Edit tour
Windows
Analysis Report
LisectAVT_2403002B_14.dll
Overview
General Information
| Sample name: | LisectAVT_2403002B_14.dll |
| Analysis ID: | 1482059 |
| MD5: | 2769761a23f793d93bbad3ded28e8ebd |
| SHA1: | df83ef58856650a7564b0f5d0914dc8478511ccf |
| SHA256: | 0f0a7d189ef514f97279ef24194c08ea5c99dd39a9d7af486ea8aedb68e0f18b |
| Tags: | dllexe |
| Infos: |  |
 | |
Detection
| Score: | 56 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
System process connects to network (likely due to code injection or exploit)
AI detected suspicious sample
Contains functionality to detect sleep reduction / modifications
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to get notified if a device is plugged in / out
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to shutdown / reboot the system
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found evasive API chain checking for process token information
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check if the current machine is a sandbox (GetTickCount - Sleep)
May sleep (evasive loops) to hinder dynamic analysis
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Communication To Uncommon Destination Ports
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Classification
- System is w10x64
loaddll32.exe (PID: 6812 cmdline: loaddll32. exe "C:\Us ers\user\D esktop\Lis ectAVT_240 3002B_14.d ll" MD5: 51E6071F9CBA48E79F10C84515AAE618) 
conhost.exe (PID: 1320 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 5836 cmdline:
cmd.exe /C rundll32. exe "C:\Us ers\user\D esktop\Lis ectAVT_240 3002B_14.d ll",#1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) 
rundll32.exe (PID: 3192 cmdline: rundll32.e xe "C:\Use rs\user\De sktop\Lise ctAVT_2403 002B_14.dl l",#1 MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 5696 cmdline:
rundll32.e xe C:\User s\user\Des ktop\Lisec tAVT_24030 02B_14.dll ,GnrkBltvk x MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 504 cmdline:
rundll32.e xe C:\User s\user\Des ktop\Lisec tAVT_24030 02B_14.dll ,GnrkBmoaa r MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 2168 cmdline:
rundll32.e xe C:\User s\user\Des ktop\Lisec tAVT_24030 02B_14.dll ,GnrkCyrpw MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 6748 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\Lise ctAVT_2403 002B_14.dl l",GnrkBlt vkx MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 1492 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\Lise ctAVT_2403 002B_14.dl l",GnrkBmo aar MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 1416 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\Lise ctAVT_2403 002B_14.dl l",GnrkCyr pw MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 5936 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\Lise ctAVT_2403 002B_14.dl l",GnrkZtd ij MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 516 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\Lise ctAVT_2403 002B_14.dl l",GnrkZew k MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 5028 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\Lise ctAVT_2403 002B_14.dl l",GnrkXzw np MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 3516 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\Lise ctAVT_2403 002B_14.dl l",GnrkXal bb MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 5068 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\Lise ctAVT_2403 002B_14.dl l",GnrkWye y MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 6960 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\Lise ctAVT_2403 002B_14.dl l",GnrkWtl rh MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 4980 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\Lise ctAVT_2403 002B_14.dl l",GnrkWsn q MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 876 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\Lise ctAVT_2403 002B_14.dl l",GnrkWap q MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 5348 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\Lise ctAVT_2403 002B_14.dl l",GnrkVnn dq MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 3204 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\Lise ctAVT_2403 002B_14.dl l",GnrkUsm c MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 2268 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\Lise ctAVT_2403 002B_14.dl l",GnrkTrg MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 3892 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\Lise ctAVT_2403 002B_14.dl l",GnrkTjx do MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 6448 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\Lise ctAVT_2403 002B_14.dl l",GnrkTch MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 3576 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\Lise ctAVT_2403 002B_14.dl l",GnrkTcf v MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 1396 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\Lise ctAVT_2403 002B_14.dl l",GnrkSts o MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 4148 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\Lise ctAVT_2403 002B_14.dl l",GnrkSf MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 6432 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\Lise ctAVT_2403 002B_14.dl l",GnrkSbq MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 6600 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\Lise ctAVT_2403 002B_14.dl l",GnrkRrd cfn MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 2196 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\Lise ctAVT_2403 002B_14.dl l",GnrkQul on MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 2144 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\Lise ctAVT_2403 002B_14.dl l",GnrkQr MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 5276 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\Lise ctAVT_2403 002B_14.dl l",GnrkQm MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 6968 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\Lise ctAVT_2403 002B_14.dl l",GnrkPp MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 5388 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\Lise ctAVT_2403 002B_14.dl l",GnrkOxf t MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 2864 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\Lise ctAVT_2403 002B_14.dl l",GnrkOks gc MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 3896 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\Lise ctAVT_2403 002B_14.dl l",GnrkOi MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 3796 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\Lise ctAVT_2403 002B_14.dl l",GnrkOhq bhe MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 3924 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\Lise ctAVT_2403 002B_14.dl l",GnrkOda MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 5272 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\Lise ctAVT_2403 002B_14.dl l",GnrkNsd wzc MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 2828 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\Lise ctAVT_2403 002B_14.dl l",GnrkNr MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 6764 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\Lise ctAVT_2403 002B_14.dl l",GnrkNof ovl MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 5432 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\Lise ctAVT_2403 002B_14.dl l",GnrkNlq h MD5: 889B99C52A60DD49227C5E485A016679)
- cleanup
⊘No configs have been found
⊘No yara matches
| Source: | Author: Florian Roth (Nextron Systems): | ||
⊘No Snort rule has matched
| Timestamp: | 2024-07-25T17:57:11.023216+0200 |
| SID: | 2036858 |
| Source Port: | 49733 |
| Destination Port: | 80 |
| Protocol: | TCP |
| Classtype: | Malware Command and Control Activity Detected |
| Timestamp: | 2024-07-25T17:55:50.513790+0200 |
| SID: | 2036858 |
| Source Port: | 49723 |
| Destination Port: | 80 |
| Protocol: | TCP |
| Classtype: | Malware Command and Control Activity Detected |
| Timestamp: | 2024-07-25T17:56:37.112001+0200 |
| SID: | 2036858 |
| Source Port: | 49729 |
| Destination Port: | 8080 |
| Protocol: | TCP |
| Classtype: | Malware Command and Control Activity Detected |
| Timestamp: | 2024-07-25T17:55:09.573145+0200 |
| SID: | 2022930 |
| Source Port: | 443 |
| Destination Port: | 49720 |
| Protocol: | TCP |
| Classtype: | A Network Trojan was detected |
| Timestamp: | 2024-07-25T17:55:33.455482+0200 |
| SID: | 2036858 |
| Source Port: | 49721 |
| Destination Port: | 80 |
| Protocol: | TCP |
| Classtype: | Malware Command and Control Activity Detected |
| Timestamp: | 2024-07-25T17:57:16.369027+0200 |
| SID: | 2036858 |
| Source Port: | 49734 |
| Destination Port: | 80 |
| Protocol: | TCP |
| Classtype: | Malware Command and Control Activity Detected |
| Timestamp: | 2024-07-25T17:56:23.050140+0200 |
| SID: | 2036858 |
