AF492E1D53910C8AE29CCE386E2D5CB |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\BtCQu5APhK.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 9249 |
| Entropy (8bit): | 7.859769804343658 |
| Encrypted: | false |
| SSDEEP: | 192:Lg3GVbPdwh/TkYJFxFd5Ynr9rwP8eiJnuLq6dIUfvF3g5/S+4DHEk:k3GVbPdSwYJn5Yr9rNJuLq6d1nF6S+4F |
| MD5: | 99568CF7EA7AB982BEBEC6E8C9736699 |
| SHA1: | 656B55183279F357ABE336F6359C4AEDB5FB4AD6 |
| SHA-256: | B9FCD205A8B2A819D6774B0F217334C24E508A02BA504D24CE3438C17AAE630A |
| SHA-512: | C7408A24197C4BF2B14C3AD43840851EB14325E60490998E1625FEC3CE538CB8B4EC1C9A71836990E0EB4EE922040217EC0989FD6E6D4F5BC4FCC3F3FDA0FB10 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\romantiserendes.ini
Download File
| Process: | C:\Users\user\Desktop\BtCQu5APhK.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 79085 |
| Entropy (8bit): | 7.963718594699245 |
| Encrypted: | false |
| SSDEEP: | 1536:0aI5v5+r/WGPIAVQIhrVMZXPizutOFGlin5ZSk2iFJNfgJSYrLfEXWMn:I55e/pVQIhrqKusGkmkPnNYhX2P |
| MD5: | 48951E338D32805997DA47E7122CA34C |
| SHA1: | FB7A57BEAAC5B15E081DCF5A54947107FB9DF9C0 |
| SHA-256: | 62D4D8C14C5BC21B8FC7BAC1BC1C8A272404C5516871E574D9E65EEF00787D11 |
| SHA-512: | 7BC3831B4274EB53F5F40C59C41456C35005FEFDD486774DA41287EA46CC33E2858C0DAE2BBE9FD12EB63BD7BA8460D8B184AB316340B45E90C939821B92D2E7 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\semiquadrangle.ini
Download File
| Process: | C:\Users\user\Desktop\BtCQu5APhK.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 18366 |
| Entropy (8bit): | 7.960531856269744 |
| Encrypted: | false |
| SSDEEP: | 384:G69R2kiP8DN7z8OayzjwTSQ1vI8+KvvKyMIWVx3NRGBQqxFk8nWzy1+a6Pu10IJ0:GgHpXda7+2d1vezVx3NRCpnZ1+afGIJ0 |
| MD5: | D0B061FE143A45224AF28C219D85EC29 |
| SHA1: | 98EC46FB584AFFF14AB2B9D8DBD914C2F82DB58B |
| SHA-256: | DDD6D841667588C40373273F4ACE25CD8E25C527BC4B15160A4BD95D5F5F859A |
| SHA-512: | D6035392C1E6D28B01CF4AD9025E9E43B64CAAD772B6FBF2F0D239CDC5F2B1DB3266DEAC88DC73B3C443D8755582E9E99B86642BE67E693447B5B70E79116A48 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\sugarcane.jpg
Download File
| Process: | C:\Users\user\Desktop\BtCQu5APhK.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 17926 |
| Entropy (8bit): | 7.964086895083405 |
| Encrypted: | false |
| SSDEEP: | 384:G69R2kiP8DN7z8OayzjwTSQ1vI8+KvvKyMIWVx3NRGBQqxFk8nWzy1+a6Pu10IJy:GgHpXda7+2d1vezVx3NRCpnZ1+afGIJy |
| MD5: | 226BA095D6E35AE7575FF844DA0C0293 |
| SHA1: | D50131B137CAA1464076A0F6B1AB1ADA6E99234E |
| SHA-256: | 307B12DABB919A69383409A5064E70DCD0CD4903C9E94814D10C540312F0BE73 |
| SHA-512: | 3BEC4961D0682F6ECA723A8838DB446F5152C34D82B9EEE7CE2B80724F63BAB6D4A3BE0C0B5418E7831F04AD8236697B7E4820ECE601878471AAA2184488121A |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\BtCQu5APhK.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 10701 |
| Entropy (8bit): | 7.839639743360956 |
| Encrypted: | false |
| SSDEEP: | 192:Lzr3FqEXWDs3kosNACUJ2PDTHjHzCM4guHBTGgAuihMBvUjhIaRTHO:3r3FqCd3Bsy1IPDTDebgkTG1XNHO |
| MD5: | 6AB549CF24DE4802D3806218FDC48906 |
| SHA1: | DADA9FCA4EC7121494CC70B3E7A2018E0F8116CA |
| SHA-256: | D484ED1BD415EC1F924CA80A2B8EBD60FF02998A3AD3028145C75900F51F19DF |
| SHA-512: | FDB7BD49B53E243FBDD3FF6613BDC0F47E6ACBE378EC9599263393B121395DCA0B23D978B7029F058B5AEBE4264EB356C945C0EB1AB00B3D6A3E75EE6D4D8651 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\unagitatedness.txt
Download File
| Process: | C:\Users\user\Desktop\BtCQu5APhK.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 355 |
| Entropy (8bit): | 4.365173801202148 |
| Encrypted: | false |
| SSDEEP: | 6:a33GWsurYzIbhGvPiUWrFArTWzgVJ86CcE6LpA6rMrLGbGVPoHknd3TFKA8iWFzK:amN9C0vPQqrqsj86Cck6kVPoEnFweWKp |
| MD5: | 52728264A79BB126BC05A9339A806437 |
| SHA1: | 031F624DC90E451583A740F03B0432F63FB472DE |
| SHA-256: | 8D23AFDA0BB6BFD4399AF4AEBFAA8196644DCD468D1E6705C2388E7DB49F8D4A |
| SHA-512: | EFC41C3E278119CFEDBC039153FE6374C5DB4DBD95E10969768115EFA463D9E38CBC0C3DC2469D200C775AF7851E4B77AB4AE63B5456E4DE996EB21A94903519 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\vrfterne\Litiscontest.jpg
Download File
| Process: | C:\Users\user\Desktop\BtCQu5APhK.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 116646 |
| Entropy (8bit): | 7.9723106052665536 |
| Encrypted: | false |
| SSDEEP: | 3072:Cq3EK4+CecuNPZ23e6at5JG7QXnv0tD6nI:Cq3PRCeTZ1tspwI |
| MD5: | 2400D62D49391C7874C3DF868B3399ED |
| SHA1: | F5AF15AAE9EE9BD00F459D67EBBCDB8E48B6D4A3 |
| SHA-256: | C400565DCC08D080953E47902F2946C687C4F814C3BA51E0D4E63E4242112566 |
| SHA-512: | 7CE7C0DAA1B222DD67D6292F9FE3A9BDFB0782C790D817C0B4B348B8D8AB7B5630D8DBFB953ED55093DFB2DCABF8FBB257A4ED666B2145D8946E0D2C082DB70B |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\vrfterne\Nontranscribing.Afk
Download File
| Process: | C:\Users\user\Desktop\BtCQu5APhK.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 464370 |
| Entropy (8bit): | 7.128664105126662 |
| Encrypted: | false |
| SSDEEP: | 12288:tcN8s2ALwBV6bJhSXw1Yg9Zgvl1J8nyXW:W53wBV6bWwPivjJJXW |
| MD5: | 7E9CCC8B5A47A5A19342C11804D3A945 |
| SHA1: | DC9C2F550A59FB4837432F67800F223BEE356B07 |
| SHA-256: | 54211487EF40979F6A0F0867799C60235277EA393976411BB979B2441B80A272 |
| SHA-512: | 5E085423CE6EDEE16EDC188EC1C3B9B7B70CF7B307155E2627FE1B9C2858B23D129F939390F75F3489CE02CD7AB3A6D8939ED5A1D1B124FFA75256D651F15EE8 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\vrfterne\Sproglyde.Mes
Download File
| Process: | C:\Users\user\Desktop\BtCQu5APhK.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 53339 |
| Entropy (8bit): | 4.586909533694526 |
| Encrypted: | false |
| SSDEEP: | 768:2klatJBusrGW4a5kIO4/ZV6/Wb9DcGfVupUahJTIuJVDbVuULJfpanV5Sd:2kotJEnckIdZ4O4UCIgl1nXd |
| MD5: | 6217DB8D3167C8D33F7FF0C9C3DBA09F |
| SHA1: | 516815348D5A41023E7BFA63ACD582C5E2C4BFDA |
| SHA-256: | 2151BFBD84CAF4F46A4E934AFEE7CD933516CD8DECE6BF869277ADCAA06A9DBA |
| SHA-512: | 2413ED09DD4C626ADA07E21A160A46BB80F9603A0464A0298A9A770A51FF14EB648AB7C23AAC24F0C9745044B57A1B35B815E3BFB311F1C5EFB1874FE6FFFECF |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\vrfterne\Tiggerstavens.fes
Download File
| Process: | C:\Users\user\Desktop\BtCQu5APhK.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 458176 |
| Entropy (8bit): | 1.246204574944222 |
| Encrypted: | false |
| SSDEEP: | 1536:xRWO2EIpW61fXKYiZAiYUQZF4Ce2spug3ZcCQy0kTwxdwBl9qiJsuQKSA4o6LOzv:seFwClmyQzweu |
| MD5: | F507FD73B5683DFB9ECE04A486CF8E21 |
| SHA1: | 171A7FF1F5C92A75FF2787021BA6750FEF68213F |
| SHA-256: | 9AEAFCD46AA3D1B660FB1A3A8F10C21D28C80A50BF37A23D9ECA444A51557065 |
| SHA-512: | B6124C979EF1DC6946F95EACAA369E4EABB9B0E32781197A8A2686FA2FEDB69B123B274EB19E82E4AD781FB49D6F74A96E1B38C147C7AC163C5430DD084C7D2F |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\vrfterne\Udgyd.ini
Download File
| Process: | C:\Users\user\Desktop\BtCQu5APhK.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 34271 |
| Entropy (8bit): | 7.9659073424878555 |
| Encrypted: | false |
| SSDEEP: | 768:4WE6omjLoyBWuDNGNceCXyQezdhoMB8q+ljUsYU1xhbU3vCH:4Uom4yBhmQi7eK8q+lpJRUfCH |
| MD5: | 868F1BE25FA5F82DE53C0CE9EA030CA3 |
| SHA1: | ECA9A135448D5C0F613209FF3516CAE3716BF0E3 |
| SHA-256: | 5FD97F664356EE61E6182C19DC0AF76318B4AA9AF75D674F11EB45DEF3D66526 |
| SHA-512: | 6A67BE639F4A4A8A24587ED6B1D67F276F41BC750B0FC74C49A69FF9293F57ACAE6DEF3423C8DF06805A1BB7CE894F4359510B3A27E2E1F388D065A618479E21 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\vrfterne\Udtrttede.ini
Download File
| Process: | C:\Users\user\Desktop\BtCQu5APhK.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 78838 |
| Entropy (8bit): | 7.9645085314331405 |
| Encrypted: | false |
| SSDEEP: | 1536:0aI5v5+r/WGPIAVQIhrVMZXPizutOFGlin5ZSk2iFJNfgJSYrLfEXWMp:I55e/pVQIhrqKusGkmkPnNYhX2R |
| MD5: | C994CB2032DBA92B7E631171678EC43D |
| SHA1: | E206DF32EA7F37FA26075E0456786E138AC27AE1 |
| SHA-256: | 3D6B9E81DA6DF4A9432CDB4168EE8F8B26CC88E47FDB9BB8A6D967FB1AB241E3 |
| SHA-512: | E444152150B4C1007FA96AA079E41D959A5A48D00D9F1D9AC15321B646F7CF4000D43825DF25EF7D69275A3CA86C029E8862AF07F873A8375B1EAAE5280A4F13 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\vrfterne\aktioners.jpg
Download File
| Process: | C:\Users\user\Desktop\BtCQu5APhK.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 33760 |
| Entropy (8bit): | 7.967017042537166 |
| Encrypted: | false |
| SSDEEP: | 768:4WE6omjLoyBWuDNGNceCXyQezdhoMB8q+ljUsYU1xhbU3vCW:4Uom4yBhmQi7eK8q+lpJRUfCW |
| MD5: | B79A2EC8152E04C3DF16B5DF803ED841 |
