Edit tour
Windows
Analysis Report
MNLS4PjscF.exe
Overview
General Information
| Sample name: | MNLS4PjscF.exerenamed because original name is a hash value |
| Original sample name: | 2baf2894d28fffff439499fbcd6b92714febd8ea39c0850f60f4575adedef15b.exe |
| Analysis ID: | 1632411 |
| MD5: | 7730242b95171f0ccb03e28bf8f5056b |
| SHA1: | a5348671e4b92b3c64086abe6fced83f251e692c |
| SHA256: | 2baf2894d28fffff439499fbcd6b92714febd8ea39c0850f60f4575adedef15b |
| Tags: | AdwareGenericexeuser-adrian__luca |
| Infos: |  |
 | |
Detection
GuLoader
| Score: | 84 |
| Range: | 0 - 100 |
| Confidence: | 100% |
Signatures
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected GuLoader
Joe Sandbox ML detected suspicious sample
Switches to a custom stack to bypass stack traces
Tries to detect virtualization through RDTSC time measurements
Abnormal high CPU Usage
Contains functionality for read data from the clipboard
Contains functionality to dynamically determine API calls
Contains functionality to shutdown / reboot the system
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Drops PE files
Found dropped PE file which has not been started or loaded
Found potential string decryption / allocating functions
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Stores files to the Windows start menu directory
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Classification
- System is w10x64
MNLS4PjscF.exe (PID: 7276 cmdline: "C:\Users\ user\Deskt op\MNLS4Pj scF.exe" MD5: 7730242B95171F0CCB03E28BF8F5056B) - MNLS4PjscF.exe (PID: 5684 cmdline:
"C:\Users\ user\Deskt op\MNLS4Pj scF.exe" MD5: 7730242B95171F0CCB03E28BF8F5056B)
- cleanup
| Name | Description | Attribution | Blogpost URLs | Link |
|---|---|---|---|---|
| CloudEyE, GuLoader | CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored. | No Attribution |
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_GuLoader_2 | Yara detected GuLoader | Joe Security | ||
| JoeSecurity_GuLoader_3 | Yara detected GuLoader | Joe Security |
⊘No Sigma rule has matched
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2025-03-07T23:30:47.020893+0100 | 2803270 | 2 | Potentially Bad Traffic | 192.168.2.7 | 49688 | 142.250.186.142 | 443 | TCP |
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | Avira: | ||
| Source: | Virustotal: | Perma Link | ||
| Source: | ReversingLabs: | |||
| Source: | Integrated Neural Analysis Model: | ||
| Source: | Static PE information: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Code function: | 0_2_0040276E | |
| Source: | Code function: | 0_2_00405770 | |
| Source: | Code function: | 0_2_0040622B | |
| Source: | Code function: | 8_2_0040276E | |
| Source: | Code function: | 8_2_00405770 | |
| Source: | Code function: | 8_2_0040622B | |
| Source: | JA3 fingerprint: | ||
| Source: | Suricata IDS: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Code function: | 0_2_004052D1 | |
| Source: | Process Stats: | ||
| Source: | Code function: | 0_2_00403358 | |
| Source: | Code function: | 8_2_00403358 | |
| Source: | File created: | Jump to behavior | ||
| Source: | Code function: | 0_2_00404B0E | |
| Source: | Code function: | 0_2_0040653D | |
| Source: | Code function: | 8_2_00404B0E | |
| Source: | Code function: | 8_2_0040653D | |
| Source: | Code function: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Static PE information: | ||
| Source: | Classification label: | ||
| Source: | Code function: | 0_2_004045C8 | |
| Source: | Code function: | 0_2_0040206A | |
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Virustotal: | ||
| Source: | ReversingLabs: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Key value queried: | Jump to behavior | ||
| Source: | File written: | Jump to behavior | ||
Data Obfuscation | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | Code function: | 0_2_00406252 | |
| Source: | Code function: | 0_2_10002DDE | |
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
Malware Analysis System Evasion | |
|---|
| Source: | API/Special instruction interceptor: | ||
| Source: | API/Special instruction interceptor: | ||
| Source: | RDTSC instruction interceptor: | ||
| Source: | RDTSC instruction interceptor: | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Last function: | ||
| Source: | Code function: | 0_2_0040276E | |
| Source: | Code function: | 0_2_00405770 | |
| Source: | Code function: | 0_2_0040622B | |
| Source: | Code function: | 8_2_0040276E | |
| Source: | Code function: | 8_2_00405770 | |
| Source: | Code function: | 8_2_0040622B | |
| Source: | Binary or memory string: | ||
| Source: | API call chain: | graph_0-4511 | ||
| Source: | API call chain: | graph_0-4516 | ||
| Source: | Code function: | 0_2_00406252 | |
| Source: | Process created: | Jump to behavior | ||
| Source: | Code function: | 0_2_00405F0A | |
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | 1 Native API | 1 Registry Run Keys / Startup Folder | 11 Process Injection | 11 Masquerading | OS Credential Dumping | 21 Security Software Discovery | Remote Services | 1 Archive Collected Data | 11 Encrypted Channel | Exfiltration Over Other Network Medium | 1 System Shutdown/Reboot |
| Credentials | Domains | Default Accounts | Scheduled Task/Job | 1 DLL Side-Loading | 1 Registry Run Keys / Startup Folder | 1 Virtualization/Sandbox Evasion | LSASS Memory | 1 Virtualization/Sandbox Evasion | Remote Desktop Protocol | 1 Clipboard Data | 3 Ingress Tool Transfer | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | 1 DLL Side-Loading | 11 Process Injection | Security Account Manager | 3 File and Directory Discovery | SMB/Windows Admin Shares | Data from Network Shared Drive | 3 Non-Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | 1 Deobfuscate/Decode Files or Information | NTDS | 23 System Information Discovery | Distributed Component Object Model | Input Capture | 14 Application Layer Protocol | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | Network Logon Script | 2 Obfuscated Files or Information | LSA Secrets | Internet Connection Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
| Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | 1 DLL Side-Loading | Cached Domain Credentials | Wi-Fi Discovery | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 67% | Virustotal | Browse | ||
| 61% | ReversingLabs | Win32.Spyware.Snakekeylogger | ||
| 100% | Avira | TR/AD.NsisInject.vqxpt |
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | ReversingLabs |
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| drive.google.com | 142.250.186.142 | true | false | high | |
| drive.usercontent.google.com | 142.250.186.33 | true | false | high |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 142.250.186.142 | drive.google.com | United States | 15169 | GOOGLEUS | false | |
| 142.250.186.33 | drive.usercontent.google.com | United States | 15169 | GOOGLEUS | false |
| Joe Sandbox version: | 42.0.0 Malachite |
| Analysis ID: | 1632411 |
| Start date and time: | 2025-03-07 23:28:28 +01:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 6m 40s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 11 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | MNLS4PjscF.exerenamed because original name is a hash value |
| Original Sample Name: | 2baf2894d28fffff439499fbcd6b92714febd8ea39c0850f60f4575adedef15b.exe |
| Detection: | MAL |
| Classification: | mal84.troj.evad.winEXE@3/30@2/2 |
| EGA Information: |
|
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): MpCmdRun.exe, sppsvc.exe, SgrmBroker.exe, conhost.exe, svchost.exe
- Excluded IPs from analysis (whitelisted): 23.60.203.209
- Excluded domains from analysis (whitelisted): fs.microsoft.com, ctldl.windowsupdate.com, c.pki.goog
- Execution Graph export aborted for target MNLS4PjscF.exe, PID 5684 because there are no executed function
- Not all processes where analyzed, report is missing behavior information
- Report size getting too big, too many NtOpenKeyEx calls found.
- Report size getting too big, too many NtQueryValueKey calls found.