| Source Port: | 49726 |
| Destination Port: | 8080 |
| Protocol: | TCP |
| Classtype: | Malware Command and Control Activity Detected |
| Timestamp: | 2024-07-25T17:55:11.045496+0200 |
| SID: | 2036858 |
| Source Port: | 49718 |
| Destination Port: | 80 |
| Protocol: | TCP |
| Classtype: | Malware Command and Control Activity Detected |
| Timestamp: | 2024-07-25T17:54:31.588390+0200 |
| SID: | 2022930 |
| Source Port: | 443 |
| Destination Port: | 49713 |
| Protocol: | TCP |
| Classtype: | A Network Trojan was detected |
| Timestamp: | 2024-07-25T17:57:05.987539+0200 |
| SID: | 2036858 |
| Source Port: | 49732 |
| Destination Port: | 80 |
| Protocol: | TCP |
| Classtype: | Malware Command and Control Activity Detected |
| Timestamp: | 2024-07-25T17:56:32.080676+0200 |
| SID: | 2036858 |
| Source Port: | 49728 |
| Destination Port: | 8080 |
| Protocol: | TCP |
| Classtype: | Malware Command and Control Activity Detected |
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | Integrated Neural Analysis Model: | ||
| Source: | Code function: | 0_2_6CD591E0 | |
| Source: | Code function: | 30_2_6CD591E0 | |
| Source: | Static PE information: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Static PE information: | ||
| Source: | Code function: | 0_2_6CD52C90 | |
Networking | |
|---|
| Source: | Network Connect: | ||
| Source: | Domain query: | ||
| Source: | TCP traffic: | ||
| Source: | IP Address: | ||
| Source: | IP Address: | ||
| Source: | ASN Name: | ||
| Source: | JA3 fingerprint: | ||
| Source: | JA3 fingerprint: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | Code function: | 30_2_6CD72DE0 | |
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Code function: | 0_2_6CD51880 | |
| Source: | Code function: | 30_2_6CD51880 | |
| Source: | Code function: | 0_2_6CD5E040 | |
| Source: | Code function: | 0_2_6CD5E2F0 | |
| Source: | Code function: | 0_2_6CD5E308 | |
| Source: | Code function: | 0_2_6CD5E32D | |
| Source: | Code function: | 30_2_6CD5E040 | |
| Source: | Code function: | 30_2_6CD5E2F0 | |
| Source: | Code function: | 30_2_6CD5E308 | |
| Source: | Code function: | 30_2_6CD5E32D | |
| Source: | Binary or memory string: | ||
| Source: | Static PE information: | ||
| Source: | Classification label: | ||
| Source: | Code function: | 30_2_6CD66580 | |
| Source: | Code function: | 0_2_6CD56690 | |
| Source: | Code function: | 0_2_6CD56690 | |
| Source: | Code function: | 30_2_6CD56690 | |
| Source: | Mutant created: | ||
| Source: | Static PE information: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | File read: | ||
| Source: | File read: | ||
| Source: | Process created: | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Key value queried: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Code function: | 0_2_6CD528E0 | |
| Source: | Code function: | 0_2_6CD56690 | |
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | |||
| Source: | Process information set: | |||
| Source: | Process information set: | |||
| Source: | Process information set: | |||
| Source: | Process information set: | |||
| Source: | Process information set: | |||
| Source: | Process information set: | |||
| Source: | Process information set: | |||
| Source: | Process information set: | |||
| Source: | Process information set: | |||
| Source: | Process information set: | |||
| Source: | Process information set: | |||
| Source: | Process information set: | |||
| Source: | Process information set: | |||
| Source: | Process information set: | |||
| Source: | Process information set: | |||
| Source: | Process information set: | |||
| Source: | Process information set: | |||
| Source: | Process information set: | |||
Malware Analysis System Evasion | |
|---|
| Source: | Code function: | 0_2_6CD51000 | |
| Source: | Code function: | 30_2_6CD51000 | |
| Source: | Window / User API: | ||
| Source: | Window / User API: | ||
| Source: | Check user administrative privileges: | graph_30-20634 | ||
| Source: | Code function: | 0_2_6CD51000 | |
| Source: | Code function: | 30_2_6CD51000 | |
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep count: | |||
| Source: | Thread sleep count: | |||
| Source: | Thread sleep count: | |||
| Source: | Thread sleep count: | |||
| Source: | Thread sleep count: | |||
| Source: | Thread sleep count: | |||
| Source: | Thread sleep count: | |||
| Source: | Thread sleep time: | |||
| Source: | Thread sleep count: | |||
| Source: | Thread sleep time: | |||
| Source: | Thread sleep count: | |||
| Source: | Thread sleep count: | |||
| Source: | Thread sleep count: | |||
| Source: | Thread sleep count: | |||
| Source: | Thread sleep count: | |||
| Source: | Thread sleep count: | |||
| Source: | Thread sleep count: | |||
| Source: | Thread sleep count: | |||
| Source: | Thread sleep count: | |||
| Source: | Thread sleep count: | |||
| Source: | Thread sleep count: | |||
| Source: | Last function: | ||
| Source: | Binary or memory string: | ||
| Source: | Code function: | 0_2_6CD528E0 | |
HIPS / PFW / Operating System Protection Evasion | |
|---|
| Source: | Network Connect: | ||
| Source: | Domain query: | ||
| Source: | Code function: | 0_2_6CD56B50 | |
| Source: | Process created: | Jump to behavior | ||
| Source: | Code function: | 30_2_6CD72B70 | |
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | 1 Valid Accounts | 2 Service Execution | 1 Valid Accounts | 1 Valid Accounts | 1 Valid Accounts | OS Credential Dumping | 111 Security Software Discovery | Remote Services | 1 Archive Collected Data | 21 Encrypted Channel | Exfiltration Over Other Network Medium | 1 System Shutdown/Reboot |
| Credentials | Domains | Default Accounts | 2 Native API | 3 Windows Service | 11 Access Token Manipulation | 1 Virtualization/Sandbox Evasion | LSASS Memory | 1 Virtualization/Sandbox Evasion | Remote Desktop Protocol | Data from Removable Media | 1 Non-Standard Port | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | 1 DLL Side-Loading | 3 Windows Service | 11 Access Token Manipulation | Security Account Manager | 1 Peripheral Device Discovery | SMB/Windows Admin Shares | Data from Network Shared Drive | 2 Ingress Tool Transfer | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | 111 Process Injection | 111 Process Injection | NTDS | 1 Application Window Discovery | Distributed Component Object Model | Input Capture | 3 Non-Application Layer Protocol | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | 1 DLL Side-Loading | 1 Rundll32 | LSA Secrets | 1 Remote System Discovery | SSH | Keylogging | 14 Application Layer Protocol | Scheduled Transfer | Data Encrypted for Impact |
| Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | 1 DLL Side-Loading | Cached Domain Credentials | 1 System Information Discovery | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| ec2-52-90-110-169.compute-1.amazonaws.com | 52.90.110.169 | true | true | unknown |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| true |
| unknown | |
| true |
| unknown | |
| true |
| unknown | |
| true |
| unknown | |
| true |
| unknown | |
| true |
| unknown | |
| true |
| unknown | |
| true |
| unknown | |
| true |
| unknown |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 40.113.110.67 | unknown | United States | 8075 | MICROSOFT-CORP-MSN-AS-BLOCKUS | false | |
| 1.1.1.1 | unknown | Australia | 13335 | CLOUDFLARENETUS | false | |
| 40.115.3.253 | unknown | United States | 8075 | MICROSOFT-CORP-MSN-AS-BLOCKUS | false | |
| 52.165.165.26 | unknown | United States | 8075 | MICROSOFT-CORP-MSN-AS-BLOCKUS | false | |
| 52.90.110.169 | ec2-52-90-110-169.compute-1.amazonaws.com | United States | 14618 | AMAZON-AESUS | true | |
| 162.159.36.2 | unknown | United States | 13335 | CLOUDFLARENETUS | false | |
| 2.19.97.171 | unknown | European Union | 20940 | AKAMAI-ASN1EU | false |
| IP |
|---|
| 192.168.2.1 |
| 192.168.2.7 |
| 192.168.2.4 |
| 192.168.2.6 |
| Joe Sandbox version: | 40.0.0 Tourmaline |
| Analysis ID: | 1482059 |
| Start date and time: | 2024-07-25 17:53:23 +02:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 7m 19s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Run name: | Run with higher sleep bypass |
| Number of analysed new started processes analysed: | 42 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | LisectAVT_2403002B_14.dll |
| Detection: | MAL |
| Classification: | mal56.evad.winDLL@93/0@1/11 |
| EGA Information: |
|
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): dllhost.exe
- Excluded IPs from analysis (whitelisted): 192.229.221.95, 2.19.126.137
- Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
- Not all processes where analyzed, report is missing behavior information
- Report size exceeded maximum capacity and may have missing behavior information.
- Report size getting too big, too many NtProtectVirtualMemory calls found.
- Report size getting too big, too many NtQueryValueKey calls found.