| SHA1: | 4E8FEE2ACDA813B8D6F12FF1B2B9BEDA769C05BD |
| SHA-256: | 584DC6A4106CFB60A2794937921B3B560F398558B482D5C24A1ECFB997EBEA9D |
| SHA-512: | 0DFB2B2FA92EB11B60C87D272B6B2EEA14DC2E05D53048C445772D6249F3635BBD1EE7B663F9F670FCD06C50C71839323BF2325CAEECBD9AD7D182E5733C3488 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\vrfterne\begrdeliges.pro
Download File
| Process: | C:\Users\user\Desktop\BtCQu5APhK.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 271048 |
| Entropy (8bit): | 1.2501527383190683 |
| Encrypted: | false |
| SSDEEP: | 1536:J3Cc9bXL6XUITHsHuh6mYsN8xVvBPJggd0Q96LJe24TSewHt/z1tIwt8iWoImuhr:JGU5Q+7bgfC97p |
| MD5: | 4CDDE62E05107CF3BAD9767453F364D5 |
| SHA1: | 8C3990C82C3F9C0ECECCFC2E878F00B674556E6E |
| SHA-256: | 80EFA0744FB280C29C700886A6CD158053D0BE9C2D87F445A76C6DEA410B774B |
| SHA-512: | A3C64E4B4DB6AEA45756BFB1C2BED5F7CA19549DE8C2D095F320DB8BC8589B01E356D033D6073CBEED9B56EDA1939BEB98E727382F5396EA3E50079125B19451 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\vrfterne\burdie.ini
Download File
| Process: | C:\Users\user\Desktop\BtCQu5APhK.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 19024 |
| Entropy (8bit): | 7.941019032399731 |
| Encrypted: | false |
| SSDEEP: | 384:G69R2kiP8DN7z8OayzjwTSQ1vI8+KvvKyMIWVx3NRGBQqxFk8nWzy1+a6Pu10IJh:GgHpXda7+2d1vezVx3NRCpnZ1+afGIJh |
| MD5: | E9772CD90D72A4F4AF0401E7BFBA7BBA |
| SHA1: | 45DEEC11D8CE16E3DF98F6E3AC23A6B647A81535 |
| SHA-256: | 53BB5626BC226D0E476A35645C2D720C1056ADFBB23DAEB5923E9264540259B9 |
| SHA-512: | BA2E24D412C69D2B1EBAEDBF5B7AC0F94544A3E9C42CDE2FB13C456217B6B0449024086D78C72F8B7C4EBA35622C56623919F64CE408471028E0A5DC6E206027 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\vrfterne\cartographer.jpg
Download File
| Process: | C:\Users\user\Desktop\BtCQu5APhK.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 30956 |
| Entropy (8bit): | 7.969499868102271 |
| Encrypted: | false |
| SSDEEP: | 768:ofYXJ6hCAlkicSla3FFc1VQC2NOF1Nuse5wExZ50vn:oQalrlaVC1uClF1NuTT5Mn |
| MD5: | C9D3CCBEBDAFAA919122541A202A9733 |
| SHA1: | F81641E686DE3B8C884971EC5DA65D8CF4BB4D3F |
| SHA-256: | 5FDB8BED6E957D3399EC0D8A30934F1E0B2A4C5880A6EC8DF43F786BAA32A96C |
| SHA-512: | F16B4DC339F4943E19408F386C376C50A4DA42E6DB1241EAB90B8596AF701F75421B87A1AEA10835467A3900E29E2611943DC9B89FDFAAC3E46D0546BFA83A7A |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\vrfterne\histographies.txt
Download File
| Process: | C:\Users\user\Desktop\BtCQu5APhK.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 34638 |
| Entropy (8bit): | 7.9628416848799 |
| Encrypted: | false |
| SSDEEP: | 768:4WE6omjLoyBWuDNGNceCXyQezdhoMB8q+ljUsYU1xhbU3vCL:4Uom4yBhmQi7eK8q+lpJRUfCL |
| MD5: | 5A1AD1096F97C0E2239684846D247918 |
| SHA1: | 2885227167F0780AED630077007401989AFDDAEE |
| SHA-256: | C2C9EE1D315D2D076FAADFDECF060E59877B621385A7825EDBA473BE85CCBF7F |
| SHA-512: | 2740807D4DCDB5D2CE786488047360225EC7DED2B84A215CCE00DB25E67C2A9B5C9C3E0593BA35F8E48D937E3104FFD97C3B034471639F88D3119F9B9C62B36B |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\vrfterne\icekhana.txt
Download File
| Process: | C:\Users\user\Desktop\BtCQu5APhK.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 78312 |
| Entropy (8bit): | 7.965760163563921 |
| Encrypted: | false |
| SSDEEP: | 1536:0aI5v5+r/WGPIAVQIhrVMZXPizutOFGlin5ZSk2iFJNfgJSYrLfEXWMo:I55e/pVQIhrqKusGkmkPnNYhX2g |
| MD5: | B53488FB78817ABDEA984B799B644E71 |
| SHA1: | B52C3F0461B2D4827634B17A8456FE0EEACCF166 |
| SHA-256: | 37E2971FE0FE1B8F445A2D90CFEFC40A614C09F04D4269DC0E39131714B71644 |
| SHA-512: | 817F53CAA92582CE9F070493836EF6E925CCDFECA064C3CD8ADFFF1124542D61ED2F2DD2ABBCFC46F7CA700A43710EA78440BD16092AC41EA59D90C7E2BB13EC |
| Malicious: | false |
| Preview: |
| File type: | |
| Entropy (8bit): | 7.8037314516273115 |
| TrID: |
|
| File name: | BtCQu5APhK.exe |
| File size: | 1'053'154 bytes |
| MD5: | c80150383af692d52bc33e7857b5724d |
| SHA1: | c9fc133a61844c2abe2095f803d6c6bb2ae944d0 |
| SHA256: | 225c26cf877ca85f63e80f878609f6dd2cf2ce717d4885f88a7a442d8bee03ad |
| SHA512: | eea0d0cf96ba7ac9cb0dd3a2e451b16e94a4a750420b3642808292ee727837e3260227a8e0af751528691e3d0089d6c01e63bf41d8ecf7424c639642a7bd8fae |
| SSDEEP: | 24576:NtLjV8bDyBuAwmVau3a88yQigUcCZmm58YbLjs8jH1zL:NtLGvo/lHMyk0ZmgK8X |
| TLSH: | 58252351BBC0661FF4D68E72D99F87D16372DF040652160F6B08FB2E2C789828F1A65B |
| File Content Preview: | MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1.D9u.*ju.*ju.*j..ujw.*ju.+j..*j..wjd.*j!..j..*j..,jt.*jRichu.*j........PE..L....f.R.................`...*......X3.......p....@ |
 | |
| Icon Hash: | 31199dedad4d2787 |
| Entrypoint: | 0x403358 |
| Entrypoint Section: | .text |
| Digitally signed: | false |
| Imagebase: | 0x400000 |
| Subsystem: | windows gui |
| Image File Characteristics: | RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE |
| DLL Characteristics: | TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x52BA66B2 [Wed Dec 25 05:01:38 2013 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 4 |
| OS Version Minor: | 0 |
| File Version Major: | 4 |
| File Version Minor: | 0 |
| Subsystem Version Major: | 4 |
| Subsystem Version Minor: | 0 |
| Import Hash: | e221f4f7d36469d53810a4b5f9fc8966 |
| Instruction |
|---|
| sub esp, 000002D4h |
| push ebx |
| push ebp |
| push esi |
| push edi |
| push 00000020h |
| xor ebp, ebp |
| pop esi |
| mov dword ptr [esp+14h], ebp |
| mov dword ptr [esp+10h], 00409230h |
| mov dword ptr [esp+1Ch], ebp |
| call dword ptr [00407034h] |
| push 00008001h |
| call dword ptr [004070BCh] |
| push ebp |
| call dword ptr [004072ACh] |
| push 00000008h |
| mov dword ptr [00429298h], eax |
| call 00007FAE58BA414Ch |
| mov dword ptr [004291E4h], eax |
| push ebp |
| lea eax, dword ptr [esp+34h] |
| push 000002B4h |
| push eax |
| push ebp |
| push 00420690h |
| call dword ptr [0040717Ch] |
| push 0040937Ch |
| push 004281E0h |
| call 00007FAE58BA3DB7h |
| call dword ptr [00407134h] |
| mov ebx, 00434000h |
| push eax |
| push ebx |
| call 00007FAE58BA3DA5h |
| push ebp |
| call dword ptr [0040710Ch] |
| cmp word ptr [00434000h], 0022h |
| mov dword ptr [004291E0h], eax |
| mov eax, ebx |
| jne 00007FAE58BA129Ah |
| push 00000022h |
| mov eax, 00434002h |
| pop esi |
| push esi |
| push eax |
| call 00007FAE58BA37F6h |
| push eax |
| call dword ptr [00407240h] |
| mov dword ptr [esp+18h], eax |
| jmp 00007FAE58BA135Eh |
| push 00000020h |
| pop edx |
| cmp cx, dx |
| jne 00007FAE58BA1299h |
| inc eax |
| inc eax |
| cmp word ptr [eax], dx |
| je 00007FAE58BA128Bh |
| add word ptr [eax], 0000h |
| Programming Language: |
|
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0x7494 | 0xb4 | .rdata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x4d000 | 0x284b8 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x7000 | 0x2b8 | .rdata |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x5e66 | 0x6000 | e8f12472e91b02deb619070e6ee7f1f4 | False | 0.6566569010416666 | data | 6.419409887460116 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .rdata | 0x7000 | 0x1354 | 0x1400 | 2222fe44ebbadbc32af32dfc9c88e48e | False | 0.4306640625 | data | 5.037511188789184 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .data | 0x9000 | 0x202d8 | 0x600 | a5ec1b720d350c6303a7aba8d85072bf | False | 0.4733072916666667 | data | 3.7600484096214832 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .ndata | 0x2a000 | 0x23000 | 0x0 | d41d8cd98f00b204e9800998ecf8427e | False | 0 | empty | 0.0 | IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .rsrc | 0x4d000 | 0x284b8 | 0x28600 | 34185201e4ea24efa65b15898a0a01f1 | False | 0.5663155476006192 | data | 5.783399428430881 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| RT_ICON | 0x4d358 | 0x10828 | Device independent bitmap graphic, 128 x 256 x 32, image size 65536 | English | United States | 0.535357269608423 |
| RT_ICON | 0x5db80 | 0x94a8 | Device independent bitmap graphic, 96 x 192 x 32, image size 36864 | English | United States | 0.5761509354635275 |
| RT_ICON | 0x67028 | 0x5488 | Device independent bitmap graphic, 72 x 144 x 32, image size 20736 | English | United States | 0.6025878003696857 |
| RT_ICON | 0x6c4b0 | 0x4228 | Device independent bitmap graphic, 64 x 128 x 32, image size 16384 | English | United States | 0.6164383561643836 |
| RT_ICON | 0x706d8 | 0x25a8 | Device independent bitmap graphic, 48 x 96 x 32, image size 9216 | English | United States | 0.6511410788381743 |