- Report size getting too big, too many NtSetInformationFile calls found.
| Time | Type | Description |
|---|---|---|
| 17:30:48 | API Interceptor |
⊘No context
⊘No context
⊘No context
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 37f463bf4616ecd445d4a1937da06e19 | Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| |
| Get hash | malicious | DarkCloud | Browse |
| ||
| Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
| Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
| Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
| Get hash | malicious | GuLoader | Browse |
| ||
| Get hash | malicious | GuLoader | Browse |
| ||
| Get hash | malicious | GuLoader | Browse |
| ||
| Get hash | malicious | GuLoader | Browse |
| ||
| Get hash | malicious | GuLoader, Snake Keylogger | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| C:\Users\user\AppData\Local\Temp\nsxBF78.tmp\System.dll | Get hash | malicious | GuLoader, Snake Keylogger | Browse | ||
| Get hash | malicious | GuLoader, Snake Keylogger | Browse | |||
| Get hash | malicious | GuLoader, Snake Keylogger | Browse | |||
| Get hash | malicious | FormBook, GuLoader | Browse | |||
| Get hash | malicious | FormBook, GuLoader | Browse | |||
| Get hash | malicious | GuLoader | Browse | |||
| Get hash | malicious | GuLoader | Browse | |||
| Get hash | malicious | Remcos, GuLoader | Browse | |||
| Get hash | malicious | GuLoader, MassLogger RAT | Browse | |||
| Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| Process: | C:\Users\user\Desktop\MNLS4PjscF.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 33 |
| Entropy (8bit): | 4.33197669498491 |
| Encrypted: | false |
| SSDEEP: | 3:U4ooQGRDWh:hooQh |
| MD5: | 340AD700CF73B73EA2313C044D40EA9A |
| SHA1: | 9B90CC3147D140FA936E308C2C320BDC385DA93A |
| SHA-256: | 55A2B8F5EF1D17023FD8245E69830CC961C0CE629EDDC7AC1043C288CB3915B5 |
| SHA-512: | 4B31D10B80AE71197AC367C868569949224A4CD542BF0E9C188B816348EC8958F952525F939C827BDDC8610F268DD12E310D6D2FC99071C741B3A38E062542B4 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Users\user\Desktop\MNLS4PjscF.exe |
| File Type: | |
| Category: | modified |
| Size (bytes): | 47 |
| Entropy (8bit): | 4.628848957968553 |
| Encrypted: | false |
| SSDEEP: | 3:YOm45GXQLQIfLBJXmgxv:5TGXQkIP2I |
| MD5: | B895D576D6637A778B387B2FCA0F56EC |
| SHA1: | E78D2BE4D94673D612C16D29C330BB0C78778429 |
| SHA-256: | BFEC1E97ED5D34825521D60B98986D1564CD159B4D1F9569EAE4C3464D2F5C47 |
| SHA-512: | B4A771D1B517A2776BA440F79F168306C244DF1A6DE1966313157154D8D52BEAD8131B95F846C2F55C15382E04284FFFC6CF6ABF3F6FCFCB259DF2EA58D769E5 |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| Preview: |
| Process: | C:\Users\user\Desktop\MNLS4PjscF.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2129096 |
| Entropy (8bit): | 5.480154099747067 |
| Encrypted: | false |
| SSDEEP: | 49152:vn9caFqd9Dv9YpvkOtFu0mBFmvYFe0m40mD0mbXCP:v9caI9Ypv5twRrgoTU |
| MD5: | 1A31BCE4E868014E605CCB1ED43E6388 |
| SHA1: | C7EA246EB669762AEAE3E64626936ECF9168D711 |
| SHA-256: | A9AECDB8CE4802482940AA6C14C5BD04E2EF983FAE29ECC9197B170518ED5DD6 |
| SHA-512: | 4D3EAE0E86E6ECF6369D188A021C71F11E09F682F5EEBBDDF0FA628FE052690ACB7AE4372753221FA6C6E90C592AAD2CE1975E85150D88859B0D74E4E33091C2 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Users\user\Desktop\MNLS4PjscF.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 52 |
| Entropy (8bit): | 4.0914493934217315 |
| Encrypted: | false |
| SSDEEP: | 3:sBa99k1NoCFOn:KankVg |
| MD5: | 5D04A35D3950677049C7A0CF17E37125 |
| SHA1: | CAFDD49A953864F83D387774B39B2657A253470F |
| SHA-256: | A9493973DD293917F3EBB932AB255F8CAC40121707548DE100D5969956BB1266 |
| SHA-512: | C7B1AFD95299C0712BDBC67F9D2714926D6EC9F71909AF615AFFC400D8D2216AB76F6AC35057088836435DE36E919507E1B25BE87B07C911083F964EB67E003B |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| Preview: |
| Process: | C:\Users\user\Desktop\MNLS4PjscF.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 56 |
| Entropy (8bit): | 4.264383994261771 |
| Encrypted: | false |
| SSDEEP: | 3:sAAEVvjsNXKwL84n:fLsXD |
| MD5: | FFE600086504D94D0E7E2F8A331F5D85 |
| SHA1: | 1FB3FA48BFA30F04FC957C05A90C824FDB38F048 |
| SHA-256: | EB6C41469BC87CBE962DB30D4BC3772CC2EDFA9D216E51F5E93A06A51FBAB86D |
| SHA-512: | 42D46FC0C26A4ADC5EEBB4B129378F36CA6A91434D6060B11F22A209F20B840F28681A62C22D751142019F746C131DA16578FB8687C52DE0706E6BCBE51417D2 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Users\user\Desktop\MNLS4PjscF.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 74 |
| Entropy (8bit): | 3.9637832956585757 |
| Encrypted: | false |
| SSDEEP: | 3:sRQE1wFEt/ijNJyI3dj2+n:aQEGiwh3D |
| MD5: | 16D513397F3C1F8334E8F3E4FC49828F |
| SHA1: | 4EE15AFCA81CA6A13AF4E38240099B730D6931F0 |
| SHA-256: | D3C781A1855C8A70F5ACA88D9E2C92AFFFA80541334731F62CAA9494AA8A0C36 |
| SHA-512: | 4A350B790FDD2FE957E9AB48D5969B217AB19FC7F93F3774F1121A5F140FF9A9EAAA8FA30E06A9EF40AD776E698C2E65A05323C3ADF84271DA1716E75F5183C3 |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| Preview: |
| Process: | C:\Users\user\Desktop\MNLS4PjscF.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 60 |
| Entropy (8bit): | 4.52973742089034 |
| Encrypted: | false |
| SSDEEP: | 3:sEMBQEJkJVEjXTQXK5xQoXUn:BXUxvUn |
| MD5: | D4453567A455B741556C4DE15C9F6446 |
| SHA1: | 410FD7474030E724F52D4E30F5F12027CE4869DB |
| SHA-256: | A1FA0DCDBE660BE838CD82F50BEA1C422988CDD527009F26B4F3DD314106C46E |
| SHA-512: | 45247F2AC6631E83BF7BCC8AD56C775689E8A4A1E18C3355B0A02AE9498854CA71033396C9BD6570833342C6CFAF1C4427D064E8515DA383BBF04A25E347E0EE |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\MNLS4PjscF.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 30 |
| Entropy (8bit): | 4.256564762130954 |
| Encrypted: | false |
| SSDEEP: | 3:DyWgLQIfLBJXmgU:mkIP25 |
| MD5: | F15BFDEBB2DF02D02C8491BDE1B4E9BD |
| SHA1: | 93BD46F57C3316C27CAD2605DDF81D6C0BDE9301 |
| SHA-256: | C87F2FF45BB530577FB8856DF1760EDAF1060AE4EE2934B17FDD21B7D116F043 |
| SHA-512: | 1757ED4AE4D47D0C839511C18BE5D75796224D4A3049E2D8853650ACE2C5057C42040DE6450BF90DD4969862E9EBB420CD8A34F8DD9C970779ED2E5459E8F2F1 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\MNLS4PjscF.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 11264 |
| Entropy (8bit): | 5.813979271513012 |
| Encrypted: | false |
| SSDEEP: | 192:eF2HS5ih/7i00dWz9T7PH6lOFcQMI5+Vw+bPFomi7dJWsP:rSUmlw9T7DmnI5+N273FP |
| MD5: | 7399323923E3946FE9140132AC388132 |
| SHA1: | 728257D06C452449B1241769B459F091AABCFFC5 |
| SHA-256: | 5A1C20A3E2E2EB182976977669F2C5D9F3104477E98F74D69D2434E79B92FDC3 |
| SHA-512: | D6F28BA761351F374AE007C780BE27758AEA7B9F998E2A88A542EEDE459D18700ADFFE71ABCB52B8A8C00695EFB7CCC280175B5EEB57CA9A645542EDFABB64F1 |
| Malicious: | false |
| Antivirus: |
|
| Joe Sandbox View: |
|
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Galmandsvrks.For231
Download File
| Process: | C:\Users\user\Desktop\MNLS4PjscF.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 38720 |
| Entropy (8bit): | 4.559800120228938 |
| Encrypted: | false |
| SSDEEP: | 768:mEnxVfKxpxr2nSuTYOn3SNpkhXQeclp7u6+Y7wNBJ:meVCd2LsOIk+TDuNd |
| MD5: | 69B437B47D51431F4999052D686B3C9D |
| SHA1: | 02ACE3384FFE99470060A7DEE66F123344A47787 |
| SHA-256: | CFC48C38571EAD57A568AA56565B39BF26B0539457EBF70A044133EDCF7EC411 |
| SHA-512: | A43EB73588DFCE4A04E2896EC347E00BCE2F5F145BFCA8D7B2EC99B9E43E5E0165A7A2BC9D333BC1D71396F726A8F2CA0805369D65B0C47121CBEE3A78D42F18 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Litiscontest.jpg
Download File
| Process: | C:\Users\user\Desktop\MNLS4PjscF.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 116646 |
| Entropy (8bit): | 7.9723106052665536 |
| Encrypted: | false |
| SSDEEP: | 3072:Cq3EK4+CecuNPZ23e6at5JG7QXnv0tD6nI:Cq3PRCeTZ1tspwI |
| MD5: | 2400D62D49391C7874C3DF868B3399ED |
| SHA1: | F5AF15AAE9EE9BD00F459D67EBBCDB8E48B6D4A3 |
| SHA-256: | C400565DCC08D080953E47902F2946C687C4F814C3BA51E0D4E63E4242112566 |
| SHA-512: | 7CE7C0DAA1B222DD67D6292F9FE3A9BDFB0782C790D817C0B4B348B8D8AB7B5630D8DBFB953ED55093DFB2DCABF8FBB257A4ED666B2145D8946E0D2C082DB70B |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Skjoldbrusks.Moe
Download File
| Process: | C:\Users\user\Desktop\MNLS4PjscF.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 439122 |
| Entropy (8bit): | 7.092576485156292 |
| Encrypted: | false |
| SSDEEP: | 12288:vnLQmOSHmgIcmz2F9U1fLjtPNpTZh9Ys8IeG:vn0uHBrmaF9U1f3NNp9h9YpvG |
| MD5: | 1CBF6CC43016032CFCCB35CCFA3ED06F |
| SHA1: | 1B7554E0945B28AAF2B7C872EE9727C40E2F2211 |
| SHA-256: | 65FCE8874CD3297D1FAD0BD26093EC26A392D068F1372E963BFF2F5A5F705B88 |
| SHA-512: | 0C13854187B62E62BF9E61F1060B7F823EEA7D6C5C28ADC3410FDD6EA15906B369EA613183C5C3F6226E6C895FF0830E222C138014BED83423854677D2571595 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Stalkingly\Orarian\tinkle.jpg
Download File
| Process: | C:\Users\user\Desktop\MNLS4PjscF.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 10701 |
| Entropy (8bit): | 7.839639743360956 |
| Encrypted: | false |
| SSDEEP: | 192:Lzr3FqEXWDs3kosNACUJ2PDTHjHzCM4guHBTGgAuihMBvUjhIaRTHO:3r3FqCd3Bsy1IPDTDebgkTG1XNHO |
| MD5: | 6AB549CF24DE4802D3806218FDC48906 |
| SHA1: | DADA9FCA4EC7121494CC70B3E7A2018E0F8116CA |
| SHA-256: | D484ED1BD415EC1F924CA80A2B8EBD60FF02998A3AD3028145C75900F51F19DF |
| SHA-512: | FDB7BD49B53E243FBDD3FF6613BDC0F47E6ACBE378EC9599263393B121395DCA0B23D978B7029F058B5AEBE4264EB356C945C0EB1AB00B3D6A3E75EE6D4D8651 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Stalkingly\Orarian\unagitatedness.txt
Download File
| Process: | C:\Users\user\Desktop\MNLS4PjscF.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 355 |