- VT rate limit hit for: LisectAVT_2403002B_14.dll
| Time | Type | Description |
|---|---|---|
| 11:55:21 | API Interceptor |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 40.113.110.67 | Get hash | malicious | ManusCrypt, Nitol | Browse | ||
| Get hash | malicious | ManusCrypt, Nitol | Browse | |||
| Get hash | malicious | ManusCrypt, Nitol | Browse | |||
| 1.1.1.1 | Get hash | malicious | FormBook, NSISDropper | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | FormBook | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| 40.115.3.253 | Get hash | malicious | Unknown | Browse | ||
| Get hash | malicious | ManusCrypt, Nitol | Browse | |||
| Get hash | malicious | ManusCrypt, Nitol | Browse | |||
| Get hash | malicious | ManusCrypt, Nitol | Browse | |||
| Get hash | malicious | ManusCrypt, Nitol | Browse | |||
| Get hash | malicious | ManusCrypt | Browse | |||
| Get hash | malicious | ManusCrypt | Browse | |||
| 52.165.165.26 | Get hash | malicious | Unknown | Browse | ||
| Get hash | malicious | Amadey, Babadeda, Glupteba, Mystic Stealer, RedLine, SmokeLoader, zgRAT | Browse | |||
| 52.90.110.169 | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| ec2-52-90-110-169.compute-1.amazonaws.com | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| CLOUDFLARENETUS | Get hash | malicious | AgentTesla | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | CobaltStrike | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | CobaltStrike | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | FormBook | Browse |
| ||
| Get hash | malicious | Lokibot | Browse |
| ||
| MICROSOFT-CORP-MSN-AS-BLOCKUS | Get hash | malicious | XRed | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | XRed | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| AMAZON-AESUS | Get hash | malicious | Bdaejec, BlackMoon | Browse |
| |
| Get hash | malicious | Bdaejec, Gandcrab | Browse |
| ||
| Get hash | malicious | Bdaejec, BlackMoon | Browse |
| ||
| Get hash | malicious | Bdaejec | Browse |
| ||
| Get hash | malicious | Bdaejec | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Bdaejec | Browse |
| ||
| Get hash | malicious | Bdaejec | Browse |
| ||
| MICROSOFT-CORP-MSN-AS-BLOCKUS | Get hash | malicious | XRed | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | XRed | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| MICROSOFT-CORP-MSN-AS-BLOCKUS | Get hash | malicious | XRed | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | XRed | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 28a2c9bd18a11de089ef85a160da29e4 | Get hash | malicious | HTMLPhisher | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| 3b5074b1b5d032e5620f69f9f700ff0e | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | AgentTesla | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
|
⊘No context
⊘No created / dropped files found
| File type: | |
| Entropy (8bit): | 6.588882386142034 |
| TrID: |
|
| File name: | LisectAVT_2403002B_14.dll |
| File size: | 190'976 bytes |
| MD5: | 2769761a23f793d93bbad3ded28e8ebd |
| SHA1: | df83ef58856650a7564b0f5d0914dc8478511ccf |
| SHA256: | 0f0a7d189ef514f97279ef24194c08ea5c99dd39a9d7af486ea8aedb68e0f18b |
| SHA512: | 9af46e2c44a63dc4a07cc7d75fb24d82174801e87b0cf95f3ca8b86613ba20de93c0cc246d20a7487f05ce5825c1a6824e8ef31dc2a3b196b079527186fde047 |
| SSDEEP: | 3072:M2U6Z3AUyPihSJjBIYj5MxPYlGUySgWmVNlFJa34kg:M2JVwihSJjOYWPkOXXB |
| TLSH: | 9E144A14E5018339F8BF00FAC7BD273D696C9A72879926C323C55C5A66867E3BE35183 |
| File Content Preview: | MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........X..............A...............y.......I.......H.......O.....Rich............PE..L......N...........!.....d...6............. |
 | |
| Icon Hash: | 7ae282899bbab082 |
| Entrypoint: | 0x737d1880 |
| Entrypoint Section: | .text |
| Digitally signed: | false |
| Imagebase: | 0x737d0000 |
| Subsystem: | windows gui |
| Image File Characteristics: | EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL |
| DLL Characteristics: | DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x4EE21DCE [Fri Dec 9 14:40:14 2011 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 5 |
| OS Version Minor: | 1 |
| File Version Major: | 5 |
| File Version Minor: | 1 |
| Subsystem Version Major: | 5 |
| Subsystem Version Minor: | 1 |
| Import Hash: | a87240b873c1a5b2b17c559a4ce533e7 |
| Instruction |
|---|
| push ebp |
| mov ebp, esp |
| push ecx |
| mov eax, dword ptr [73800628h] |
| and eax, 01h |
| jne 00007F97047E9BADh |
| mov ecx, dword ptr [73800628h] |
| or ecx, 01h |
| mov dword ptr [73800628h], ecx |
| mov edx, dword ptr [737F8194h] |
| mov dword ptr [73800624h], edx |
| mov eax, dword ptr [ebp+0Ch] |
| mov dword ptr [ebp-04h], eax |
| cmp dword ptr [ebp-04h], 00000000h |
| je 00007F97047E9BA1h |
| cmp dword ptr [ebp-04h], 01h |
| je 00007F97047E9B94h |
| jmp 00007F97047E9B9Eh |
| call 00007F97047E9363h |
| jmp 00007F97047E9B97h |
| call 00007F97047E938Ch |
| mov eax, 00000001h |
| mov esp, ebp |
| pop ebp |
| retn 000Ch |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| push ebp |
| mov ebp, esp |
| sub esp, 08h |
| mov eax, dword ptr [737F8120h] |
| mov dword ptr [ebp-04h], eax |
| mov dword ptr [ebp-08h], 00000000h |
| call 00007F97047E932Bh |
| call 00007F97047FF966h |
| mov dword ptr [ebp-08h], eax |
| mov ecx, dword ptr [ebp-08h] |
| push ecx |
| call 00007F97047EA43Ah |
| push eax |
| call 00007F97047EA4F4h |
| test eax, eax |
| jne 00007F97047E9B9Bh |
| mov edx, dword ptr [ebp-08h] |
| push edx |
| call 00007F97047EA607h |
| call 00007F97047E9332h |
| mov eax, dword ptr [ebp-08h] |
| mov esp, ebp |
| pop ebp |
| ret |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| push ebp |
| mov ebp, esp |
| pop ebp |
| ret |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| push ebp |
| mov ebp, esp |
| pop ebp |
| ret |
| int3 |
| int3 |
| Programming Language: |
|
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x2bfc0 | 0x3d4 | .rdata |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0x2b590 | 0x64 | .rdata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x9a000 | 0x3e0 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x9b000 | 0x2188 | .reloc |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x28000 | 0x1b4 | .rdata |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x262de | 0x26400 | a12ac472b50da1763b63988f2d9724c4 | False | 0.4705371732026144 | data | 6.374301962893391 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .rdata | 0x28000 | 0x4394 | 0x4400 | 82b918d77a044f40686ae5809c89ddbd | False | 0.759765625 | data | 7.055205472510572 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .data | 0x2d000 | 0x6c551 | 0xa00 | c81870d3c545b9989522cccbbdbde726 | False | 0.913671875 | data | 7.449705734565964 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .rsrc | 0x9a000 | 0x3e0 | 0x400 | 6117fb448b882a3030c2aff8efcd289b | False | 0.4248046875 | data | 3.0643979755835313 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .reloc | 0x9b000 | 0x26fc | 0x2800 | 745f439c351f3878b92a5df493588d95 | False | 0.62431640625 | data | 6.137144019251764 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| RT_DIALOG | 0x9a340 | 0x9c | data | Chinese | China | 0.6794871794871795 |
| RT_VERSION | 0x9a0a0 | 0x29c | data | Chinese | China | 0.4550898203592814 |
| DLL | Import |
|---|---|
| KERNEL32.dll | EnumTimeFormatsW, GlobalAddAtomW, TryEnterCriticalSection, HeapAlloc, EnumResourceNamesW, GlobalFix, HeapCompact, TlsSetValue, FindResourceExA, MoveFileA, CompareFileTime, WriteProfileSectionW, InitializeSListHead, UpdateResourceA, ClearCommBreak, GetDevicePowerState, Sleep, EnumResourceTypesW, SetConsoleTitleA, IsSystemResumeAutomatic, GetShortPathNameA, GetPrivateProfileStringW, IsBadStringPtrA, CreateMailslotW, LoadLibraryA, GetProcAddress, PeekConsoleInputA, GetSystemWindowsDirectoryW, OpenWaitableTimerA, CreateFileW, GetLastError, SetFilePointer, WriteFile, CloseHandle, SetConsoleActiveScreenBuffer, SetCurrentDirectoryW, EnumSystemCodePagesA, GetCalendarInfoA, GetTickCount, FindResourceW |
| USER32.dll | DefDlgProcA, DrawAnimatedRects, ArrangeIconicWindows, SetWindowRgn, HideCaret, ScrollWindowEx, ShowWindowAsync, RegisterClipboardFormatA, AnimateWindow, FillRect, GetClassInfoExW, IsDialogMessageW, CharLowerBuffA, LoadStringW, GetKBCodePage, DlgDirSelectComboBoxExA, ClipCursor, IsWindowUnicode, SendMessageTimeoutA, PostMessageA, OemToCharA, GetClipboardFormatNameA, UnregisterDeviceNotification, ExitWindowsEx, SetPropA, SystemParametersInfoA, UnregisterClassA, GetDlgItemInt, IsWindowEnabled, LoadCursorFromFileA |