| RT_ICON | 0x72c80 | 0x10a8 | Device independent bitmap graphic, 32 x 64 x 32, image size 4096 | English | United States | 0.7045028142589118 |
| RT_ICON | 0x73d28 | 0x988 | Device independent bitmap graphic, 24 x 48 x 32, image size 2304 | English | United States | 0.7372950819672132 |
| RT_ICON | 0x746b0 | 0x468 | Device independent bitmap graphic, 16 x 32 x 32, image size 1024 | English | United States | 0.8111702127659575 |
| RT_DIALOG | 0x74b18 | 0x144 | data | English | United States | 0.5216049382716049 |
| RT_DIALOG | 0x74c60 | 0x120 | data | English | United States | 0.5138888888888888 |
| RT_DIALOG | 0x74d80 | 0x11c | data | English | United States | 0.6056338028169014 |
| RT_DIALOG | 0x74ea0 | 0x60 | data | English | United States | 0.7291666666666666 |
| RT_GROUP_ICON | 0x74f00 | 0x76 | data | English | United States | 0.7542372881355932 |
| RT_VERSION | 0x74f78 | 0x238 | data | English | United States | 0.5422535211267606 |
| RT_MANIFEST | 0x751b0 | 0x305 | XML 1.0 document, ASCII text, with very long lines (773), with no line terminators | English | United States | 0.5614489003880984 |
| DLL | Import |
|---|---|
| KERNEL32.dll | CompareFileTime, SearchPathW, SetFileTime, CloseHandle, GetShortPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, GetFullPathNameW, CreateDirectoryW, Sleep, GetTickCount, CreateFileW, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, SetEnvironmentVariableW, GetWindowsDirectoryW, SetFileAttributesW, ExpandEnvironmentStringsW, SetErrorMode, LoadLibraryW, lstrlenW, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, CreateProcessW, RemoveDirectoryW, lstrcmpiA, GetTempFileNameW, lstrcpyA, lstrcpyW, lstrcatW, GetSystemDirectoryW, GetVersion, GetProcAddress, LoadLibraryA, GetModuleHandleA, GetModuleHandleW, lstrcmpiW, lstrcmpW, WaitForSingleObject, GlobalFree, GlobalAlloc, LoadLibraryExW, GetExitCodeProcess, FreeLibrary, WritePrivateProfileStringW, GetCommandLineW, GetTempPathW, GetPrivateProfileStringW, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, MulDiv, MultiByteToWideChar, WriteFile, lstrlenA, WideCharToMultiByte |
| USER32.dll | EndDialog, ScreenToClient, GetWindowRect, RegisterClassW, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, wsprintfW, CreateWindowExW, SystemParametersInfoW, AppendMenuW, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, GetDC, SetWindowLongW, LoadImageW, SendMessageTimeoutW, FindWindowExW, EmptyClipboard, OpenClipboard, TrackPopupMenu, EndPaint, ShowWindow, GetDlgItem, IsWindow, SetForegroundWindow |
| GDI32.dll | SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor |
| SHELL32.dll | SHGetSpecialFolderLocation, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW |
| ADVAPI32.dll | RegCloseKey, RegOpenKeyExW, RegDeleteKeyW, RegDeleteValueW, RegEnumValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumKeyW |
| COMCTL32.dll | ImageList_Create, ImageList_AddMasked, ImageList_Destroy |
| ole32.dll | CoCreateInstance, CoTaskMemFree, OleInitialize, OleUninitialize |
| VERSION.dll | GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW |
| Description | Data |
|---|---|
| FileDescription | vignetted |
| LegalCopyright | dommedagsprdikenens johnnis |
| LegalTrademarks | kodes |
| OriginalFilename | toggler triumvirates.exe |
| ProductVersion | 3.5.0.0 |
| Translation | 0x0409 0x04e4 |
| Language of compilation system | Country where language is spoken | Map |
|---|---|---|
| English | United States |  |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | SID | Signature | Severity | Source IP | Source Port | Dest IP | Dest Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2025-03-07T23:01:08.248611+0100 | 2803270 | ETPRO MALWARE Common Downloader Header Pattern UHCa | 2 | 192.168.2.7 | 49688 | 142.250.184.206 | 443 | TCP |
| 2025-03-07T23:01:15.548465+0100 | 2803274 | ETPRO MALWARE Common Downloader Header Pattern UH | 2 | 192.168.2.7 | 49690 | 193.122.6.168 | 80 | TCP |
| 2025-03-07T23:01:18.392259+0100 | 2803274 | ETPRO MALWARE Common Downloader Header Pattern UH | 2 | 192.168.2.7 | 49690 | 193.122.6.168 | 80 | TCP |
| 2025-03-07T23:01:20.495274+0100 | 2803305 | ETPRO MALWARE Common Downloader Header Pattern H | 3 | 192.168.2.7 | 49692 | 104.21.80.1 | 443 | TCP |
| 2025-03-07T23:01:21.204733+0100 | 2803274 | ETPRO MALWARE Common Downloader Header Pattern UH | 2 | 192.168.2.7 | 49693 | 193.122.6.168 | 80 | TCP |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Mar 7, 2025 23:01:05.340457916 CET | 49688 | 443 | 192.168.2.7 | 142.250.184.206 |
| Mar 7, 2025 23:01:05.340509892 CET | 443 | 49688 | 142.250.184.206 | 192.168.2.7 |
| Mar 7, 2025 23:01:05.340620041 CET | 49688 | 443 | 192.168.2.7 | 142.250.184.206 |
| Mar 7, 2025 23:01:05.355479956 CET | 49688 | 443 | 192.168.2.7 | 142.250.184.206 |
| Mar 7, 2025 23:01:05.355501890 CET | 443 | 49688 | 142.250.184.206 | 192.168.2.7 |
| Mar 7, 2025 23:01:07.507683992 CET | 443 | 49688 | 142.250.184.206 | 192.168.2.7 |
| Mar 7, 2025 23:01:07.507781982 CET | 49688 | 443 | 192.168.2.7 | 142.250.184.206 |
| Mar 7, 2025 23:01:07.508781910 CET | 443 | 49688 | 142.250.184.206 | 192.168.2.7 |
| Mar 7, 2025 23:01:07.508837938 CET | 49688 | 443 | 192.168.2.7 | 142.250.184.206 |
| Mar 7, 2025 23:01:07.666646004 CET | 49688 | 443 | 192.168.2.7 | 142.250.184.206 |
| Mar 7, 2025 23:01:07.666682005 CET | 443 | 49688 | 142.250.184.206 | 192.168.2.7 |
| Mar 7, 2025 23:01:07.667088032 CET | 443 | 49688 | 142.250.184.206 | 192.168.2.7 |
| Mar 7, 2025 23:01:07.667154074 CET | 49688 | 443 | 192.168.2.7 | 142.250.184.206 |
| Mar 7, 2025 23:01:07.671087980 CET | 49688 | 443 | 192.168.2.7 | 142.250.184.206 |
| Mar 7, 2025 23:01:07.716327906 CET | 443 | 49688 | 142.250.184.206 | 192.168.2.7 |
| Mar 7, 2025 23:01:08.248619080 CET | 443 | 49688 | 142.250.184.206 | 192.168.2.7 |
| Mar 7, 2025 23:01:08.248701096 CET | 443 | 49688 | 142.250.184.206 | 192.168.2.7 |
| Mar 7, 2025 23:01:08.248827934 CET | 49688 | 443 | 192.168.2.7 | 142.250.184.206 |
| Mar 7, 2025 23:01:08.248893976 CET | 49688 | 443 | 192.168.2.7 | 142.250.184.206 |
| Mar 7, 2025 23:01:08.250153065 CET | 49688 | 443 | 192.168.2.7 | 142.250.184.206 |
| Mar 7, 2025 23:01:08.250173092 CET | 443 | 49688 | 142.250.184.206 | 192.168.2.7 |
| Mar 7, 2025 23:01:08.250184059 CET | 49688 | 443 | 192.168.2.7 | 142.250.184.206 |
| Mar 7, 2025 23:01:08.250236034 CET | 49688 | 443 | 192.168.2.7 | 142.250.184.206 |
| Mar 7, 2025 23:01:08.276854038 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:08.276896954 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:08.277008057 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:08.277260065 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:08.277276039 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:10.034429073 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:10.034553051 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:10.090795040 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:10.090817928 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:10.091680050 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:10.091747999 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:10.094914913 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:10.136337042 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:12.978322983 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:12.978432894 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:12.985711098 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:12.985819101 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.009984970 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.010097027 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.010111094 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.010145903 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.062169075 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.062289953 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.062298059 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.062326908 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.062356949 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.062362909 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.062376022 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.062417984 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.076847076 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.076931000 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.076937914 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.076977968 