| Entropy (8bit): | 4.365173801202148 |
| Encrypted: | false |
| SSDEEP: | 6:a33GWsurYzIbhGvPiUWrFArTWzgVJ86CcE6LpA6rMrLGbGVPoHknd3TFKA8iWFzK:amN9C0vPQqrqsj86Cck6kVPoEnFweWKp |
| MD5: | 52728264A79BB126BC05A9339A806437 |
| SHA1: | 031F624DC90E451583A740F03B0432F63FB472DE |
| SHA-256: | 8D23AFDA0BB6BFD4399AF4AEBFAA8196644DCD468D1E6705C2388E7DB49F8D4A |
| SHA-512: | EFC41C3E278119CFEDBC039153FE6374C5DB4DBD95E10969768115EFA463D9E38CBC0C3DC2469D200C775AF7851E4B77AB4AE63B5456E4DE996EB21A94903519 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Stalkingly\Udgyd.ini
Download File
| Process: | C:\Users\user\Desktop\MNLS4PjscF.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 34271 |
| Entropy (8bit): | 7.9659073424878555 |
| Encrypted: | false |
| SSDEEP: | 768:4WE6omjLoyBWuDNGNceCXyQezdhoMB8q+ljUsYU1xhbU3vCH:4Uom4yBhmQi7eK8q+lpJRUfCH |
| MD5: | 868F1BE25FA5F82DE53C0CE9EA030CA3 |
| SHA1: | ECA9A135448D5C0F613209FF3516CAE3716BF0E3 |
| SHA-256: | 5FD97F664356EE61E6182C19DC0AF76318B4AA9AF75D674F11EB45DEF3D66526 |
| SHA-512: | 6A67BE639F4A4A8A24587ED6B1D67F276F41BC750B0FC74C49A69FF9293F57ACAE6DEF3423C8DF06805A1BB7CE894F4359510B3A27E2E1F388D065A618479E21 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Stalkingly\Udtrttede.ini
Download File
| Process: | C:\Users\user\Desktop\MNLS4PjscF.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 78838 |
| Entropy (8bit): | 7.9645085314331405 |
| Encrypted: | false |
| SSDEEP: | 1536:0aI5v5+r/WGPIAVQIhrVMZXPizutOFGlin5ZSk2iFJNfgJSYrLfEXWMp:I55e/pVQIhrqKusGkmkPnNYhX2R |
| MD5: | C994CB2032DBA92B7E631171678EC43D |
| SHA1: | E206DF32EA7F37FA26075E0456786E138AC27AE1 |
| SHA-256: | 3D6B9E81DA6DF4A9432CDB4168EE8F8B26CC88E47FDB9BB8A6D967FB1AB241E3 |
| SHA-512: | E444152150B4C1007FA96AA079E41D959A5A48D00D9F1D9AC15321B646F7CF4000D43825DF25EF7D69275A3CA86C029E8862AF07F873A8375B1EAAE5280A4F13 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Stalkingly\aktioners.jpg
Download File
| Process: | C:\Users\user\Desktop\MNLS4PjscF.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 33760 |
| Entropy (8bit): | 7.967017042537166 |
| Encrypted: | false |
| SSDEEP: | 768:4WE6omjLoyBWuDNGNceCXyQezdhoMB8q+ljUsYU1xhbU3vCW:4Uom4yBhmQi7eK8q+lpJRUfCW |
| MD5: | B79A2EC8152E04C3DF16B5DF803ED841 |
| SHA1: | 4E8FEE2ACDA813B8D6F12FF1B2B9BEDA769C05BD |
| SHA-256: | 584DC6A4106CFB60A2794937921B3B560F398558B482D5C24A1ECFB997EBEA9D |
| SHA-512: | 0DFB2B2FA92EB11B60C87D272B6B2EEA14DC2E05D53048C445772D6249F3635BBD1EE7B663F9F670FCD06C50C71839323BF2325CAEECBD9AD7D182E5733C3488 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Stalkingly\begrdeliges.pro
Download File
| Process: | C:\Users\user\Desktop\MNLS4PjscF.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 271048 |
| Entropy (8bit): | 1.2501527383190683 |
| Encrypted: | false |
| SSDEEP: | 1536:J3Cc9bXL6XUITHsHuh6mYsN8xVvBPJggd0Q96LJe24TSewHt/z1tIwt8iWoImuhr:JGU5Q+7bgfC97p |
| MD5: | 4CDDE62E05107CF3BAD9767453F364D5 |
| SHA1: | 8C3990C82C3F9C0ECECCFC2E878F00B674556E6E |
| SHA-256: | 80EFA0744FB280C29C700886A6CD158053D0BE9C2D87F445A76C6DEA410B774B |
| SHA-512: | A3C64E4B4DB6AEA45756BFB1C2BED5F7CA19549DE8C2D095F320DB8BC8589B01E356D033D6073CBEED9B56EDA1939BEB98E727382F5396EA3E50079125B19451 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Stalkingly\burdie.ini
Download File
| Process: | C:\Users\user\Desktop\MNLS4PjscF.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 19024 |
| Entropy (8bit): | 7.941019032399731 |
| Encrypted: | false |
| SSDEEP: | 384:G69R2kiP8DN7z8OayzjwTSQ1vI8+KvvKyMIWVx3NRGBQqxFk8nWzy1+a6Pu10IJh:GgHpXda7+2d1vezVx3NRCpnZ1+afGIJh |
| MD5: | E9772CD90D72A4F4AF0401E7BFBA7BBA |
| SHA1: | 45DEEC11D8CE16E3DF98F6E3AC23A6B647A81535 |
| SHA-256: | 53BB5626BC226D0E476A35645C2D720C1056ADFBB23DAEB5923E9264540259B9 |
| SHA-512: | BA2E24D412C69D2B1EBAEDBF5B7AC0F94544A3E9C42CDE2FB13C456217B6B0449024086D78C72F8B7C4EBA35622C56623919F64CE408471028E0A5DC6E206027 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Stalkingly\cartographer.jpg
Download File
| Process: | C:\Users\user\Desktop\MNLS4PjscF.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 30956 |
| Entropy (8bit): | 7.969499868102271 |
| Encrypted: | false |
| SSDEEP: | 768:ofYXJ6hCAlkicSla3FFc1VQC2NOF1Nuse5wExZ50vn:oQalrlaVC1uClF1NuTT5Mn |
| MD5: | C9D3CCBEBDAFAA919122541A202A9733 |
| SHA1: | F81641E686DE3B8C884971EC5DA65D8CF4BB4D3F |
| SHA-256: | 5FDB8BED6E957D3399EC0D8A30934F1E0B2A4C5880A6EC8DF43F786BAA32A96C |
| SHA-512: | F16B4DC339F4943E19408F386C376C50A4DA42E6DB1241EAB90B8596AF701F75421B87A1AEA10835467A3900E29E2611943DC9B89FDFAAC3E46D0546BFA83A7A |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Stalkingly\histographies.txt
Download File
| Process: | C:\Users\user\Desktop\MNLS4PjscF.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 34638 |
| Entropy (8bit): | 7.9628416848799 |
| Encrypted: | false |
| SSDEEP: | 768:4WE6omjLoyBWuDNGNceCXyQezdhoMB8q+ljUsYU1xhbU3vCL:4Uom4yBhmQi7eK8q+lpJRUfCL |
| MD5: | 5A1AD1096F97C0E2239684846D247918 |
| SHA1: | 2885227167F0780AED630077007401989AFDDAEE |
| SHA-256: | C2C9EE1D315D2D076FAADFDECF060E59877B621385A7825EDBA473BE85CCBF7F |
| SHA-512: | 2740807D4DCDB5D2CE786488047360225EC7DED2B84A215CCE00DB25E67C2A9B5C9C3E0593BA35F8E48D937E3104FFD97C3B034471639F88D3119F9B9C62B36B |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Stalkingly\icekhana.txt
Download File
| Process: | C:\Users\user\Desktop\MNLS4PjscF.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 78312 |
| Entropy (8bit): | 7.965760163563921 |
| Encrypted: | false |
| SSDEEP: | 1536:0aI5v5+r/WGPIAVQIhrVMZXPizutOFGlin5ZSk2iFJNfgJSYrLfEXWMo:I55e/pVQIhrqKusGkmkPnNYhX2g |
| MD5: | B53488FB78817ABDEA984B799B644E71 |
| SHA1: | B52C3F0461B2D4827634B17A8456FE0EEACCF166 |
| SHA-256: | 37E2971FE0FE1B8F445A2D90CFEFC40A614C09F04D4269DC0E39131714B71644 |
| SHA-512: | 817F53CAA92582CE9F070493836EF6E925CCDFECA064C3CD8ADFFF1124542D61ED2F2DD2ABBCFC46F7CA700A43710EA78440BD16092AC41EA59D90C7E2BB13EC |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Stalkingly\manxman.jpg
Download File
| Process: | C:\Users\user\Desktop\MNLS4PjscF.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 6266 |
| Entropy (8bit): | 7.934604994452403 |
| Encrypted: | false |
| SSDEEP: | 192:LageUe3z8q30+rTymq37MvDe0QQCtvOdjxvIqwgOdTsx3W:OQeJ3trT1cMvD2jvO7vIqwgOdTaW |
| MD5: | D154965D450CABB2873570BBB6BCEE1F |
| SHA1: | B69F899F37D407E34F7391B278C08140F22A8D4F |
| SHA-256: | 8EAF9B50CE1AE80F9A033C88D393FABFF9033E1D8485B411594889DD23AEEB48 |
| SHA-512: | 6483603905A6B6566F45C7F26EFC549D371A96DEFD57B29DD96AE8890EE481964C9E682A1077AEFC8D10F8366FADEAFE9FC0DE12477D0265C70D3BC629E53B3E |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Stalkingly\modstaaet.jpg
Download File
| Process: | C:\Users\user\Desktop\MNLS4PjscF.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 77820 |
| Entropy (8bit): | 7.966308391338044 |
| Encrypted: | false |
| SSDEEP: | 1536:0aI5v5+r/WGPIAVQIhrVMZXPizutOFGlin5ZSk2iFJNfgJSYrLfEXWMz:I55e/pVQIhrqKusGkmkPnNYhX2r |
| MD5: | 69FAD6C6022F82800FD9AA55EAFF43DF |
| SHA1: | C34951D82990B356BCB2CAE1B24690AAA9A558AB |
| SHA-256: | D765417E77F1604852B08BF8E3FC78B08DB3947AE0456B7DA5A7E272D83B1426 |
| SHA-512: | 324D713ECDE5AAFCEE49721D65936E3B8646F482521D971059E4D90908EAAA0CD7F0FE47159529935C3589F5892AB9F930AE74630EDBECC81CC68B7FC5FBA227 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Stalkingly\musicianer.spi
Download File
| Process: | C:\Users\user\Desktop\MNLS4PjscF.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 252988 |
| Entropy (8bit): | 1.258435768634305 |
| Encrypted: | false |
| SSDEEP: | 1536:Ffup5V9mQ4FqyWKrbCGsV2kLUY+mvKDFHHe4w/Lm65l32C+8zQNrpQJu0jx23uf5:1lMpKEfpd |
| MD5: | E19F0FF07EFE63E8B30B92E64C3279C1 |
| SHA1: | 7855F6FBD8FC96F485B4140A85A4D5CBD31F1AF9 |
| SHA-256: | 4CE892AA1B8B8CFFC9835C703FABC69087F82490FB46E889D6C07280DCE64E03 |
| SHA-512: | 030264903EFB58841058997648E112F3AC89EE4D9EA038D96F1CD132A59B2B0A3D6BCB4DD99DA62279835408453F84CF3AF492E1D53910C8AE29CCE386E2D5CB |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Stalkingly\ndder.jpg
Download File
| Process: | C:\Users\user\Desktop\MNLS4PjscF.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 9249 |
| Entropy (8bit): | 7.859769804343658 |
| Encrypted: | false |
| SSDEEP: | 192:Lg3GVbPdwh/TkYJFxFd5Ynr9rwP8eiJnuLq6dIUfvF3g5/S+4DHEk:k3GVbPdSwYJn5Yr9rNJuLq6d1nF6S+4F |
| MD5: | 99568CF7EA7AB982BEBEC6E8C9736699 |
| SHA1: | 656B55183279F357ABE336F6359C4AEDB5FB4AD6 |
| SHA-256: | B9FCD205A8B2A819D6774B0F217334C24E508A02BA504D24CE3438C17AAE630A |
| SHA-512: | C7408A24197C4BF2B14C3AD43840851EB14325E60490998E1625FEC3CE538CB8B4EC1C9A71836990E0EB4EE922040217EC0989FD6E6D4F5BC4FCC3F3FDA0FB10 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Stalkingly\romantiserendes.ini
Download File
| Process: | C:\Users\user\Desktop\MNLS4PjscF.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 79085 |
| Entropy (8bit): | 7.963718594699245 |
| Encrypted: | false |
| SSDEEP: | 1536:0aI5v5+r/WGPIAVQIhrVMZXPizutOFGlin5ZSk2iFJNfgJSYrLfEXWMn:I55e/pVQIhrqKusGkmkPnNYhX2P |
| MD5: | 48951E338D32805997DA47E7122CA34C |
| SHA1: | FB7A57BEAAC5B15E081DCF5A54947107FB9DF9C0 |
| SHA-256: | 62D4D8C14C5BC21B8FC7BAC1BC1C8A272404C5516871E574D9E65EEF00787D11 |
| SHA-512: | 7BC3831B4274EB53F5F40C59C41456C35005FEFDD486774DA41287EA46CC33E2858C0DAE2BBE9FD12EB63BD7BA8460D8B184AB316340B45E90C939821B92D2E7 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Stalkingly\semiquadrangle.ini
Download File
| Process: | C:\Users\user\Desktop\MNLS4PjscF.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 18366 |
| Entropy (8bit): | 7.960531856269744 |
| Encrypted: | false |