| GDI32.dll | CloseFigure, SetBitmapBits, GetPixel, PlayMetaFileRecord, GetMiterLimit, GetEnhMetaFileHeader, SetICMProfileA, SetColorSpace, SetICMMode, SetTextColor, SetDeviceGammaRamp, SelectPalette, GetWindowExtEx, CreateEnhMetaFileA, DeleteDC, LPtoDP, GetBitmapBits |
| ADVAPI32.dll | IsValidSid, SetSecurityDescriptorSacl, RegDisablePredefinedCache, FileEncryptionStatusW, LookupPrivilegeNameW, OpenBackupEventLogW, LogonUserW, RegEnumKeyW, StartServiceCtrlDispatcherW, InitiateSystemShutdownExW, SetKernelObjectSecurity, AreAllAccessesGranted, QueryServiceConfigA, LookupPrivilegeNameA, RegOpenUserClassesRoot, ImpersonateLoggedOnUser, ReadEventLogW, RegEnumKeyExA |
| Name | Ordinal | Address |
|---|---|---|
| GnrkBltvkx | 1 | 0x737d1a90 |
| GnrkBmoaar | 2 | 0x737d1aa0 |
| GnrkCyrpw | 3 | 0x737d1a40 |
| GnrkEkp | 4 | 0x737d1be0 |
| GnrkEnjzs | 5 | 0x737d1d80 |
| GnrkFa | 6 | 0x737d1d60 |
| GnrkFsx | 7 | 0x737d1940 |
| GnrkGm | 8 | 0x737d1c70 |
| GnrkGt | 9 | 0x737d1b30 |
| GnrkHhcpo | 10 | 0x737d1c20 |
| GnrkHjtl | 11 | 0x737d1c10 |
| GnrkIiip | 12 | 0x737d1d90 |
| GnrkJird | 13 | 0x737d1d50 |
| GnrkJstv | 14 | 0x737d1e20 |
| GnrkKhlhca | 15 | 0x737d1e10 |
| GnrkKhqbbu | 16 | 0x737d1f00 |
| GnrkLmkamk | 17 | 0x737d1dc0 |
| GnrkLoc | 18 | 0x737d1a10 |
| GnrkNlqh | 19 | 0x737d1e00 |
| GnrkNofovl | 20 | 0x737d1da0 |
| GnrkNr | 21 | 0x737d1970 |
| GnrkNsdwzc | 22 | 0x737d1a70 |
| GnrkOda | 23 | 0x737d1ca0 |
| GnrkOhqbhe | 24 | 0x737d1ee0 |
| GnrkOi | 25 | 0x737d1db0 |
| GnrkOksgc | 26 | 0x737d1cb0 |
| GnrkOxft | 27 | 0x737d1960 |
| GnrkPp | 28 | 0x737d1b00 |
| GnrkQm | 29 | 0x737d1bf0 |
| GnrkQr | 30 | 0x737d1770 |
| GnrkQulon | 31 | 0x737d1c90 |
| GnrkRrdcfn | 32 | 0x737d1c50 |
| GnrkSbq | 33 | 0x737d1990 |
| GnrkSf | 34 | 0x737d1ec0 |
| GnrkStso | 35 | 0x737d1ae0 |
| GnrkTcfv | 36 | 0x737d1eb0 |
| GnrkTch | 37 | 0x737d1c30 |
| GnrkTjxdo | 38 | 0x737d1ab0 |
| GnrkTrg | 39 | 0x737d1e60 |
| GnrkUsmc | 40 | 0x737d1930 |
| GnrkVnndq | 41 | 0x737d1b10 |
| GnrkWapq | 42 | 0x737d1de0 |
| GnrkWsnq | 43 | 0x737d1ad0 |
| GnrkWtlrh | 44 | 0x737d1c00 |
| GnrkWyey | 45 | 0x737d1c40 |
| GnrkXalbb | 46 | 0x737d1950 |
| GnrkXzwnp | 47 | 0x737d1a50 |
| GnrkZewk | 48 | 0x737d1d20 |
| GnrkZtdij | 49 | 0x737d1b70 |
| Language of compilation system | Country where language is spoken | Map |
|---|---|---|
| Chinese | China |  |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | Protocol | SID | Signature | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|---|---|---|
| 2024-07-25T17:57:11.023216+0200 | TCP | 2036858 | ET MALWARE PlugX CnC Beacon | 49733 | 80 | 192.168.2.6 | 52.90.110.169 |
| 2024-07-25T17:55:50.513790+0200 | TCP | 2036858 | ET MALWARE PlugX CnC Beacon | 49723 | 80 | 192.168.2.6 | 52.90.110.169 |
| 2024-07-25T17:56:37.112001+0200 | TCP | 2036858 | ET MALWARE PlugX CnC Beacon | 49729 | 8080 | 192.168.2.6 | 52.90.110.169 |
| 2024-07-25T17:55:09.573145+0200 | TCP | 2022930 | ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow | 443 | 49720 | 52.165.165.26 | 192.168.2.6 |
| 2024-07-25T17:55:33.455482+0200 | TCP | 2036858 | ET MALWARE PlugX CnC Beacon | 49721 | 80 | 192.168.2.6 | 52.90.110.169 |
| 2024-07-25T17:57:16.369027+0200 | TCP | 2036858 | ET MALWARE PlugX CnC Beacon | 49734 | 80 | 192.168.2.6 | 52.90.110.169 |
| 2024-07-25T17:56:23.050140+0200 | TCP | 2036858 | ET MALWARE PlugX CnC Beacon | 49726 | 8080 | 192.168.2.6 | 52.90.110.169 |
| 2024-07-25T17:55:11.045496+0200 | TCP | 2036858 | ET MALWARE PlugX CnC Beacon | 49718 | 80 | 192.168.2.6 | 52.90.110.169 |
| 2024-07-25T17:54:31.588390+0200 | TCP | 2022930 | ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow | 443 | 49713 | 52.165.165.26 | 192.168.2.6 |
| 2024-07-25T17:57:05.987539+0200 | TCP | 2036858 | ET MALWARE PlugX CnC Beacon | 49732 | 80 | 192.168.2.6 | 52.90.110.169 |
| 2024-07-25T17:56:32.080676+0200 | TCP | 2036858 | ET MALWARE PlugX CnC Beacon | 49728 | 8080 | 192.168.2.6 | 52.90.110.169 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Jul 25, 2024 17:54:10.689420938 CEST | 49674 | 443 | 192.168.2.6 | 173.222.162.64 |
| Jul 25, 2024 17:54:10.689469099 CEST | 49673 | 443 | 192.168.2.6 | 173.222.162.64 |
| Jul 25, 2024 17:54:11.017412901 CEST | 49672 | 443 | 192.168.2.6 | 173.222.162.64 |
| Jul 25, 2024 17:54:17.826790094 CEST | 49710 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:54:17.826845884 CEST | 443 | 49710 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:54:17.826919079 CEST | 49710 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:54:17.827599049 CEST | 49710 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:54:17.827613115 CEST | 443 | 49710 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:54:18.752722979 CEST | 443 | 49710 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:54:18.752827883 CEST | 49710 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:54:18.758467913 CEST | 49710 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:54:18.758491993 CEST | 443 | 49710 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:54:18.758790970 CEST | 443 | 49710 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:54:18.760627031 CEST | 49710 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:54:18.760688066 CEST | 49710 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:54:18.760699034 CEST | 443 | 49710 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:54:18.760873079 CEST | 49710 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:54:18.808512926 CEST | 443 | 49710 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:54:18.942621946 CEST | 443 | 49710 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:54:18.943001986 CEST | 443 | 49710 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:54:18.943121910 CEST | 49710 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:54:18.943309069 CEST | 49710 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:54:18.943332911 CEST | 443 | 49710 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:54:18.943351030 CEST | 49710 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:54:20.298732996 CEST | 49674 | 443 | 192.168.2.6 | 173.222.162.64 |
| Jul 25, 2024 17:54:20.298733950 CEST | 49673 | 443 | 192.168.2.6 | 173.222.162.64 |
| Jul 25, 2024 17:54:20.626837015 CEST | 49672 | 443 | 192.168.2.6 | 173.222.162.64 |
| Jul 25, 2024 17:54:22.400389910 CEST | 443 | 49705 | 173.222.162.64 | 192.168.2.6 |
| Jul 25, 2024 17:54:22.400582075 CEST | 49705 | 443 | 192.168.2.6 | 173.222.162.64 |
| Jul 25, 2024 17:54:26.147855997 CEST | 49711 | 80 | 192.168.2.6 | 52.90.110.169 |
| Jul 25, 2024 17:54:26.153084993 CEST | 80 | 49711 | 52.90.110.169 | 192.168.2.6 |
| Jul 25, 2024 17:54:26.153155088 CEST | 49711 | 80 | 192.168.2.6 | 52.90.110.169 |
| Jul 25, 2024 17:54:26.153551102 CEST | 49711 | 80 | 192.168.2.6 | 52.90.110.169 |
| Jul 25, 2024 17:54:26.163907051 CEST | 80 | 49711 | 52.90.110.169 | 192.168.2.6 |
| Jul 25, 2024 17:54:26.166481018 CEST | 49712 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:54:26.166532993 CEST | 443 | 49712 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:54:26.166754007 CEST | 49712 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:54:26.167644024 CEST | 49712 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:54:26.167656898 CEST | 443 | 49712 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:54:27.028791904 CEST | 443 | 49712 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:54:27.029649019 CEST | 49712 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:54:27.030607939 CEST | 49712 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:54:27.030620098 CEST | 443 | 49712 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:54:27.030847073 CEST | 443 | 49712 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:54:27.032768965 CEST | 49712 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:54:27.032922983 CEST | 49712 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:54:27.032922983 CEST | 49712 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:54:27.032927990 CEST | 443 | 49712 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:54:27.076498032 CEST | 443 | 49712 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:54:27.212403059 CEST | 443 | 49712 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:54:27.212488890 CEST | 443 | 49712 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:54:27.212953091 CEST | 49712 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:54:27.212953091 CEST | 49712 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:54:27.212982893 CEST | 443 | 49712 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:54:27.213006020 CEST | 49712 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:54:30.532378912 CEST | 49713 | 443 | 192.168.2.6 | 52.165.165.26 |