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.082914114 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.082968950 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.083007097 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.083049059 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.095477104 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.095551014 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.101691961 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.101747990 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.101753950 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.101787090 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.105040073 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.105086088 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.105091095 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.105129004 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.111548901 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.111634016 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.111639977 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.111681938 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.118176937 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.118272066 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.118278027 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.118316889 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.125081062 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.125258923 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.125287056 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.125475883 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.132082939 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.132169962 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.132178068 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.132224083 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.138751984 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.138833046 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.138839960 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.138900995 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.146414042 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.146509886 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.146517992 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.146562099 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.152786970 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.152915955 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.152925014 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.152997971 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.159363031 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.159444094 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.159457922 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.159511089 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.166178942 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.166316032 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.166321993 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.166393042 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.172983885 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.173085928 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.173108101 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.173170090 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.173207045 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.173327923 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.179717064 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.179775953 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.179820061 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.179867983 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.179899931 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.179997921 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.184365988 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.184437037 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.184443951 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.184488058 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.189131021 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.189201117 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.189207077 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.189280033 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.193835974 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.193906069 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.193914890 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.193967104 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.201319933 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.201391935 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.207501888 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.207580090 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.207587004 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.207664013 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.209047079 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.209095001 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.209106922 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.209148884 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.214812040 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.214883089 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.217798948 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.217855930 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.217928886 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.217972994 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.217978001 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.218039989 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.222531080 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.222594023 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.222609997 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.222657919 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.227344036 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.227421045 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.227474928 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.227524042 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.231797934 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.231903076 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.231910944 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.231986046 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.237368107 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.237447023 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.237579107 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.237632036 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.237679005 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.237728119 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.241347075 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.241417885 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.241466045 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.241528988 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.249154091 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.249300957 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.268405914 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.268476009 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.268492937 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.268508911 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.268524885 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.268567085 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.271449089 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.271501064 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.271509886 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.271553040 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.276019096 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.276073933 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.276081085 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.276124001 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.278598070 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.278667927 