| SSDEEP: | 384:G69R2kiP8DN7z8OayzjwTSQ1vI8+KvvKyMIWVx3NRGBQqxFk8nWzy1+a6Pu10IJ0:GgHpXda7+2d1vezVx3NRCpnZ1+afGIJ0 |
| MD5: | D0B061FE143A45224AF28C219D85EC29 |
| SHA1: | 98EC46FB584AFFF14AB2B9D8DBD914C2F82DB58B |
| SHA-256: | DDD6D841667588C40373273F4ACE25CD8E25C527BC4B15160A4BD95D5F5F859A |
| SHA-512: | D6035392C1E6D28B01CF4AD9025E9E43B64CAAD772B6FBF2F0D239CDC5F2B1DB3266DEAC88DC73B3C443D8755582E9E99B86642BE67E693447B5B70E79116A48 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Stalkingly\sugarcane.jpg
Download File
| Process: | C:\Users\user\Desktop\MNLS4PjscF.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 17926 |
| Entropy (8bit): | 7.964086895083405 |
| Encrypted: | false |
| SSDEEP: | 384:G69R2kiP8DN7z8OayzjwTSQ1vI8+KvvKyMIWVx3NRGBQqxFk8nWzy1+a6Pu10IJy:GgHpXda7+2d1vezVx3NRCpnZ1+afGIJy |
| MD5: | 226BA095D6E35AE7575FF844DA0C0293 |
| SHA1: | D50131B137CAA1464076A0F6B1AB1ADA6E99234E |
| SHA-256: | 307B12DABB919A69383409A5064E70DCD0CD4903C9E94814D10C540312F0BE73 |
| SHA-512: | 3BEC4961D0682F6ECA723A8838DB446F5152C34D82B9EEE7CE2B80724F63BAB6D4A3BE0C0B5418E7831F04AD8236697B7E4820ECE601878471AAA2184488121A |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Tiggerstavens.fes
Download File
| Process: | C:\Users\user\Desktop\MNLS4PjscF.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 458176 |
| Entropy (8bit): | 1.246204574944222 |
| Encrypted: | false |
| SSDEEP: | 1536:xRWO2EIpW61fXKYiZAiYUQZF4Ce2spug3ZcCQy0kTwxdwBl9qiJsuQKSA4o6LOzv:seFwClmyQzweu |
| MD5: | F507FD73B5683DFB9ECE04A486CF8E21 |
| SHA1: | 171A7FF1F5C92A75FF2787021BA6750FEF68213F |
| SHA-256: | 9AEAFCD46AA3D1B660FB1A3A8F10C21D28C80A50BF37A23D9ECA444A51557065 |
| SHA-512: | B6124C979EF1DC6946F95EACAA369E4EABB9B0E32781197A8A2686FA2FEDB69B123B274EB19E82E4AD781FB49D6F74A96E1B38C147C7AC163C5430DD084C7D2F |
| Malicious: | false |
| Preview: |
| File type: | |
| Entropy (8bit): | 7.956197504044966 |
| TrID: |
|
| File name: | MNLS4PjscF.exe |
| File size: | 883'660 bytes |
| MD5: | 7730242b95171f0ccb03e28bf8f5056b |
| SHA1: | a5348671e4b92b3c64086abe6fced83f251e692c |
| SHA256: | 2baf2894d28fffff439499fbcd6b92714febd8ea39c0850f60f4575adedef15b |
| SHA512: | 74a89a765c1d138b3e9c90a0cbb3768ded91ceb7140d99b97b8aec2392e88e58d3b46a657db6738f8effa59743ae6e4eab19bc264944273adaa7543dfab9626c |
| SSDEEP: | 12288:Zt1Y3a5Pi5kV98nWGjFxN1bIyPA2lKZ7SimXcL9WIoXygi+VIfX+SPA4c5Wj6wnM:VY0Pi5kId5F55lc7zmXcLEr9t4UkM |
| TLSH: | 1A1523005BDD8666EAE521B36D7381AAC3779E968553820F5F443F7B3C342B184A32DB |
| File Content Preview: | MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1.D9u.*ju.*ju.*j..ujw.*ju.+j..*j..wjd.*j!..j..*j..,jt.*jRichu.*j........PE..L....f.R.................`...*......X3.......p....@ |
 | |
| Icon Hash: | a5d56872428d9074 |
| Entrypoint: | 0x403358 |
| Entrypoint Section: | .text |
| Digitally signed: | false |
| Imagebase: | 0x400000 |
| Subsystem: | windows gui |
| Image File Characteristics: | RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE |
| DLL Characteristics: | TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x52BA66B2 [Wed Dec 25 05:01:38 2013 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 4 |
| OS Version Minor: | 0 |
| File Version Major: | 4 |
| File Version Minor: | 0 |
| Subsystem Version Major: | 4 |
| Subsystem Version Minor: | 0 |
| Import Hash: | e221f4f7d36469d53810a4b5f9fc8966 |
| Instruction |
|---|
| sub esp, 000002D4h |
| push ebx |
| push ebp |
| push esi |
| push edi |
| push 00000020h |
| xor ebp, ebp |
| pop esi |
| mov dword ptr [esp+14h], ebp |
| mov dword ptr [esp+10h], 00409230h |
| mov dword ptr [esp+1Ch], ebp |
| call dword ptr [00407034h] |
| push 00008001h |
| call dword ptr [004070BCh] |
| push ebp |
| call dword ptr [004072ACh] |
| push 00000008h |
| mov dword ptr [00429298h], eax |
| call 00007F09F87DDC6Ch |
| mov dword ptr [004291E4h], eax |
| push ebp |
| lea eax, dword ptr [esp+34h] |
| push 000002B4h |
| push eax |
| push ebp |
| push 00420690h |
| call dword ptr [0040717Ch] |
| push 0040937Ch |
| push 004281E0h |
| call 00007F09F87DD8D7h |
| call dword ptr [00407134h] |
| mov ebx, 00434000h |
| push eax |
| push ebx |
| call 00007F09F87DD8C5h |
| push ebp |
| call dword ptr [0040710Ch] |
| cmp word ptr [00434000h], 0022h |
| mov dword ptr [004291E0h], eax |
| mov eax, ebx |
| jne 00007F09F87DADBAh |
| push 00000022h |
| mov eax, 00434002h |
| pop esi |
| push esi |
| push eax |
| call 00007F09F87DD316h |
| push eax |
| call dword ptr [00407240h] |
| mov dword ptr [esp+18h], eax |
| jmp 00007F09F87DAE7Eh |
| push 00000020h |
| pop edx |
| cmp cx, dx |
| jne 00007F09F87DADB9h |
| inc eax |
| inc eax |
| cmp word ptr [eax], dx |
| je 00007F09F87DADABh |
| add word ptr [eax], 0000h |
| Programming Language: |
|
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0x7494 | 0xb4 | .rdata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x4d000 | 0x5040 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x7000 | 0x2b8 | .rdata |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x5e66 | 0x6000 | e8f12472e91b02deb619070e6ee7f1f4 | False | 0.6566569010416666 | data | 6.419409887460116 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .rdata | 0x7000 | 0x1354 | 0x1400 | 2222fe44ebbadbc32af32dfc9c88e48e | False | 0.4306640625 | data | 5.037511188789184 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .data | 0x9000 | 0x202d8 | 0x600 | a5ec1b720d350c6303a7aba8d85072bf | False | 0.4733072916666667 | data | 3.7600484096214832 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .ndata | 0x2a000 | 0x23000 | 0x0 | d41d8cd98f00b204e9800998ecf8427e | False | 0 | empty | 0.0 | IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .rsrc | 0x4d000 | 0x5040 | 0x5200 | b2da62e34b8c62c487b136a5434db933 | False | 0.17844893292682926 | data | 2.8674367335879127 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| RT_ICON | 0x4d298 | 0x25a8 | Device independent bitmap graphic, 48 x 96 x 32, image size 9600 | English | United States | 0.10197095435684647 |
| RT_ICON | 0x4f840 | 0x10a8 | Device independent bitmap graphic, 32 x 64 x 32, image size 4224 | English | United States | 0.17659474671669795 |
| RT_ICON | 0x508e8 | 0x988 | Device independent bitmap graphic, 24 x 48 x 32, image size 2400 | English | United States | 0.21598360655737706 |
| RT_ICON | 0x51270 | 0x468 | Device independent bitmap graphic, 16 x 32 x 32, image size 1088 | English | United States | 0.2703900709219858 |
| RT_DIALOG | 0x516d8 | 0x144 | data | English | United States | 0.5216049382716049 |
| RT_DIALOG | 0x51820 | 0x120 | data | English | United States | 0.5138888888888888 |
| RT_DIALOG | 0x51940 | 0x11c | data | English | United States | 0.6056338028169014 |
| RT_DIALOG | 0x51a60 | 0x60 | data | English | United States | 0.7291666666666666 |
| RT_GROUP_ICON | 0x51ac0 | 0x3e | data | English | United States | 0.8064516129032258 |
| RT_VERSION | 0x51b00 | 0x238 | data | English | United States | 0.5422535211267606 |
| RT_MANIFEST | 0x51d38 | 0x305 | XML 1.0 document, ASCII text, with very long lines (773), with no line terminators | English | United States | 0.5614489003880984 |
| DLL | Import |
|---|---|
| KERNEL32.dll | CompareFileTime, SearchPathW, SetFileTime, CloseHandle, GetShortPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, GetFullPathNameW, CreateDirectoryW, Sleep, GetTickCount, CreateFileW, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, SetEnvironmentVariableW, GetWindowsDirectoryW, SetFileAttributesW, ExpandEnvironmentStringsW, SetErrorMode, LoadLibraryW, lstrlenW, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, CreateProcessW, RemoveDirectoryW, lstrcmpiA, GetTempFileNameW, lstrcpyA, lstrcpyW, lstrcatW, GetSystemDirectoryW, GetVersion, GetProcAddress, LoadLibraryA, GetModuleHandleA, GetModuleHandleW, lstrcmpiW, lstrcmpW, WaitForSingleObject, GlobalFree, GlobalAlloc, LoadLibraryExW, GetExitCodeProcess, FreeLibrary, WritePrivateProfileStringW, GetCommandLineW, GetTempPathW, GetPrivateProfileStringW, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, MulDiv, MultiByteToWideChar, WriteFile, lstrlenA, WideCharToMultiByte |
| USER32.dll | EndDialog, ScreenToClient, GetWindowRect, RegisterClassW, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, wsprintfW, CreateWindowExW, SystemParametersInfoW, AppendMenuW, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, GetDC, SetWindowLongW, LoadImageW, SendMessageTimeoutW, FindWindowExW, EmptyClipboard, OpenClipboard, TrackPopupMenu, EndPaint, ShowWindow, GetDlgItem, IsWindow, SetForegroundWindow |
| GDI32.dll | SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor |
| SHELL32.dll | SHGetSpecialFolderLocation, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW |
| ADVAPI32.dll | RegCloseKey, RegOpenKeyExW, RegDeleteKeyW, RegDeleteValueW, RegEnumValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumKeyW |
| COMCTL32.dll | ImageList_Create, ImageList_AddMasked, ImageList_Destroy |
| ole32.dll | CoCreateInstance, CoTaskMemFree, OleInitialize, OleUninitialize |
| VERSION.dll | GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW |
| Description | Data |
|---|---|
| FileDescription | vignetted |
| LegalCopyright | dommedagsprdikenens johnnis |
| LegalTrademarks | kodes |
| OriginalFilename | toggler triumvirates.exe |
| ProductVersion | 3.5.0.0 |
| Translation | 0x0409 0x04e4 |
| Language of compilation system | Country where language is spoken | Map |
|---|---|---|