| Jul 25, 2024 17:54:30.532429934 CEST | 443 | 49713 | 52.165.165.26 | 192.168.2.6 |
| Jul 25, 2024 17:54:30.532510996 CEST | 49713 | 443 | 192.168.2.6 | 52.165.165.26 |
| Jul 25, 2024 17:54:30.533443928 CEST | 49713 | 443 | 192.168.2.6 | 52.165.165.26 |
| Jul 25, 2024 17:54:30.533454895 CEST | 443 | 49713 | 52.165.165.26 | 192.168.2.6 |
| Jul 25, 2024 17:54:31.313271046 CEST | 443 | 49713 | 52.165.165.26 | 192.168.2.6 |
| Jul 25, 2024 17:54:31.313343048 CEST | 49713 | 443 | 192.168.2.6 | 52.165.165.26 |
| Jul 25, 2024 17:54:31.316278934 CEST | 49713 | 443 | 192.168.2.6 | 52.165.165.26 |
| Jul 25, 2024 17:54:31.316289902 CEST | 443 | 49713 | 52.165.165.26 | 192.168.2.6 |
| Jul 25, 2024 17:54:31.316526890 CEST | 443 | 49713 | 52.165.165.26 | 192.168.2.6 |
| Jul 25, 2024 17:54:31.340521097 CEST | 49713 | 443 | 192.168.2.6 | 52.165.165.26 |
| Jul 25, 2024 17:54:31.384506941 CEST | 443 | 49713 | 52.165.165.26 | 192.168.2.6 |
| Jul 25, 2024 17:54:31.582511902 CEST | 443 | 49713 | 52.165.165.26 | 192.168.2.6 |
| Jul 25, 2024 17:54:31.582567930 CEST | 443 | 49713 | 52.165.165.26 | 192.168.2.6 |
| Jul 25, 2024 17:54:31.582609892 CEST | 443 | 49713 | 52.165.165.26 | 192.168.2.6 |
| Jul 25, 2024 17:54:31.582704067 CEST | 49713 | 443 | 192.168.2.6 | 52.165.165.26 |
| Jul 25, 2024 17:54:31.582732916 CEST | 443 | 49713 | 52.165.165.26 | 192.168.2.6 |
| Jul 25, 2024 17:54:31.582874060 CEST | 49713 | 443 | 192.168.2.6 | 52.165.165.26 |
| Jul 25, 2024 17:54:31.587287903 CEST | 443 | 49713 | 52.165.165.26 | 192.168.2.6 |
| Jul 25, 2024 17:54:31.587384939 CEST | 49713 | 443 | 192.168.2.6 | 52.165.165.26 |
| Jul 25, 2024 17:54:31.587393045 CEST | 443 | 49713 | 52.165.165.26 | 192.168.2.6 |
| Jul 25, 2024 17:54:31.588156939 CEST | 443 | 49713 | 52.165.165.26 | 192.168.2.6 |
| Jul 25, 2024 17:54:31.588175058 CEST | 49713 | 443 | 192.168.2.6 | 52.165.165.26 |
| Jul 25, 2024 17:54:31.588197947 CEST | 443 | 49713 | 52.165.165.26 | 192.168.2.6 |
| Jul 25, 2024 17:54:31.588212013 CEST | 49713 | 443 | 192.168.2.6 | 52.165.165.26 |
| Jul 25, 2024 17:54:31.588217974 CEST | 443 | 49713 | 52.165.165.26 | 192.168.2.6 |
| Jul 25, 2024 17:54:31.588227987 CEST | 49713 | 443 | 192.168.2.6 | 52.165.165.26 |
| Jul 25, 2024 17:54:31.588231087 CEST | 443 | 49713 | 52.165.165.26 | 192.168.2.6 |
| Jul 25, 2024 17:54:38.978712082 CEST | 49717 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:54:38.978799105 CEST | 443 | 49717 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:54:38.978890896 CEST | 49717 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:54:38.979571104 CEST | 49717 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:54:38.979598999 CEST | 443 | 49717 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:54:40.482805967 CEST | 443 | 49717 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:54:40.483047009 CEST | 49717 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:54:40.488200903 CEST | 49717 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:54:40.488229036 CEST | 443 | 49717 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:54:40.489084005 CEST | 443 | 49717 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:54:40.490931988 CEST | 49717 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:54:40.491008043 CEST | 49717 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:54:40.491019011 CEST | 443 | 49717 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:54:40.491117954 CEST | 49717 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:54:40.532555103 CEST | 443 | 49717 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:54:41.144376993 CEST | 443 | 49717 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:54:41.144543886 CEST | 443 | 49717 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:54:41.144911051 CEST | 49717 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:54:41.144947052 CEST | 443 | 49717 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:54:41.144965887 CEST | 49717 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:54:41.144972086 CEST | 443 | 49717 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:54:47.540843010 CEST | 80 | 49711 | 52.90.110.169 | 192.168.2.6 |
| Jul 25, 2024 17:54:47.541023970 CEST | 49711 | 80 | 192.168.2.6 | 52.90.110.169 |
| Jul 25, 2024 17:54:47.541112900 CEST | 49711 | 80 | 192.168.2.6 | 52.90.110.169 |
| Jul 25, 2024 17:54:47.545984030 CEST | 80 | 49711 | 52.90.110.169 | 192.168.2.6 |
| Jul 25, 2024 17:54:49.657166004 CEST | 49718 | 80 | 192.168.2.6 | 52.90.110.169 |
| Jul 25, 2024 17:54:49.662364960 CEST | 80 | 49718 | 52.90.110.169 | 192.168.2.6 |
| Jul 25, 2024 17:54:49.662476063 CEST | 49718 | 80 | 192.168.2.6 | 52.90.110.169 |
| Jul 25, 2024 17:54:49.663119078 CEST | 49718 | 80 | 192.168.2.6 | 52.90.110.169 |
| Jul 25, 2024 17:54:49.668275118 CEST | 80 | 49718 | 52.90.110.169 | 192.168.2.6 |
| Jul 25, 2024 17:55:01.619185925 CEST | 49719 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:55:01.619240999 CEST | 443 | 49719 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:55:01.619326115 CEST | 49719 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:55:01.620003939 CEST | 49719 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:55:01.620021105 CEST | 443 | 49719 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:55:03.536003113 CEST | 443 | 49719 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:55:03.536245108 CEST | 49719 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:55:03.538173914 CEST | 49719 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:55:03.538192034 CEST | 443 | 49719 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:55:03.538497925 CEST | 443 | 49719 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:55:03.540375948 CEST | 49719 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:55:03.540465117 CEST | 49719 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:55:03.540472984 CEST | 443 | 49719 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:55:03.540621996 CEST | 49719 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:55:03.584502935 CEST | 443 | 49719 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:55:03.715455055 CEST | 443 | 49719 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:55:03.715533018 CEST | 443 | 49719 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:55:03.715668917 CEST | 49719 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:55:03.715843916 CEST | 49719 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:55:03.715857983 CEST | 443 | 49719 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:55:07.749150038 CEST | 49720 | 443 | 192.168.2.6 | 52.165.165.26 |
| Jul 25, 2024 17:55:07.749183893 CEST | 443 | 49720 | 52.165.165.26 | 192.168.2.6 |
| Jul 25, 2024 17:55:07.749275923 CEST | 49720 | 443 | 192.168.2.6 | 52.165.165.26 |
| Jul 25, 2024 17:55:07.749644995 CEST | 49720 | 443 | 192.168.2.6 | 52.165.165.26 |
| Jul 25, 2024 17:55:07.749658108 CEST | 443 | 49720 | 52.165.165.26 | 192.168.2.6 |
| Jul 25, 2024 17:55:09.299978018 CEST | 443 | 49720 | 52.165.165.26 | 192.168.2.6 |
| Jul 25, 2024 17:55:09.300040007 CEST | 49720 | 443 | 192.168.2.6 | 52.165.165.26 |
| Jul 25, 2024 17:55:09.302829981 CEST | 49720 | 443 | 192.168.2.6 | 52.165.165.26 |
| Jul 25, 2024 17:55:09.302843094 CEST | 443 | 49720 | 52.165.165.26 | 192.168.2.6 |
| Jul 25, 2024 17:55:09.303076029 CEST | 443 | 49720 | 52.165.165.26 | 192.168.2.6 |
| Jul 25, 2024 17:55:09.306896925 CEST | 49720 | 443 | 192.168.2.6 | 52.165.165.26 |
| Jul 25, 2024 17:55:09.348546982 CEST | 443 | 49720 | 52.165.165.26 | 192.168.2.6 |
| Jul 25, 2024 17:55:09.568620920 CEST | 443 | 49720 | 52.165.165.26 | 192.168.2.6 |
| Jul 25, 2024 17:55:09.568660021 CEST | 443 | 49720 | 52.165.165.26 | 192.168.2.6 |
| Jul 25, 2024 17:55:09.568676949 CEST | 443 | 49720 | 52.165.165.26 | 192.168.2.6 |
| Jul 25, 2024 17:55:09.568955898 CEST | 49720 | 443 | 192.168.2.6 | 52.165.165.26 |
| Jul 25, 2024 17:55:09.568980932 CEST | 443 | 49720 | 52.165.165.26 | 192.168.2.6 |
| Jul 25, 2024 17:55:09.569041014 CEST | 49720 | 443 | 192.168.2.6 | 52.165.165.26 |
| Jul 25, 2024 17:55:09.572948933 CEST | 443 | 49720 | 52.165.165.26 | 192.168.2.6 |
| Jul 25, 2024 17:55:09.572990894 CEST | 443 | 49720 | 52.165.165.26 | 192.168.2.6 |
| Jul 25, 2024 17:55:09.573036909 CEST | 443 | 49720 | 52.165.165.26 | 192.168.2.6 |