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.278675079 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.278728008 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.281900883 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.281948090 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.282051086 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.282095909 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.282102108 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.282157898 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.284497023 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.284553051 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.284564018 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.284606934 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.290066004 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.290147066 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.290154934 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.290184975 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.290210009 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.290216923 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.290234089 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.290260077 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.291445017 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.291493893 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.291502953 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.291546106 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.293961048 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.294013977 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.294022083 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.294065952 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.296520948 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.296587944 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.296596050 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.296636105 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.307548046 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.307627916 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.335514069 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.335603952 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.335619926 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.335671902 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.336416006 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.336461067 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.336467981 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.336513996 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.338423967 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.338474035 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.338479996 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.338526011 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.338534117 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.338584900 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.347927094 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.348022938 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.348295927 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.348346949 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.355011940 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.355072021 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.355081081 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.355122089 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.355910063 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.355956078 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.355966091 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.356004953 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.357779026 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.357825994 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.357865095 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.357918978 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.357924938 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.357966900 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.359641075 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.359720945 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.359770060 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.359813929 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.361507893 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.361548901 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.361557007 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.361603022 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.363903999 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.363961935 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.365432024 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.365475893 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.365482092 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.365524054 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.366437912 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.366480112 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.366486073 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.366528988 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.368304014 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.368362904 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.368369102 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.368411064 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.370153904 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.370220900 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.370227098 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.370275974 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.372184992 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.372226000 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.372231960 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.372267962 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.374543905 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.374588966 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.374596119 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.374638081 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.374645948 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.374686003 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.380614042 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.380686998 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.435079098 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.435251951 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.435285091 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.435336113 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.438746929 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.438836098 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.445492983 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.445590973 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.445606947 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.445657969 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.446540117 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.446602106 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.446630001 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.446681976 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.447937012 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.448009968 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.448117971 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.448170900 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.449697971 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.449750900 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.449788094 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.449835062 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.454456091 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.454531908 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.454576969 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.454627991 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.456564903 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.456639051 