| English | United States |  |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | SID | Signature | Severity | Source IP | Source Port | Dest IP | Dest Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2025-03-07T23:30:47.020893+0100 | 2803270 | ETPRO MALWARE Common Downloader Header Pattern UHCa | 2 | 192.168.2.7 | 49688 | 142.250.186.142 | 443 | TCP |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Mar 7, 2025 23:30:44.315655947 CET | 49688 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:30:44.315721989 CET | 443 | 49688 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:30:44.315799952 CET | 49688 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:30:44.325414896 CET | 49688 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:30:44.325432062 CET | 443 | 49688 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:30:46.242435932 CET | 443 | 49688 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:30:46.242858887 CET | 49688 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:30:46.243078947 CET | 443 | 49688 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:30:46.243244886 CET | 49688 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:30:46.312232018 CET | 49688 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:30:46.312256098 CET | 443 | 49688 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:30:46.313247919 CET | 443 | 49688 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:30:46.313365936 CET | 49688 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:30:46.318738937 CET | 49688 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:30:46.364330053 CET | 443 | 49688 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:30:47.021070004 CET | 443 | 49688 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:30:47.021164894 CET | 49688 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:30:47.021189928 CET | 443 | 49688 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:30:47.021240950 CET | 49688 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:30:47.021250010 CET | 443 | 49688 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:30:47.021286011 CET | 49688 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:30:47.021303892 CET | 443 | 49688 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:30:47.021394014 CET | 49688 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:30:47.022969007 CET | 49688 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:30:47.022990942 CET | 443 | 49688 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:30:47.044737101 CET | 49689 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:30:47.044836998 CET | 443 | 49689 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:30:47.044933081 CET | 49689 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:30:47.045267105 CET | 49689 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:30:47.045304060 CET | 443 | 49689 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:30:48.775861979 CET | 443 | 49689 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:30:48.776196003 CET | 49689 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:30:48.780988932 CET | 49689 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:30:48.781049967 CET | 443 | 49689 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:30:48.781517982 CET | 443 | 49689 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:30:48.781593084 CET | 49689 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:30:48.782143116 CET | 49689 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:30:48.824347019 CET | 443 | 49689 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:30:49.465431929 CET | 443 | 49689 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:30:49.465749025 CET | 49689 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:30:49.465783119 CET | 443 | 49689 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:30:49.465866089 CET | 49689 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:30:49.468012094 CET | 443 | 49689 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:30:49.468089104 CET | 49689 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:30:49.468096972 CET | 443 | 49689 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:30:49.468112946 CET | 443 | 49689 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:30:49.468139887 CET | 49689 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:30:49.468178034 CET | 49689 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:30:49.475123882 CET | 49689 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:30:49.475151062 CET | 443 | 49689 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:30:49.595096111 CET | 49690 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:30:49.595140934 CET | 443 | 49690 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:30:49.595231056 CET | 49690 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:30:49.595616102 CET | 49690 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:30:49.595628023 CET | 443 | 49690 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:30:51.457639933 CET | 443 | 49690 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:30:51.457752943 CET | 49690 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:30:51.458316088 CET | 49690 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:30:51.458327055 CET | 443 | 49690 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:30:51.458519936 CET | 49690 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:30:51.458523989 CET | 443 | 49690 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:30:52.107809067 CET | 443 | 49690 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:30:52.107912064 CET | 49690 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:30:52.107943058 CET | 443 | 49690 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:30:52.107991934 CET | 49690 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:30:52.108022928 CET | 443 | 49690 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:30:52.108068943 CET | 49690 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:30:52.108189106 CET | 49690 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:30:52.108206987 CET | 443 | 49690 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:30:52.114226103 CET | 49691 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:30:52.114284039 CET | 443 | 49691 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:30:52.114357948 CET | 49691 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:30:52.114619970 CET | 49691 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:30:52.114634991 CET | 443 | 49691 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:30:53.881725073 CET | 443 | 49691 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:30:53.881894112 CET | 49691 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:30:53.882534027 CET | 49691 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:30:53.882545948 CET | 443 | 49691 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:30:53.882908106 CET | 49691 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:30:53.882914066 CET | 443 | 49691 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:30:54.605011940 CET | 443 | 49691 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:30:54.605164051 CET | 443 | 49691 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:30:54.605274916 CET | 49691 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:30:54.605276108 CET | 49691 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:30:54.605315924 CET | 443 | 49691 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:30:54.605382919 CET | 49691 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:30:54.606024027 CET | 49691 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:30:54.606132030 CET | 443 | 49691 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:30:54.606215954 CET | 49691 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:30:54.737636089 CET | 49692 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:30:54.737694025 CET | 443 | 49692 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:30:54.737803936 CET | 49692 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:30:54.738435030 CET | 49692 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:30:54.738445997 CET | 443 | 49692 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:30:56.539603949 CET | 443 | 49692 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:30:56.539731979 CET | 49692 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:30:56.540326118 CET | 49692 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:30:56.540337086 CET | 443 | 49692 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:30:56.540537119 CET | 49692 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:30:56.540540934 CET | 443 | 49692 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:30:57.199019909 CET | 443 | 49692 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:30:57.199095964 CET | 49692 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:30:57.199101925 CET | 443 | 49692 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:30:57.199151039 CET | 49692 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:30:57.199346066 CET | 49692 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:30:57.199366093 CET | 443 | 49692 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:30:57.206535101 CET | 49693 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:30:57.206633091 CET | 443 | 49693 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:30:57.206733942 CET | 49693 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:30:57.206976891 CET | 49693 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:30:57.207016945 CET | 443 | 49693 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:30:58.937169075 CET | 443 | 49693 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:30:58.937324047 CET | 49693 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:30:58.940052986 CET | 49693 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:30:58.940087080 CET | 443 | 49693 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:30:58.940355062 CET | 443 | 49693 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:30:58.940426111 CET | 49693 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:30:58.941072941 CET | 49693 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:30:58.988329887 CET | 443 | 49693 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:30:59.626915932 CET | 443 | 49693 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:30:59.626976013 CET | 443 | 49693 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:30:59.627074957 CET | 49693 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:30:59.627149105 CET | 443 | 49693 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:30:59.627185106 CET | 49693 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:30:59.627212048 CET | 49693 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:30:59.627940893 CET | 49693 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:30:59.627984047 CET | 443 | 49693 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:30:59.628057003 CET | 49693 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:30:59.750854015 CET | 49694 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:30:59.750905037 CET | 443 | 49694 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:30:59.751015902 CET | 49694 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:30:59.751454115 CET | 49694 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:30:59.751462936 CET | 443 | 49694 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:31:01.513772011 CET | 443 | 49694 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:31:01.513873100 CET | 49694 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:31:01.514998913 CET | 49694 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:31:01.515003920 CET | 443 | 49694 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:31:01.515536070 CET | 49694 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:31:01.515539885 CET | 443 | 49694 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:31:02.166764021 CET | 443 | 49694 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:31:02.166860104 CET | 443 | 49694 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:31:02.166979074 CET | 49694 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:31:02.171983004 CET | 49694 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:31:02.172008038 CET | 443 | 49694 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:31:02.242894888 CET | 49695 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:02.242973089 CET | 443 | 49695 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:02.243060112 CET | 49695 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:02.243511915 CET | 49695 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:02.243531942 CET | 443 | 49695 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:04.033065081 CET | 443 | 49695 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:04.033209085 CET | 49695 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:04.035475969 CET | 49695 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:04.035485029 CET | 443 | 49695 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:04.035806894 CET | 443 | 49695 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:04.035913944 CET | 49695 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:04.036323071 CET | 49695 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:04.084323883 CET | 443 | 49695 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:04.721470118 CET | 443 | 49695 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:04.721532106 CET | 443 | 49695 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:04.721649885 CET | 49695 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:04.721649885 CET | 49695 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:04.721678019 CET | 443 | 49695 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:04.721760035 CET | 49695 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:04.724585056 CET | 443 | 49695 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:04.724646091 CET | 443 | 49695 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:04.724703074 CET | 49695 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:04.724703074 CET | 49695 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:04.727458954 CET | 49695 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:04.727479935 CET | 443 | 49695 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:04.880729914 CET | 49696 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:31:04.880774021 CET | 443 | 49696 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:31:04.880996943 CET | 49696 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:31:04.981961012 CET | 49696 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:31:04.981991053 CET | 443 | 49696 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:31:06.718738079 CET | 443 | 49696 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:31:06.718998909 CET | 49696 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:31:06.719932079 CET | 49696 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:31:06.719955921 CET | 443 | 49696 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:31:06.720000982 CET | 49696 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:31:06.720036030 CET | 443 | 49696 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:31:07.368155956 CET | 443 | 49696 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:31:07.368242025 CET | 443 | 49696 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:31:07.368352890 CET | 49696 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:31:07.369484901 CET | 49696 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:31:07.374124050 CET | 49696 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:31:07.374145031 CET | 443 | 49696 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:31:07.374166965 CET | 49696 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:31:07.374344110 CET | 49696 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:31:07.398653984 CET | 49697 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:07.398710012 CET | 443 | 49697 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:07.398794889 CET | 49697 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:07.399183989 CET | 49697 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:07.399195910 CET | 443 | 49697 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:09.246596098 CET | 443 | 49697 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:09.246737003 CET | 49697 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:09.247328043 CET | 49697 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:09.247339964 CET | 443 | 49697 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:09.247637033 CET | 49697 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:09.247642040 CET | 443 | 49697 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:10.002644062 CET | 443 | 49697 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:10.002691984 CET | 443 | 49697 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:10.002727032 CET | 49697 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:10.002757072 CET | 443 | 49697 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:10.002770901 CET | 49697 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:10.002798080 CET | 49697 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:10.003458023 CET | 49697 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:10.003510952 CET | 443 | 49697 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:10.003562927 CET | 49697 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:10.125832081 CET | 49698 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:31:10.125880003 CET | 443 | 49698 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:31:10.125979900 CET | 49698 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:31:10.126280069 CET | 49698 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:31:10.126293898 CET | 443 | 49698 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:31:11.986768007 CET | 443 | 49698 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:31:11.986871958 CET | 49698 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:31:11.987448931 CET | 49698 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:31:11.987457037 CET | 443 | 49698 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:31:11.987719059 CET | 49698 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:31:11.987724066 CET | 443 | 49698 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:31:12.640362978 CET | 443 | 49698 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:31:12.640449047 CET | 443 | 49698 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:31:12.640494108 CET | 49698 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:31:12.640564919 CET | 49698 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:31:12.640738964 CET | 49698 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:31:12.640755892 CET | 443 | 49698 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:31:12.650316954 CET | 49699 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:12.650362015 CET | 443 | 49699 