| Jul 25, 2024 17:55:09.573069096 CEST | 49720 | 443 | 192.168.2.6 | 52.165.165.26 |
| Jul 25, 2024 17:55:09.573122025 CEST | 49720 | 443 | 192.168.2.6 | 52.165.165.26 |
| Jul 25, 2024 17:55:09.573201895 CEST | 49720 | 443 | 192.168.2.6 | 52.165.165.26 |
| Jul 25, 2024 17:55:09.573219061 CEST | 443 | 49720 | 52.165.165.26 | 192.168.2.6 |
| Jul 25, 2024 17:55:09.573230028 CEST | 49720 | 443 | 192.168.2.6 | 52.165.165.26 |
| Jul 25, 2024 17:55:09.573235035 CEST | 443 | 49720 | 52.165.165.26 | 192.168.2.6 |
| Jul 25, 2024 17:55:11.045417070 CEST | 80 | 49718 | 52.90.110.169 | 192.168.2.6 |
| Jul 25, 2024 17:55:11.045495987 CEST | 49718 | 80 | 192.168.2.6 | 52.90.110.169 |
| Jul 25, 2024 17:55:11.046040058 CEST | 49718 | 80 | 192.168.2.6 | 52.90.110.169 |
| Jul 25, 2024 17:55:11.053024054 CEST | 80 | 49718 | 52.90.110.169 | 192.168.2.6 |
| Jul 25, 2024 17:55:12.059077024 CEST | 49721 | 80 | 192.168.2.6 | 52.90.110.169 |
| Jul 25, 2024 17:55:12.064285994 CEST | 80 | 49721 | 52.90.110.169 | 192.168.2.6 |
| Jul 25, 2024 17:55:12.065888882 CEST | 49721 | 80 | 192.168.2.6 | 52.90.110.169 |
| Jul 25, 2024 17:55:12.066039085 CEST | 49721 | 80 | 192.168.2.6 | 52.90.110.169 |
| Jul 25, 2024 17:55:12.073990107 CEST | 80 | 49721 | 52.90.110.169 | 192.168.2.6 |
| Jul 25, 2024 17:55:25.458007097 CEST | 49722 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:55:25.458076954 CEST | 443 | 49722 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:55:25.458177090 CEST | 49722 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:55:25.458863974 CEST | 49722 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:55:25.458878040 CEST | 443 | 49722 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:55:26.593583107 CEST | 443 | 49722 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:55:26.593772888 CEST | 49722 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:55:26.595622063 CEST | 49722 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:55:26.595655918 CEST | 443 | 49722 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:55:26.595918894 CEST | 443 | 49722 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:55:26.597933054 CEST | 49722 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:55:26.598052025 CEST | 49722 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:55:26.598063946 CEST | 443 | 49722 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:55:26.598223925 CEST | 49722 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:55:26.644507885 CEST | 443 | 49722 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:55:26.788438082 CEST | 443 | 49722 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:55:26.789216995 CEST | 49722 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:55:26.789297104 CEST | 443 | 49722 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:55:26.789369106 CEST | 49722 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:55:26.789536953 CEST | 443 | 49722 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:55:26.789623976 CEST | 49722 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:55:26.789680958 CEST | 49722 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:55:33.455132008 CEST | 80 | 49721 | 52.90.110.169 | 192.168.2.6 |
| Jul 25, 2024 17:55:33.455482006 CEST | 49721 | 80 | 192.168.2.6 | 52.90.110.169 |
| Jul 25, 2024 17:55:33.455589056 CEST | 49721 | 80 | 192.168.2.6 | 52.90.110.169 |
| Jul 25, 2024 17:55:33.465553999 CEST | 80 | 49721 | 52.90.110.169 | 192.168.2.6 |
| Jul 25, 2024 17:55:34.471539021 CEST | 49723 | 80 | 192.168.2.6 | 52.90.110.169 |
| Jul 25, 2024 17:55:34.476825953 CEST | 80 | 49723 | 52.90.110.169 | 192.168.2.6 |
| Jul 25, 2024 17:55:34.476921082 CEST | 49723 | 80 | 192.168.2.6 | 52.90.110.169 |
| Jul 25, 2024 17:55:34.477086067 CEST | 49723 | 80 | 192.168.2.6 | 52.90.110.169 |
| Jul 25, 2024 17:55:34.488125086 CEST | 80 | 49723 | 52.90.110.169 | 192.168.2.6 |
| Jul 25, 2024 17:55:50.424643040 CEST | 49704 | 80 | 192.168.2.6 | 2.19.97.171 |
| Jul 25, 2024 17:55:50.458551884 CEST | 80 | 49704 | 2.19.97.171 | 192.168.2.6 |
| Jul 25, 2024 17:55:50.458667994 CEST | 49704 | 80 | 192.168.2.6 | 2.19.97.171 |
| Jul 25, 2024 17:55:50.513789892 CEST | 49723 | 80 | 192.168.2.6 | 52.90.110.169 |
| Jul 25, 2024 17:55:51.565897942 CEST | 49724 | 8080 | 192.168.2.6 | 52.90.110.169 |
| Jul 25, 2024 17:55:51.573383093 CEST | 8080 | 49724 | 52.90.110.169 | 192.168.2.6 |
| Jul 25, 2024 17:55:51.576596022 CEST | 49724 | 8080 | 192.168.2.6 | 52.90.110.169 |
| Jul 25, 2024 17:55:51.576884985 CEST | 49724 | 8080 | 192.168.2.6 | 52.90.110.169 |
| Jul 25, 2024 17:55:51.581801891 CEST | 8080 | 49724 | 52.90.110.169 | 192.168.2.6 |
| Jul 25, 2024 17:55:52.871532917 CEST | 49725 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:55:52.871598005 CEST | 443 | 49725 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:55:52.871834040 CEST | 49725 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:55:52.872520924 CEST | 49725 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:55:52.872549057 CEST | 443 | 49725 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:55:53.689729929 CEST | 443 | 49725 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:55:53.689821959 CEST | 49725 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:55:53.691708088 CEST | 49725 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:55:53.691720009 CEST | 443 | 49725 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:55:53.692012072 CEST | 443 | 49725 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:55:53.703605890 CEST | 49725 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:55:53.703691959 CEST | 49725 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:55:53.703696966 CEST | 443 | 49725 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:55:53.703846931 CEST | 49725 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:55:53.744491100 CEST | 443 | 49725 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:55:53.892640114 CEST | 443 | 49725 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:55:53.892719030 CEST | 443 | 49725 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:55:53.893162966 CEST | 49725 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:55:53.893198013 CEST | 443 | 49725 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:55:53.893205881 CEST | 49725 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:55:53.893213034 CEST | 443 | 49725 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:55:53.893224001 CEST | 49725 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:56:12.946147919 CEST | 8080 | 49724 | 52.90.110.169 | 192.168.2.6 |
| Jul 25, 2024 17:56:12.946253061 CEST | 49724 | 8080 | 192.168.2.6 | 52.90.110.169 |
| Jul 25, 2024 17:56:12.949676991 CEST | 49724 | 8080 | 192.168.2.6 | 52.90.110.169 |
| Jul 25, 2024 17:56:12.954898119 CEST | 8080 | 49724 | 52.90.110.169 | 192.168.2.6 |
| Jul 25, 2024 17:56:14.977638960 CEST | 49726 | 8080 | 192.168.2.6 | 52.90.110.169 |
| Jul 25, 2024 17:56:14.988527060 CEST | 8080 | 49726 | 52.90.110.169 | 192.168.2.6 |
| Jul 25, 2024 17:56:14.989790916 CEST | 49726 | 8080 | 192.168.2.6 | 52.90.110.169 |
| Jul 25, 2024 17:56:15.027879000 CEST | 49726 | 8080 | 192.168.2.6 | 52.90.110.169 |
| Jul 25, 2024 17:56:15.035418034 CEST | 8080 | 49726 | 52.90.110.169 | 192.168.2.6 |
| Jul 25, 2024 17:56:21.433706999 CEST | 49727 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:56:21.433753014 CEST | 443 | 49727 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:56:21.433811903 CEST | 49727 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:56:21.434535980 CEST | 49727 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:56:21.434552908 CEST | 443 | 49727 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:56:22.567063093 CEST | 443 | 49727 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:56:22.567321062 CEST | 49727 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:56:22.574461937 CEST | 49727 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:56:22.574481964 CEST | 443 | 49727 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:56:22.574771881 CEST | 443 | 49727 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:56:22.576752901 CEST | 49727 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:56:22.576829910 CEST | 49727 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:56:22.576834917 CEST | 443 | 49727 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:56:22.576961994 CEST | 49727 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:56:22.620549917 CEST | 443 | 49727 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:56:22.750425100 CEST | 443 | 49727 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:56:22.750833035 CEST | 443 | 49727 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:56:22.751246929 CEST | 49727 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:56:22.751312971 CEST | 443 | 49727 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:56:22.751324892 CEST | 49727 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:56:22.751324892 CEST | 49727 | 443 | 192.168.2.6 | 40.113.110.67 |