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.474463940 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.474524021 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.474539042 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.474582911 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.474591017 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.474638939 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.475075006 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.475121975 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.475142002 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.475188971 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.476459980 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.476507902 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.476515055 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.476553917 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.477792978 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.477853060 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.477890968 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.477936983 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.482033968 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.482085943 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.482093096 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.482131958 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.482152939 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.482193947 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.482215881 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.482264042 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.483609915 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.483654976 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.483778000 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.483824015 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.484771013 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.484819889 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.484920979 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.484968901 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.494333982 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.494452000 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.494690895 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.494754076 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.494841099 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.494885921 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.495155096 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.495203018 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.495243073 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.495296955 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.496296883 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.496341944 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.496612072 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.496656895 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.497919083 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.497970104 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.498023033 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.498090982 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.499346972 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.499408960 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.499449015 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.499500036 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.500891924 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.500952959 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.500984907 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.501033068 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.501072884 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.501121044 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.502347946 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.502429962 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.502453089 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.502522945 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.503462076 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.503540993 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.503575087 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.503637075 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.504895926 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.504977942 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.504988909 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.505036116 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.506200075 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.506258011 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.506289005 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.506329060 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.507610083 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.507673025 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.507699966 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.507751942 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.509078026 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.509135962 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.509167910 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.509215117 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.510490894 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.510551929 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.513438940 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.513503075 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.513557911 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.513612032 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.514256001 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.514308929 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.514347076 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.514394999 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.514453888 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.514503956 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.514547110 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.514594078 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.515733957 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.515810013 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.515835047 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.515882969 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.517079115 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.517127037 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.517165899 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.517230988 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.517254114 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.517306089 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.522077084 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.522152901 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.522166014 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.522218943 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.522284031 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.522341013 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.541126013 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.541157961 CET | 443 | 49689 | 172.217.16.193 | 192.168.2.7 |
| Mar 7, 2025 23:01:13.541172981 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:13.541207075 CET | 49689 | 443 | 192.168.2.7 | 172.217.16.193 |
| Mar 7, 2025 23:01:14.616823912 CET | 49690 | 80 | 192.168.2.7 | 193.122.6.168 |
| Mar 7, 2025 23:01:14.621906042 CET | 80 | 49690 | 193.122.6.168 | 192.168.2.7 |
| Mar 7, 2025 23:01:14.621994019 CET | 49690 | 80 | 192.168.2.7 | 193.122.6.168 |
| Mar 7, 2025 23:01:14.622208118 CET | 49690 | 80 | 192.168.2.7 | 193.122.6.168 |
| Mar 7, 2025 23:01:14.627206087 CET | 80 | 49690 | 193.122.6.168 | 192.168.2.7 |
| Mar 7, 2025 23:01:15.267038107 CET | 80 | 49690 | 193.122.6.168 | 192.168.2.7 |
| Mar 7, 2025 23:01:15.272387028 CET | 49690 | 80 | 192.168.2.7 | 193.122.6.168 |
| Mar 7, 2025 23:01:15.277403116 CET | 80 | 49690 | 193.122.6.168 | 192.168.2.7 |
| Mar 7, 2025 23:01:15.505311012 CET | 80 | 49690 | 193.122.6.168 | 192.168.2.7 |