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:12.650425911 CET | 49699 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:12.650779009 CET | 49699 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:12.650791883 CET | 443 | 49699 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:14.408188105 CET | 443 | 49699 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:14.408273935 CET | 49699 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:14.411232948 CET | 49699 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:14.411247015 CET | 443 | 49699 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:14.411520004 CET | 443 | 49699 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:14.411580086 CET | 49699 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:14.412148952 CET | 49699 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:14.452333927 CET | 443 | 49699 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:15.089756012 CET | 443 | 49699 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:15.089813948 CET | 443 | 49699 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:15.089868069 CET | 49699 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:15.089898109 CET | 443 | 49699 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:15.089912891 CET | 49699 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:15.089946032 CET | 49699 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:15.090745926 CET | 49699 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:15.090783119 CET | 443 | 49699 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:15.090837002 CET | 49699 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:15.220290899 CET | 49700 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:31:15.220359087 CET | 443 | 49700 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:31:15.220494986 CET | 49700 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:31:15.220912933 CET | 49700 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:31:15.220935106 CET | 443 | 49700 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:31:16.983881950 CET | 443 | 49700 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:31:16.983963013 CET | 49700 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:31:17.001207113 CET | 49700 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:31:17.001223087 CET | 443 | 49700 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:31:17.001441002 CET | 49700 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:31:17.001446962 CET | 443 | 49700 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:31:17.736514091 CET | 443 | 49700 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:31:17.736618042 CET | 443 | 49700 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:31:17.736618996 CET | 49700 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:31:17.736670971 CET | 49700 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:31:17.736952066 CET | 49700 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:31:17.736975908 CET | 443 | 49700 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:31:17.750025034 CET | 49701 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:17.750066042 CET | 443 | 49701 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:17.750133991 CET | 49701 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:17.750544071 CET | 49701 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:17.750560045 CET | 443 | 49701 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:19.483727932 CET | 443 | 49701 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:19.483829975 CET | 49701 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:19.485981941 CET | 49701 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:19.485996008 CET | 443 | 49701 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:19.486358881 CET | 443 | 49701 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:19.486428976 CET | 49701 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:19.487102032 CET | 49701 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:19.532345057 CET | 443 | 49701 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:20.229494095 CET | 443 | 49701 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:20.229672909 CET | 49701 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:20.229697943 CET | 443 | 49701 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:20.229758024 CET | 49701 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:20.240776062 CET | 443 | 49701 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:20.240875959 CET | 49701 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:20.240904093 CET | 443 | 49701 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:20.240947008 CET | 49701 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:20.241081953 CET | 49701 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:20.241127014 CET | 443 | 49701 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:20.241175890 CET | 49701 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:20.345261097 CET | 49702 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:31:20.345318079 CET | 443 | 49702 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:31:20.345405102 CET | 49702 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:31:20.345750093 CET | 49702 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:31:20.345765114 CET | 443 | 49702 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:31:22.197532892 CET | 443 | 49702 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:31:22.197607994 CET | 49702 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:31:22.198215961 CET | 49702 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:31:22.198221922 CET | 443 | 49702 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:31:22.198425055 CET | 49702 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:31:22.198429108 CET | 443 | 49702 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:31:22.928880930 CET | 443 | 49702 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:31:22.928955078 CET | 443 | 49702 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:31:22.929027081 CET | 49702 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:31:22.929090023 CET | 49702 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:31:22.929363012 CET | 49702 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:31:22.929378033 CET | 443 | 49702 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:31:22.929409027 CET | 49702 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:31:22.929426908 CET | 49702 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:31:22.950352907 CET | 49703 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:22.950409889 CET | 443 | 49703 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:22.950484037 CET | 49703 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:22.950731993 CET | 49703 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:22.950742960 CET | 443 | 49703 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:24.813858032 CET | 443 | 49703 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:24.813971996 CET | 49703 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:24.818639040 CET | 49703 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:24.818650007 CET | 443 | 49703 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:24.819037914 CET | 443 | 49703 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:24.819231987 CET | 49703 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:24.820133924 CET | 49703 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:24.864327908 CET | 443 | 49703 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:25.585594893 CET | 443 | 49703 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:25.585632086 CET | 443 | 49703 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:25.585728884 CET | 49703 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:25.585752964 CET | 443 | 49703 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:25.585763931 CET | 49703 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:25.585803032 CET | 49703 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:25.587214947 CET | 49703 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:25.587383032 CET | 443 | 49703 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:25.587459087 CET | 49703 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:25.704617023 CET | 49704 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:31:25.704653025 CET | 443 | 49704 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:31:25.704746962 CET | 49704 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:31:25.705209970 CET | 49704 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:31:25.705218077 CET | 443 | 49704 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:31:27.488532066 CET | 443 | 49704 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:31:27.488789082 CET | 49704 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:31:27.489296913 CET | 49704 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:31:27.489310980 CET | 443 | 49704 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:31:27.489507914 CET | 49704 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:31:27.489512920 CET | 443 | 49704 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:31:28.142894983 CET | 443 | 49704 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:31:28.142978907 CET | 443 | 49704 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:31:28.142985106 CET | 49704 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:31:28.143049955 CET | 49704 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:31:28.430843115 CET | 49704 | 443 | 192.168.2.7 | 142.250.186.142 |