| Jul 25, 2024 17:56:22.751337051 CEST | 443 | 49727 | 40.113.110.67 | 192.168.2.6 |
| Jul 25, 2024 17:56:23.050139904 CEST | 49726 | 8080 | 192.168.2.6 | 52.90.110.169 |
| Jul 25, 2024 17:56:24.065493107 CEST | 49728 | 8080 | 192.168.2.6 | 52.90.110.169 |
| Jul 25, 2024 17:56:24.070488930 CEST | 8080 | 49728 | 52.90.110.169 | 192.168.2.6 |
| Jul 25, 2024 17:56:24.070573092 CEST | 49728 | 8080 | 192.168.2.6 | 52.90.110.169 |
| Jul 25, 2024 17:56:24.070729971 CEST | 49728 | 8080 | 192.168.2.6 | 52.90.110.169 |
| Jul 25, 2024 17:56:24.075514078 CEST | 8080 | 49728 | 52.90.110.169 | 192.168.2.6 |
| Jul 25, 2024 17:56:32.080676079 CEST | 49728 | 8080 | 192.168.2.6 | 52.90.110.169 |
| Jul 25, 2024 17:56:33.097110033 CEST | 49729 | 8080 | 192.168.2.6 | 52.90.110.169 |
| Jul 25, 2024 17:56:33.106733084 CEST | 8080 | 49729 | 52.90.110.169 | 192.168.2.6 |
| Jul 25, 2024 17:56:33.110219955 CEST | 49729 | 8080 | 192.168.2.6 | 52.90.110.169 |
| Jul 25, 2024 17:56:33.110414028 CEST | 49729 | 8080 | 192.168.2.6 | 52.90.110.169 |
| Jul 25, 2024 17:56:33.116117954 CEST | 8080 | 49729 | 52.90.110.169 | 192.168.2.6 |
| Jul 25, 2024 17:56:37.112000942 CEST | 49729 | 8080 | 192.168.2.6 | 52.90.110.169 |
| Jul 25, 2024 17:56:38.206617117 CEST | 49730 | 80 | 192.168.2.6 | 52.90.110.169 |
| Jul 25, 2024 17:56:38.509855986 CEST | 80 | 49730 | 52.90.110.169 | 192.168.2.6 |
| Jul 25, 2024 17:56:38.509924889 CEST | 49730 | 80 | 192.168.2.6 | 52.90.110.169 |
| Jul 25, 2024 17:56:38.510205984 CEST | 49730 | 80 | 192.168.2.6 | 52.90.110.169 |
| Jul 25, 2024 17:56:38.516333103 CEST | 80 | 49730 | 52.90.110.169 | 192.168.2.6 |
| Jul 25, 2024 17:56:50.637783051 CEST | 49731 | 443 | 192.168.2.6 | 40.115.3.253 |
| Jul 25, 2024 17:56:50.637823105 CEST | 443 | 49731 | 40.115.3.253 | 192.168.2.6 |
| Jul 25, 2024 17:56:50.637947083 CEST | 49731 | 443 | 192.168.2.6 | 40.115.3.253 |
| Jul 25, 2024 17:56:50.638761044 CEST | 49731 | 443 | 192.168.2.6 | 40.115.3.253 |
| Jul 25, 2024 17:56:50.638777971 CEST | 443 | 49731 | 40.115.3.253 | 192.168.2.6 |
| Jul 25, 2024 17:56:51.530021906 CEST | 443 | 49731 | 40.115.3.253 | 192.168.2.6 |
| Jul 25, 2024 17:56:51.530323029 CEST | 49731 | 443 | 192.168.2.6 | 40.115.3.253 |
| Jul 25, 2024 17:56:51.532392979 CEST | 49731 | 443 | 192.168.2.6 | 40.115.3.253 |
| Jul 25, 2024 17:56:51.532404900 CEST | 443 | 49731 | 40.115.3.253 | 192.168.2.6 |
| Jul 25, 2024 17:56:51.532783031 CEST | 443 | 49731 | 40.115.3.253 | 192.168.2.6 |
| Jul 25, 2024 17:56:51.534595966 CEST | 49731 | 443 | 192.168.2.6 | 40.115.3.253 |
| Jul 25, 2024 17:56:51.534672022 CEST | 49731 | 443 | 192.168.2.6 | 40.115.3.253 |
| Jul 25, 2024 17:56:51.534677982 CEST | 443 | 49731 | 40.115.3.253 | 192.168.2.6 |
| Jul 25, 2024 17:56:51.534815073 CEST | 49731 | 443 | 192.168.2.6 | 40.115.3.253 |
| Jul 25, 2024 17:56:51.580492020 CEST | 443 | 49731 | 40.115.3.253 | 192.168.2.6 |
| Jul 25, 2024 17:56:51.737180948 CEST | 443 | 49731 | 40.115.3.253 | 192.168.2.6 |
| Jul 25, 2024 17:56:51.738842010 CEST | 49731 | 443 | 192.168.2.6 | 40.115.3.253 |
| Jul 25, 2024 17:56:51.738871098 CEST | 443 | 49731 | 40.115.3.253 | 192.168.2.6 |
| Jul 25, 2024 17:56:51.738884926 CEST | 49731 | 443 | 192.168.2.6 | 40.115.3.253 |
| Jul 25, 2024 17:56:51.738949060 CEST | 49731 | 443 | 192.168.2.6 | 40.115.3.253 |
| Jul 25, 2024 17:56:59.947873116 CEST | 80 | 49730 | 52.90.110.169 | 192.168.2.6 |
| Jul 25, 2024 17:56:59.948014975 CEST | 49730 | 80 | 192.168.2.6 | 52.90.110.169 |
| Jul 25, 2024 17:56:59.948060989 CEST | 49730 | 80 | 192.168.2.6 | 52.90.110.169 |
| Jul 25, 2024 17:56:59.953325033 CEST | 80 | 49730 | 52.90.110.169 | 192.168.2.6 |
| Jul 25, 2024 17:57:01.977514982 CEST | 49732 | 80 | 192.168.2.6 | 52.90.110.169 |
| Jul 25, 2024 17:57:01.982506037 CEST | 80 | 49732 | 52.90.110.169 | 192.168.2.6 |
| Jul 25, 2024 17:57:01.982621908 CEST | 49732 | 80 | 192.168.2.6 | 52.90.110.169 |
| Jul 25, 2024 17:57:01.982738972 CEST | 49732 | 80 | 192.168.2.6 | 52.90.110.169 |
| Jul 25, 2024 17:57:01.987514019 CEST | 80 | 49732 | 52.90.110.169 | 192.168.2.6 |
| Jul 25, 2024 17:57:05.987539053 CEST | 49732 | 80 | 192.168.2.6 | 52.90.110.169 |
| Jul 25, 2024 17:57:07.008379936 CEST | 49733 | 80 | 192.168.2.6 | 52.90.110.169 |
| Jul 25, 2024 17:57:07.013673067 CEST | 80 | 49733 | 52.90.110.169 | 192.168.2.6 |
| Jul 25, 2024 17:57:07.013787031 CEST | 49733 | 80 | 192.168.2.6 | 52.90.110.169 |
| Jul 25, 2024 17:57:07.014034986 CEST | 49733 | 80 | 192.168.2.6 | 52.90.110.169 |
| Jul 25, 2024 17:57:07.019023895 CEST | 80 | 49733 | 52.90.110.169 | 192.168.2.6 |
| Jul 25, 2024 17:57:11.023216009 CEST | 49733 | 80 | 192.168.2.6 | 52.90.110.169 |
| Jul 25, 2024 17:57:12.039932966 CEST | 49734 | 80 | 192.168.2.6 | 52.90.110.169 |
| Jul 25, 2024 17:57:12.045190096 CEST | 80 | 49734 | 52.90.110.169 | 192.168.2.6 |
| Jul 25, 2024 17:57:12.045269012 CEST | 49734 | 80 | 192.168.2.6 | 52.90.110.169 |
| Jul 25, 2024 17:57:12.045528889 CEST | 49734 | 80 | 192.168.2.6 | 52.90.110.169 |
| Jul 25, 2024 17:57:12.050493956 CEST | 80 | 49734 | 52.90.110.169 | 192.168.2.6 |
| Jul 25, 2024 17:57:16.369026899 CEST | 49734 | 80 | 192.168.2.6 | 52.90.110.169 |
| Jul 25, 2024 17:57:17.565691948 CEST | 49735 | 80 | 192.168.2.6 | 52.90.110.169 |
| Jul 25, 2024 17:57:17.572041035 CEST | 80 | 49735 | 52.90.110.169 | 192.168.2.6 |
| Jul 25, 2024 17:57:17.572134972 CEST | 49735 | 80 | 192.168.2.6 | 52.90.110.169 |
| Jul 25, 2024 17:57:17.572288990 CEST | 49735 | 80 | 192.168.2.6 | 52.90.110.169 |
| Jul 25, 2024 17:57:17.577965021 CEST | 80 | 49735 | 52.90.110.169 | 192.168.2.6 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Jul 25, 2024 17:54:26.117017031 CEST | 58485 | 53 | 192.168.2.6 | 8.8.8.8 |
| Jul 25, 2024 17:54:26.127499104 CEST | 53 | 58485 | 8.8.8.8 | 192.168.2.6 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Jul 25, 2024 17:54:26.117017031 CEST | 192.168.2.6 | 8.8.8.8 | 0x296e | Standard query (0) | A (IP address) | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Jul 25, 2024 17:54:26.127499104 CEST | 8.8.8.8 | 192.168.2.6 | 0x296e | No error (0) | 52.90.110.169 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.6 | 49711 | 52.90.110.169 | 80 | 2144 | C:\Windows\SysWOW64\rundll32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Jul 25, 2024 17:54:26.153551102 CEST | 72 | OUT |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.6 | 49718 | 52.90.110.169 | 80 | 2144 | C:\Windows\SysWOW64\rundll32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Jul 25, 2024 17:54:49.663119078 CEST | 258 | OUT |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 2 | 192.168.2.6 | 49721 | 52.90.110.169 | 80 | 2144 | C:\Windows\SysWOW64\rundll32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Jul 25, 2024 17:55:12.066039085 CEST | 258 | OUT |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 3 | 192.168.2.6 | 49723 | 52.90.110.169 | 80 | 2144 | C:\Windows\SysWOW64\rundll32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Jul 25, 2024 17:55:34.477086067 CEST | 258 | OUT |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 4 | 192.168.2.6 | 49726 | 52.90.110.169 | 8080 | 2144 | C:\Windows\SysWOW64\rundll32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Jul 25, 2024 17:56:15.027879000 CEST | 263 | OUT |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 5 | 192.168.2.6 | 49728 | 52.90.110.169 | 8080 | 2144 | C:\Windows\SysWOW64\rundll32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Jul 25, 2024 17:56:24.070729971 CEST | 263 | OUT |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 6 | 192.168.2.6 | 49729 | 52.90.110.169 | 8080 | 2144 | C:\Windows\SysWOW64\rundll32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Jul 25, 2024 17:56:33.110414028 CEST | 263 | OUT |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 7 | 192.168.2.6 | 49730 | 52.90.110.169 | 80 | 2144 | C:\Windows\SysWOW64\rundll32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Jul 25, 2024 17:56:38.510205984 CEST | 70 | OUT |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 8 | 192.168.2.6 | 49732 | 52.90.110.169 | 80 | 2144 | C:\Windows\SysWOW64\rundll32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Jul 25, 2024 17:57:01.982738972 CEST | 258 | OUT |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 9 | 192.168.2.6 | 49733 | 52.90.110.169 | 80 | 2144 | C:\Windows\SysWOW64\rundll32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Jul 25, 2024 17:57:07.014034986 CEST | 258 | OUT |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 10 | 192.168.2.6 | 49734 | 52.90.110.169 | 80 | 2144 | C:\Windows\SysWOW64\rundll32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Jul 25, 2024 17:57:12.045528889 CEST | 258 | OUT |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 11 | 192.168.2.6 | 49735 | 52.90.110.169 | 80 | 2144 | C:\Windows\SysWOW64\rundll32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Jul 25, 2024 17:57:17.572288990 CEST | 20 | OUT |