| Mar 7, 2025 23:01:15.548465014 CET | 49690 | 80 | 192.168.2.7 | 193.122.6.168 |
| Mar 7, 2025 23:01:15.970109940 CET | 49691 | 443 | 192.168.2.7 | 104.21.80.1 |
| Mar 7, 2025 23:01:15.970139027 CET | 443 | 49691 | 104.21.80.1 | 192.168.2.7 |
| Mar 7, 2025 23:01:15.970205069 CET | 49691 | 443 | 192.168.2.7 | 104.21.80.1 |
| Mar 7, 2025 23:01:15.986109018 CET | 49691 | 443 | 192.168.2.7 | 104.21.80.1 |
| Mar 7, 2025 23:01:15.986125946 CET | 443 | 49691 | 104.21.80.1 | 192.168.2.7 |
| Mar 7, 2025 23:01:17.660160065 CET | 443 | 49691 | 104.21.80.1 | 192.168.2.7 |
| Mar 7, 2025 23:01:17.660299063 CET | 49691 | 443 | 192.168.2.7 | 104.21.80.1 |
| Mar 7, 2025 23:01:17.663805008 CET | 49691 | 443 | 192.168.2.7 | 104.21.80.1 |
| Mar 7, 2025 23:01:17.663816929 CET | 443 | 49691 | 104.21.80.1 | 192.168.2.7 |
| Mar 7, 2025 23:01:17.664263010 CET | 443 | 49691 | 104.21.80.1 | 192.168.2.7 |
| Mar 7, 2025 23:01:17.667915106 CET | 49691 | 443 | 192.168.2.7 | 104.21.80.1 |
| Mar 7, 2025 23:01:17.708328962 CET | 443 | 49691 | 104.21.80.1 | 192.168.2.7 |
| Mar 7, 2025 23:01:18.138622999 CET | 443 | 49691 | 104.21.80.1 | 192.168.2.7 |
| Mar 7, 2025 23:01:18.138721943 CET | 443 | 49691 | 104.21.80.1 | 192.168.2.7 |
| Mar 7, 2025 23:01:18.138876915 CET | 49691 | 443 | 192.168.2.7 | 104.21.80.1 |
| Mar 7, 2025 23:01:18.145621061 CET | 49691 | 443 | 192.168.2.7 | 104.21.80.1 |
| Mar 7, 2025 23:01:18.151107073 CET | 49690 | 80 | 192.168.2.7 | 193.122.6.168 |
| Mar 7, 2025 23:01:18.156222105 CET | 80 | 49690 | 193.122.6.168 | 192.168.2.7 |
| Mar 7, 2025 23:01:18.343739986 CET | 80 | 49690 | 193.122.6.168 | 192.168.2.7 |
| Mar 7, 2025 23:01:18.355174065 CET | 49692 | 443 | 192.168.2.7 | 104.21.80.1 |
| Mar 7, 2025 23:01:18.355217934 CET | 443 | 49692 | 104.21.80.1 | 192.168.2.7 |
| Mar 7, 2025 23:01:18.355319023 CET | 49692 | 443 | 192.168.2.7 | 104.21.80.1 |
| Mar 7, 2025 23:01:18.355602980 CET | 49692 | 443 | 192.168.2.7 | 104.21.80.1 |
| Mar 7, 2025 23:01:18.355618000 CET | 443 | 49692 | 104.21.80.1 | 192.168.2.7 |
| Mar 7, 2025 23:01:18.392258883 CET | 49690 | 80 | 192.168.2.7 | 193.122.6.168 |
| Mar 7, 2025 23:01:20.037545919 CET | 443 | 49692 | 104.21.80.1 | 192.168.2.7 |
| Mar 7, 2025 23:01:20.040910959 CET | 49692 | 443 | 192.168.2.7 | 104.21.80.1 |
| Mar 7, 2025 23:01:20.040930033 CET | 443 | 49692 | 104.21.80.1 | 192.168.2.7 |
| Mar 7, 2025 23:01:20.495373011 CET | 443 | 49692 | 104.21.80.1 | 192.168.2.7 |
| Mar 7, 2025 23:01:20.495537996 CET | 443 | 49692 | 104.21.80.1 | 192.168.2.7 |
| Mar 7, 2025 23:01:20.495611906 CET | 49692 | 443 | 192.168.2.7 | 104.21.80.1 |
| Mar 7, 2025 23:01:20.495973110 CET | 49692 | 443 | 192.168.2.7 | 104.21.80.1 |
| Mar 7, 2025 23:01:20.499577999 CET | 49690 | 80 | 192.168.2.7 | 193.122.6.168 |
| Mar 7, 2025 23:01:20.500686884 CET | 49693 | 80 | 192.168.2.7 | 193.122.6.168 |
| Mar 7, 2025 23:01:20.505225897 CET | 80 | 49690 | 193.122.6.168 | 192.168.2.7 |
| Mar 7, 2025 23:01:20.505296946 CET | 49690 | 80 | 192.168.2.7 | 193.122.6.168 |
| Mar 7, 2025 23:01:20.505798101 CET | 80 | 49693 | 193.122.6.168 | 192.168.2.7 |
| Mar 7, 2025 23:01:20.505877018 CET | 49693 | 80 | 192.168.2.7 | 193.122.6.168 |
| Mar 7, 2025 23:01:20.505976915 CET | 49693 | 80 | 192.168.2.7 | 193.122.6.168 |
| Mar 7, 2025 23:01:20.511550903 CET | 80 | 49693 | 193.122.6.168 | 192.168.2.7 |
| Mar 7, 2025 23:01:21.151809931 CET | 80 | 49693 | 193.122.6.168 | 192.168.2.7 |
| Mar 7, 2025 23:01:21.153300047 CET | 49694 | 443 | 192.168.2.7 | 104.21.80.1 |
| Mar 7, 2025 23:01:21.153369904 CET | 443 | 49694 | 104.21.80.1 | 192.168.2.7 |
| Mar 7, 2025 23:01:21.153534889 CET | 49694 | 443 | 192.168.2.7 | 104.21.80.1 |
| Mar 7, 2025 23:01:21.153723955 CET | 49694 | 443 | 192.168.2.7 | 104.21.80.1 |
| Mar 7, 2025 23:01:21.153744936 CET | 443 | 49694 | 104.21.80.1 | 192.168.2.7 |
| Mar 7, 2025 23:01:21.204732895 CET | 49693 | 80 | 192.168.2.7 | 193.122.6.168 |
| Mar 7, 2025 23:01:22.860753059 CET | 443 | 49694 | 104.21.80.1 | 192.168.2.7 |
| Mar 7, 2025 23:01:22.862401962 CET | 49694 | 443 | 192.168.2.7 | 104.21.80.1 |
| Mar 7, 2025 23:01:22.862422943 CET | 443 | 49694 | 104.21.80.1 | 192.168.2.7 |
| Mar 7, 2025 23:01:23.435234070 CET | 443 | 49694 | 104.21.80.1 | 192.168.2.7 |
| Mar 7, 2025 23:01:23.435311079 CET | 443 | 49694 | 104.21.80.1 | 192.168.2.7 |
| Mar 7, 2025 23:01:23.435389042 CET | 49694 | 443 | 192.168.2.7 | 104.21.80.1 |
| Mar 7, 2025 23:01:23.436036110 CET | 49694 | 443 | 192.168.2.7 | 104.21.80.1 |
| Mar 7, 2025 23:01:23.441142082 CET | 49695 | 80 | 192.168.2.7 | 193.122.6.168 |
| Mar 7, 2025 23:01:23.446213007 CET | 80 | 49695 | 193.122.6.168 | 192.168.2.7 |
| Mar 7, 2025 23:01:23.446340084 CET | 49695 | 80 | 192.168.2.7 | 193.122.6.168 |
| Mar 7, 2025 23:01:23.446413994 CET | 49695 | 80 | 192.168.2.7 | 193.122.6.168 |
| Mar 7, 2025 23:01:23.451438904 CET | 80 | 49695 | 193.122.6.168 | 192.168.2.7 |
| Mar 7, 2025 23:01:24.090101004 CET | 80 | 49695 | 193.122.6.168 | 192.168.2.7 |
| Mar 7, 2025 23:01:24.091651917 CET | 49696 | 443 | 192.168.2.7 | 104.21.80.1 |
| Mar 7, 2025 23:01:24.091697931 CET | 443 | 49696 | 104.21.80.1 | 192.168.2.7 |
| Mar 7, 2025 23:01:24.091778040 CET | 49696 | 443 | 192.168.2.7 | 104.21.80.1 |
| Mar 7, 2025 23:01:24.092052937 CET | 49696 | 443 | 192.168.2.7 | 104.21.80.1 |
| Mar 7, 2025 23:01:24.092070103 CET | 443 | 49696 | 104.21.80.1 | 192.168.2.7 |
| Mar 7, 2025 23:01:24.142153978 CET | 49695 | 80 | 192.168.2.7 | 193.122.6.168 |
| Mar 7, 2025 23:01:25.794125080 CET | 443 | 49696 | 104.21.80.1 | 192.168.2.7 |
| Mar 7, 2025 23:01:25.797005892 CET | 49696 | 443 | 192.168.2.7 | 104.21.80.1 |
| Mar 7, 2025 23:01:25.797023058 CET | 443 | 49696 | 104.21.80.1 | 192.168.2.7 |
| Mar 7, 2025 23:01:26.301863909 CET | 443 | 49696 | 104.21.80.1 | 192.168.2.7 |
| Mar 7, 2025 23:01:26.301944971 CET | 443 | 49696 | 104.21.80.1 | 192.168.2.7 |
| Mar 7, 2025 23:01:26.302311897 CET | 49696 | 443 | 192.168.2.7 | 104.21.80.1 |
| Mar 7, 2025 23:01:26.302995920 CET | 49696 | 443 | 192.168.2.7 | 104.21.80.1 |
| Mar 7, 2025 23:01:26.310846090 CET | 49695 | 80 | 192.168.2.7 | 193.122.6.168 |
| Mar 7, 2025 23:01:26.311953068 CET | 49697 | 80 | 192.168.2.7 | 193.122.6.168 |
| Mar 7, 2025 23:01:26.316086054 CET | 80 | 49695 | 193.122.6.168 | 192.168.2.7 |
| Mar 7, 2025 23:01:26.316951990 CET | 80 | 49697 | 193.122.6.168 | 192.168.2.7 |
| Mar 7, 2025 23:01:26.317024946 CET | 49695 | 80 | 192.168.2.7 | 193.122.6.168 |
| Mar 7, 2025 23:01:26.317056894 CET | 49697 | 80 | 192.168.2.7 | 193.122.6.168 |
| Mar 7, 2025 23:01:26.317178965 CET | 49697 | 80 | 192.168.2.7 | 193.122.6.168 |
| Mar 7, 2025 23:01:26.322225094 CET | 80 | 49697 | 193.122.6.168 | 192.168.2.7 |
| Mar 7, 2025 23:01:26.973820925 CET | 80 | 49697 | 193.122.6.168 | 192.168.2.7 |
| Mar 7, 2025 23:01:26.975218058 CET | 49698 | 443 | 192.168.2.7 | 104.21.80.1 |
| Mar 7, 2025 23:01:26.975352049 CET | 443 | 49698 | 104.21.80.1 | 192.168.2.7 |
| Mar 7, 2025 23:01:26.975483894 CET | 49698 | 443 | 192.168.2.7 | 104.21.80.1 |
| Mar 7, 2025 23:01:26.975773096 CET | 49698 | 443 | 192.168.2.7 | 104.21.80.1 |
| Mar 7, 2025 23:01:26.975809097 CET | 443 | 49698 | 104.21.80.1 | 192.168.2.7 |
| Mar 7, 2025 23:01:27.017177105 CET | 49697 | 80 | 192.168.2.7 | 193.122.6.168 |
| Mar 7, 2025 23:01:28.799516916 CET | 443 | 49698 | 104.21.80.1 | 192.168.2.7 |
| Mar 7, 2025 23:01:28.845278978 CET | 49698 | 443 | 192.168.2.7 | 104.21.80.1 |
| Mar 7, 2025 23:01:30.701272011 CET | 49698 | 443 | 192.168.2.7 | 104.21.80.1 |
| Mar 7, 2025 23:01:30.701358080 CET | 443 | 49698 | 104.21.80.1 | 192.168.2.7 |
| Mar 7, 2025 23:01:31.340948105 CET | 443 | 49698 | 104.21.80.1 | 192.168.2.7 |
| Mar 7, 2025 23:01:31.341042995 CET | 443 | 49698 | 104.21.80.1 | 192.168.2.7 |
| Mar 7, 2025 23:01:31.341202021 CET | 49698 | 443 | 192.168.2.7 | 104.21.80.1 |
| Mar 7, 2025 23:01:31.341538906 CET | 49698 | 443 | 192.168.2.7 | 104.21.80.1 |
| Mar 7, 2025 23:01:31.344453096 CET | 49697 | 80 | 192.168.2.7 | 193.122.6.168 |
| Mar 7, 2025 23:01:31.345396042 CET | 49699 | 80 | 192.168.2.7 | 193.122.6.168 |
| Mar 7, 2025 23:01:31.349733114 CET | 80 | 49697 | 193.122.6.168 | 192.168.2.7 |
| Mar 7, 2025 23:01:31.349781036 CET | 49697 | 80 | 192.168.2.7 | 193.122.6.168 |
| Mar 7, 2025 23:01:31.350502014 CET | 80 | 49699 | 193.122.6.168 | 192.168.2.7 |
| Mar 7, 2025 23:01:31.350569010 CET | 49699 | 80 | 192.168.2.7 | 193.122.6.168 |
| Mar 7, 2025 23:01:31.350621939 CET | 49699 | 80 | 192.168.2.7 | 193.122.6.168 |