| Mar 7, 2025 23:31:28.430938005 CET | 443 | 49704 | 142.250.186.142 | 192.168.2.7 |
| Mar 7, 2025 23:31:28.441260099 CET | 49705 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:28.441320896 CET | 443 | 49705 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:28.441385031 CET | 49705 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:28.442164898 CET | 49705 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:28.442181110 CET | 443 | 49705 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:30.253350019 CET | 443 | 49705 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:30.253443003 CET | 49705 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:30.255652905 CET | 49705 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:30.255661964 CET | 443 | 49705 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:30.255916119 CET | 443 | 49705 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:30.255978107 CET | 49705 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:30.256649971 CET | 49705 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:30.300338030 CET | 443 | 49705 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:31.017780066 CET | 443 | 49705 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:31.017858028 CET | 49705 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:31.017870903 CET | 443 | 49705 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:31.017916918 CET | 443 | 49705 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:31.017919064 CET | 49705 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:31.017951012 CET | 443 | 49705 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:31.017983913 CET | 49705 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:31.017993927 CET | 49705 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:31.018026114 CET | 443 | 49705 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:31.018081903 CET | 49705 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:31.020531893 CET | 443 | 49705 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:31.020591974 CET | 49705 | 443 | 192.168.2.7 | 142.250.186.33 |
| Mar 7, 2025 23:31:31.020678043 CET | 443 | 49705 | 142.250.186.33 | 192.168.2.7 |
| Mar 7, 2025 23:31:31.020728111 CET | 49705 | 443 | 192.168.2.7 | 142.250.186.33 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Mar 7, 2025 23:30:44.301100016 CET | 54080 | 53 | 192.168.2.7 | 1.1.1.1 |
| Mar 7, 2025 23:30:44.308722019 CET | 53 | 54080 | 1.1.1.1 | 192.168.2.7 |
| Mar 7, 2025 23:30:47.036686897 CET | 56821 | 53 | 192.168.2.7 | 1.1.1.1 |
| Mar 7, 2025 23:30:47.043759108 CET | 53 | 56821 | 1.1.1.1 | 192.168.2.7 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Mar 7, 2025 23:30:44.301100016 CET | 192.168.2.7 | 1.1.1.1 | 0xc5ca | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Mar 7, 2025 23:30:47.036686897 CET | 192.168.2.7 | 1.1.1.1 | 0xb268 | Standard query (0) | A (IP address) | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Mar 7, 2025 23:30:44.308722019 CET | 1.1.1.1 | 192.168.2.7 | 0xc5ca | No error (0) | 142.250.186.142 | A (IP address) | IN (0x0001) | false | ||
| Mar 7, 2025 23:30:47.043759108 CET | 1.1.1.1 | 192.168.2.7 | 0xb268 | No error (0) | 142.250.186.33 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.7 | 49688 | 142.250.186.142 | 443 | 5684 | C:\Users\user\Desktop\MNLS4PjscF.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-03-07 22:30:46 UTC | 216 | OUT | |
| 2025-03-07 22:30:47 UTC | 1610 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.7 | 49689 | 142.250.186.33 | 443 | 5684 | C:\Users\user\Desktop\MNLS4PjscF.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-03-07 22:30:48 UTC | 258 | OUT | |
| 2025-03-07 22:30:49 UTC | 1926 | IN | |
| 2025-03-07 22:30:49 UTC | 1652 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 2 | 192.168.2.7 | 49690 | 142.250.186.142 | 443 | 5684 | C:\Users\user\Desktop\MNLS4PjscF.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-03-07 22:30:51 UTC | 428 | OUT | |
| 2025-03-07 22:30:52 UTC | 1610 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 3 | 192.168.2.7 | 49691 | 142.250.186.33 | 443 | 5684 | C:\Users\user\Desktop\MNLS4PjscF.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-03-07 22:30:53 UTC | 470 | OUT | |
| 2025-03-07 22:30:54 UTC | 1533 | IN | |
| 2025-03-07 22:30:54 UTC | 1533 | IN | |
| 2025-03-07 22:30:54 UTC | 119 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 4 | 192.168.2.7 | 49692 | 142.250.186.142 | 443 | 5684 | C:\Users\user\Desktop\MNLS4PjscF.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-03-07 22:30:56 UTC | 428 | OUT | |
| 2025-03-07 22:30:57 UTC | 1610 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 5 | 192.168.2.7 | 49693 | 142.250.186.33 | 443 | 5684 | C:\Users\user\Desktop\MNLS4PjscF.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-03-07 22:30:58 UTC | 470 | OUT | |
| 2025-03-07 22:30:59 UTC | 1534 | IN | |
| 2025-03-07 22:30:59 UTC | 1534 | IN | |
| 2025-03-07 22:30:59 UTC | 118 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 6 | 192.168.2.7 | 49694 | 142.250.186.142 | 443 | 5684 | C:\Users\user\Desktop\MNLS4PjscF.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-03-07 22:31:01 UTC | 428 | OUT | |
| 2025-03-07 22:31:02 UTC | 1610 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 7 | 192.168.2.7 | 49695 | 142.250.186.33 | 443 | 5684 | C:\Users\user\Desktop\MNLS4PjscF.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-03-07 22:31:04 UTC | 470 | OUT | |
| 2025-03-07 22:31:04 UTC | 1534 | IN | |
| 2025-03-07 22:31:04 UTC | 1534 | IN | |
| 2025-03-07 22:31:04 UTC | 118 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 8 | 192.168.2.7 | 49696 | 142.250.186.142 | 443 | 5684 | C:\Users\user\Desktop\MNLS4PjscF.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-03-07 22:31:06 UTC | 428 | OUT | |
| 2025-03-07 22:31:07 UTC | 1610 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 9 | 192.168.2.7 | 49697 | 142.250.186.33 | 443 | 5684 | C:\Users\user\Desktop\MNLS4PjscF.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-03-07 22:31:09 UTC | 470 | OUT | |
| 2025-03-07 22:31:09 UTC | 1534 | IN | |
| 2025-03-07 22:31:09 UTC | 1534 | IN | |
| 2025-03-07 22:31:09 UTC | 118 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 10 | 192.168.2.7 | 49698 | 142.250.186.142 | 443 | 5684 | C:\Users\user\Desktop\MNLS4PjscF.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-03-07 22:31:11 UTC | 428 | OUT | |
| 2025-03-07 22:31:12 UTC | 1610 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 11 | 192.168.2.7 | 49699 | 142.250.186.33 | 443 | 5684 | C:\Users\user\Desktop\MNLS4PjscF.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-03-07 22:31:14 UTC | 470 | OUT | |
| 2025-03-07 22:31:15 UTC | 1533 | IN | |
| 2025-03-07 22:31:15 UTC | 1533 | IN | |
| 2025-03-07 22:31:15 UTC | 119 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 12 | 192.168.2.7 | 49700 | 142.250.186.142 | 443 | 5684 | C:\Users\user\Desktop\MNLS4PjscF.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-03-07 22:31:16 UTC | 428 | OUT | |
| 2025-03-07 22:31:17 UTC | 1610 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 13 | 192.168.2.7 | 49701 | 142.250.186.33 | 443 | 5684 | C:\Users\user\Desktop\MNLS4PjscF.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-03-07 22:31:19 UTC | 470 | OUT | |
| 2025-03-07 22:31:20 UTC | 1541 | IN | |
| 2025-03-07 22:31:20 UTC | 1541 | IN | |
| 2025-03-07 22:31:20 UTC | 111 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 14 | 192.168.2.7 | 49702 | 142.250.186.142 | 443 | 5684 | C:\Users\user\Desktop\MNLS4PjscF.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-03-07 22:31:22 UTC | 428 | OUT | |
| 2025-03-07 22:31:22 UTC | 1610 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 15 | 192.168.2.7 | 49703 | 142.250.186.33 | 443 | 5684 | C:\Users\user\Desktop\MNLS4PjscF.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-03-07 22:31:24 UTC | 470 | OUT | |
| 2025-03-07 22:31:25 UTC | 1534 | IN | |
| 2025-03-07 22:31:25 UTC | 1534 | IN | |
| 2025-03-07 22:31:25 UTC | 118 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 16 | 192.168.2.7 | 49704 | 142.250.186.142 | 443 | 5684 | C:\Users\user\Desktop\MNLS4PjscF.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-03-07 22:31:27 UTC | 428 | OUT | |
| 2025-03-07 22:31:28 UTC | 1610 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 17 | 192.168.2.7 | 49705 | 142.250.186.33 | 443 | 5684 | C:\Users\user\Desktop\MNLS4PjscF.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-03-07 22:31:30 UTC | 470 | OUT | |
| 2025-03-07 22:31:31 UTC | 1533 | IN | |
| 2025-03-07 22:31:31 UTC | 1533 | IN | |
| 2025-03-07 22:31:31 UTC | 119 | IN |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
| Target ID: | 0 |
| Start time: | 17:29:24 |
| Start date: | 07/03/2025 |
| Path: | C:\Users\user\Desktop\MNLS4PjscF.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x400000 |
| File size: | 883'660 bytes |
| MD5 hash: | 7730242B95171F0CCB03E28BF8F5056B |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Reputation: | low |
| Has exited: | true |
| Target ID: | 8 |
| Start time: | 17:30:31 |
| Start date: | 07/03/2025 |
| Path: | C:\Users\user\Desktop\MNLS4PjscF.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x400000 |
| File size: | 883'660 bytes |
| MD5 hash: | 7730242B95171F0CCB03E28BF8F5056B |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | low |
| Has exited: | false |