| Mar 7, 2025 23:01:31.355721951 CET | 80 | 49699 | 193.122.6.168 | 192.168.2.7 |
| Mar 7, 2025 23:01:32.002465963 CET | 80 | 49699 | 193.122.6.168 | 192.168.2.7 |
| Mar 7, 2025 23:01:32.048345089 CET | 49699 | 80 | 192.168.2.7 | 193.122.6.168 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Mar 7, 2025 23:01:05.262655020 CET | 55737 | 53 | 192.168.2.7 | 1.1.1.1 |
| Mar 7, 2025 23:01:05.325784922 CET | 53 | 55737 | 1.1.1.1 | 192.168.2.7 |
| Mar 7, 2025 23:01:08.269037962 CET | 61662 | 53 | 192.168.2.7 | 1.1.1.1 |
| Mar 7, 2025 23:01:08.276118040 CET | 53 | 61662 | 1.1.1.1 | 192.168.2.7 |
| Mar 7, 2025 23:01:14.604863882 CET | 52364 | 53 | 192.168.2.7 | 1.1.1.1 |
| Mar 7, 2025 23:01:14.612631083 CET | 53 | 52364 | 1.1.1.1 | 192.168.2.7 |
| Mar 7, 2025 23:01:15.957664013 CET | 55040 | 53 | 192.168.2.7 | 1.1.1.1 |
| Mar 7, 2025 23:01:15.966588974 CET | 53 | 55040 | 1.1.1.1 | 192.168.2.7 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Mar 7, 2025 23:01:05.262655020 CET | 192.168.2.7 | 1.1.1.1 | 0xbc53 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Mar 7, 2025 23:01:08.269037962 CET | 192.168.2.7 | 1.1.1.1 | 0x3d7f | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Mar 7, 2025 23:01:14.604863882 CET | 192.168.2.7 | 1.1.1.1 | 0x811d | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Mar 7, 2025 23:01:15.957664013 CET | 192.168.2.7 | 1.1.1.1 | 0x65de | Standard query (0) | A (IP address) | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Mar 7, 2025 23:01:05.325784922 CET | 1.1.1.1 | 192.168.2.7 | 0xbc53 | No error (0) | 142.250.184.206 | A (IP address) | IN (0x0001) | false | ||
| Mar 7, 2025 23:01:08.276118040 CET | 1.1.1.1 | 192.168.2.7 | 0x3d7f | No error (0) | 172.217.16.193 | A (IP address) | IN (0x0001) | false | ||
| Mar 7, 2025 23:01:14.612631083 CET | 1.1.1.1 | 192.168.2.7 | 0x811d | No error (0) | checkip.dyndns.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Mar 7, 2025 23:01:14.612631083 CET | 1.1.1.1 | 192.168.2.7 | 0x811d | No error (0) | 193.122.6.168 | A (IP address) | IN (0x0001) | false | ||
| Mar 7, 2025 23:01:14.612631083 CET | 1.1.1.1 | 192.168.2.7 | 0x811d | No error (0) | 193.122.130.0 | A (IP address) | IN (0x0001) | false | ||
| Mar 7, 2025 23:01:14.612631083 CET | 1.1.1.1 | 192.168.2.7 | 0x811d | No error (0) | 158.101.44.242 | A (IP address) | IN (0x0001) | false | ||
| Mar 7, 2025 23:01:14.612631083 CET | 1.1.1.1 | 192.168.2.7 | 0x811d | No error (0) | 132.226.247.73 | A (IP address) | IN (0x0001) | false | ||
| Mar 7, 2025 23:01:14.612631083 CET | 1.1.1.1 | 192.168.2.7 | 0x811d | No error (0) | 132.226.8.169 | A (IP address) | IN (0x0001) | false | ||
| Mar 7, 2025 23:01:15.966588974 CET | 1.1.1.1 | 192.168.2.7 | 0x65de | No error (0) | 104.21.80.1 | A (IP address) | IN (0x0001) | false | ||
| Mar 7, 2025 23:01:15.966588974 CET | 1.1.1.1 | 192.168.2.7 | 0x65de | No error (0) | 104.21.16.1 | A (IP address) | IN (0x0001) | false | ||
| Mar 7, 2025 23:01:15.966588974 CET | 1.1.1.1 | 192.168.2.7 | 0x65de | No error (0) | 104.21.32.1 | A (IP address) | IN (0x0001) | false | ||
| Mar 7, 2025 23:01:15.966588974 CET | 1.1.1.1 | 192.168.2.7 | 0x65de | No error (0) | 104.21.64.1 | A (IP address) | IN (0x0001) | false | ||
| Mar 7, 2025 23:01:15.966588974 CET | 1.1.1.1 | 192.168.2.7 | 0x65de | No error (0) | 104.21.112.1 | A (IP address) | IN (0x0001) | false | ||
| Mar 7, 2025 23:01:15.966588974 CET | 1.1.1.1 | 192.168.2.7 | 0x65de | No error (0) | 104.21.48.1 | A (IP address) | IN (0x0001) | false | ||
| Mar 7, 2025 23:01:15.966588974 CET | 1.1.1.1 | 192.168.2.7 | 0x65de | No error (0) | 104.21.96.1 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.7 | 49690 | 193.122.6.168 | 80 | 2760 | C:\Users\user\Desktop\BtCQu5APhK.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Mar 7, 2025 23:01:14.622208118 CET | 151 | OUT | |
| Mar 7, 2025 23:01:15.267038107 CET | 273 | IN | |
| Mar 7, 2025 23:01:15.272387028 CET | 127 | OUT | |
| Mar 7, 2025 23:01:15.505311012 CET | 273 | IN | |
| Mar 7, 2025 23:01:18.151107073 CET | 127 | OUT | |
| Mar 7, 2025 23:01:18.343739986 CET | 273 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.7 | 49693 | 193.122.6.168 | 80 | 2760 | C:\Users\user\Desktop\BtCQu5APhK.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Mar 7, 2025 23:01:20.505976915 CET | 127 | OUT | |
| Mar 7, 2025 23:01:21.151809931 CET | 273 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 2 | 192.168.2.7 | 49695 | 193.122.6.168 | 80 | 2760 | C:\Users\user\Desktop\BtCQu5APhK.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Mar 7, 2025 23:01:23.446413994 CET | 151 | OUT | |
| Mar 7, 2025 23:01:24.090101004 CET | 273 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 3 | 192.168.2.7 | 49697 | 193.122.6.168 | 80 | 2760 | C:\Users\user\Desktop\BtCQu5APhK.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Mar 7, 2025 23:01:26.317178965 CET | 151 | OUT | |
| Mar 7, 2025 23:01:26.973820925 CET | 273 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port |
|---|---|---|---|---|
| 4 | 192.168.2.7 | 49699 | 193.122.6.168 | 80 |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Mar 7, 2025 23:01:31.350621939 CET | 151 | OUT | |
| Mar 7, 2025 23:01:32.002465963 CET | 273 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.7 | 49688 | 142.250.184.206 | 443 | 2760 | C:\Users\user\Desktop\BtCQu5APhK.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-03-07 22:01:07 UTC | 216 | OUT | |
| 2025-03-07 22:01:08 UTC | 1610 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.7 | 49689 | 172.217.16.193 | 443 | 2760 | C:\Users\user\Desktop\BtCQu5APhK.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-03-07 22:01:10 UTC | 258 | OUT | |
| 2025-03-07 22:01:12 UTC | 5014 | IN | |
| 2025-03-07 22:01:12 UTC | 5014 | IN | |
| 2025-03-07 22:01:13 UTC | 4668 | IN | |
| 2025-03-07 22:01:13 UTC | 1378 | IN | |
| 2025-03-07 22:01:13 UTC | 1378 | IN | |
| 2025-03-07 22:01:13 UTC | 1378 | IN | |
| 2025-03-07 22:01:13 UTC | 1378 | IN | |
| 2025-03-07 22:01:13 UTC | 1378 | IN | |
| 2025-03-07 22:01:13 UTC | 1378 | IN | |
| 2025-03-07 22:01:13 UTC | 1378 | IN | |
| 2025-03-07 22:01:13 UTC | 1378 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 2 | 192.168.2.7 | 49691 | 104.21.80.1 | 443 | 2760 | C:\Users\user\Desktop\BtCQu5APhK.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-03-07 22:01:17 UTC | 85 | OUT | |
| 2025-03-07 22:01:18 UTC | 852 | IN | |
| 2025-03-07 22:01:18 UTC | 362 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 3 | 192.168.2.7 | 49692 | 104.21.80.1 | 443 | 2760 | C:\Users\user\Desktop\BtCQu5APhK.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-03-07 22:01:20 UTC | 61 | OUT | |
| 2025-03-07 22:01:20 UTC | 861 | IN | |
| 2025-03-07 22:01:20 UTC | 362 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 4 | 192.168.2.7 | 49694 | 104.21.80.1 | 443 | 2760 | C:\Users\user\Desktop\BtCQu5APhK.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-03-07 22:01:22 UTC | 85 | OUT | |
| 2025-03-07 22:01:23 UTC | 857 | IN | |
| 2025-03-07 22:01:23 UTC | 362 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 5 | 192.168.2.7 | 49696 | 104.21.80.1 | 443 | 2760 | C:\Users\user\Desktop\BtCQu5APhK.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-03-07 22:01:25 UTC | 85 | OUT | |
| 2025-03-07 22:01:26 UTC | 855 | IN | |
| 2025-03-07 22:01:26 UTC | 362 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 6 | 192.168.2.7 | 49698 | 104.21.80.1 | 443 | 2760 | C:\Users\user\Desktop\BtCQu5APhK.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-03-07 22:01:30 UTC | 85 | OUT | |
| 2025-03-07 22:01:31 UTC | 860 | IN | |
| 2025-03-07 22:01:31 UTC | 362 | IN |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
| Target ID: | 0 |
| Start time: | 16:59:21 |
| Start date: | 07/03/2025 |
| Path: | C:\Users\user\Desktop\BtCQu5APhK.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x400000 |
| File size: | 1'053'154 bytes |
| MD5 hash: | C80150383AF692D52BC33E7857B5724D |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Reputation: | low |
| Has exited: | true |
| Target ID: | 8 |
| Start time: | 17:00:42 |
| Start date: | 07/03/2025 |
| Path: | C:\Users\user\Desktop\BtCQu5APhK.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x400000 |
| File size: | 1'053'154 bytes |
| MD5 hash: | C80150383AF692D52BC33E7857B5724D |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Reputation: | low |
| Has exited: | false |