| Session ID | Source IP | Source Port | Destination IP | Destination Port |
|---|---|---|---|---|
| 0 | 192.168.2.6 | 49710 | 40.113.110.67 | 443 |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-07-25 15:54:18 UTC | 71 | OUT | |
| 2024-07-25 15:54:18 UTC | 249 | OUT | |
| 2024-07-25 15:54:18 UTC | 1064 | OUT | |
| 2024-07-25 15:54:18 UTC | 218 | OUT |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.6 | 49710 | 40.113.110.67 | 443 | 2144 | C:\Windows\SysWOW64\rundll32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-07-25 15:54:18 UTC | 14 | IN | |
| 2024-07-25 15:54:18 UTC | 58 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port |
|---|---|---|---|---|
| 2 | 192.168.2.6 | 49712 | 40.113.110.67 | 443 |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-07-25 15:54:27 UTC | 71 | OUT | |
| 2024-07-25 15:54:27 UTC | 249 | OUT | |
| 2024-07-25 15:54:27 UTC | 1064 | OUT | |
| 2024-07-25 15:54:27 UTC | 218 | OUT |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 3 | 192.168.2.6 | 49712 | 40.113.110.67 | 443 | 2144 | C:\Windows\SysWOW64\rundll32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-07-25 15:54:27 UTC | 14 | IN | |
| 2024-07-25 15:54:27 UTC | 58 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port |
|---|---|---|---|---|
| 4 | 192.168.2.6 | 49713 | 52.165.165.26 | 443 |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-07-25 15:54:31 UTC | 306 | OUT |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 5 | 192.168.2.6 | 49713 | 52.165.165.26 | 443 | 2144 | C:\Windows\SysWOW64\rundll32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-07-25 15:54:31 UTC | 560 | IN | |
| 2024-07-25 15:54:31 UTC | 15824 | IN | |
| 2024-07-25 15:54:31 UTC | 8666 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port |
|---|---|---|---|---|
| 6 | 192.168.2.6 | 49717 | 40.113.110.67 | 443 |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-07-25 15:54:40 UTC | 71 | OUT | |
| 2024-07-25 15:54:40 UTC | 249 | OUT | |
| 2024-07-25 15:54:40 UTC | 1064 | OUT | |
| 2024-07-25 15:54:40 UTC | 218 | OUT |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 7 | 192.168.2.6 | 49717 | 40.113.110.67 | 443 | 2144 | C:\Windows\SysWOW64\rundll32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-07-25 15:54:41 UTC | 14 | IN | |
| 2024-07-25 15:54:41 UTC | 58 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port |
|---|---|---|---|---|
| 8 | 192.168.2.6 | 49719 | 40.113.110.67 | 443 |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-07-25 15:55:03 UTC | 71 | OUT | |
| 2024-07-25 15:55:03 UTC | 249 | OUT | |
| 2024-07-25 15:55:03 UTC | 1064 | OUT | |
| 2024-07-25 15:55:03 UTC | 218 | OUT |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 9 | 192.168.2.6 | 49719 | 40.113.110.67 | 443 | 2144 | C:\Windows\SysWOW64\rundll32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-07-25 15:55:03 UTC | 14 | IN | |
| 2024-07-25 15:55:03 UTC | 58 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port |
|---|---|---|---|---|
| 10 | 192.168.2.6 | 49720 | 52.165.165.26 | 443 |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-07-25 15:55:09 UTC | 306 | OUT |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 11 | 192.168.2.6 | 49720 | 52.165.165.26 | 443 | 2144 | C:\Windows\SysWOW64\rundll32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-07-25 15:55:09 UTC | 560 | IN | |
| 2024-07-25 15:55:09 UTC | 15824 | IN | |
| 2024-07-25 15:55:09 UTC | 14181 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port |
|---|---|---|---|---|
| 12 | 192.168.2.6 | 49722 | 40.113.110.67 | 443 |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-07-25 15:55:26 UTC | 71 | OUT | |
| 2024-07-25 15:55:26 UTC | 249 | OUT | |
| 2024-07-25 15:55:26 UTC | 1064 | OUT | |
| 2024-07-25 15:55:26 UTC | 218 | OUT |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 13 | 192.168.2.6 | 49722 | 40.113.110.67 | 443 | 2144 | C:\Windows\SysWOW64\rundll32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-07-25 15:55:26 UTC | 14 | IN | |
| 2024-07-25 15:55:26 UTC | 58 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port |
|---|---|---|---|---|
| 14 | 192.168.2.6 | 49725 | 40.113.110.67 | 443 |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-07-25 15:55:53 UTC | 71 | OUT | |
| 2024-07-25 15:55:53 UTC | 249 | OUT | |
| 2024-07-25 15:55:53 UTC | 1064 | OUT | |
| 2024-07-25 15:55:53 UTC | 218 | OUT |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 15 | 192.168.2.6 | 49725 | 40.113.110.67 | 443 | 2144 | C:\Windows\SysWOW64\rundll32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-07-25 15:55:53 UTC | 14 | IN | |
| 2024-07-25 15:55:53 UTC | 58 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port |
|---|---|---|---|---|
| 16 | 192.168.2.6 | 49727 | 40.113.110.67 | 443 |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-07-25 15:56:22 UTC | 71 | OUT | |
| 2024-07-25 15:56:22 UTC | 249 | OUT | |
| 2024-07-25 15:56:22 UTC | 1064 | OUT | |
| 2024-07-25 15:56:22 UTC | 218 | OUT |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 17 | 192.168.2.6 | 49727 | 40.113.110.67 | 443 | 2144 | C:\Windows\SysWOW64\rundll32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-07-25 15:56:22 UTC | 14 | IN | |
| 2024-07-25 15:56:22 UTC | 58 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port |
|---|---|---|---|---|
| 18 | 192.168.2.6 | 49731 | 40.115.3.253 | 443 |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-07-25 15:56:51 UTC | 71 | OUT | |
| 2024-07-25 15:56:51 UTC | 249 | OUT | |
| 2024-07-25 15:56:51 UTC | 1064 | OUT | |
| 2024-07-25 15:56:51 UTC | 218 | OUT |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 19 | 192.168.2.6 | 49731 | 40.115.3.253 | 443 | 2144 | C:\Windows\SysWOW64\rundll32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-07-25 15:56:51 UTC | 14 | IN | |
| 2024-07-25 15:56:51 UTC | 58 | IN |
Click to jump to process
Click to jump to process
Click to jump to process
| Target ID: | 0 |
| Start time: | 11:54:11 |
| Start date: | 25/07/2024 |
| Path: | C:\Windows\System32\loaddll32.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x3a0000 |
| File size: | 126'464 bytes |
| MD5 hash: | 51E6071F9CBA48E79F10C84515AAE618 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | false |
| Target ID: | 1 |
| Start time: | 11:54:11 |
| Start date: | 25/07/2024 |
| Path: | C:\Windows\System32\conhost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff66e660000 |
| File size: | 862'208 bytes |
| MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | false |
| Target ID: | 3 |
| Start time: | 11:54:11 |
| Start date: | 25/07/2024 |
| Path: | C:\Windows\SysWOW64\cmd.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x1c0000 |
| File size: | 236'544 bytes |
| MD5 hash: | D0FCE3AFA6AA1D58CE9FA336CC2B675B |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 4 |
| Start time: | 11:54:11 |
| Start date: | 25/07/2024 |
| Path: | C:\Windows\SysWOW64\rundll32.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x4d0000 |
| File size: | 61'440 bytes |
| MD5 hash: | 889B99C52A60DD49227C5E485A016679 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 5 |
| Start time: | 11:54:11 |
| Start date: | 25/07/2024 |
| Path: | C:\Windows\SysWOW64\rundll32.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x4d0000 |
| File size: | 61'440 bytes |
| MD5 hash: | 889B99C52A60DD49227C5E485A016679 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 6 |
| Start time: | 11:54:14 |
| Start date: | 25/07/2024 |
| Path: | C:\Windows\SysWOW64\rundll32.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x4d0000 |
| File size: | 61'440 bytes |
| MD5 hash: | 889B99C52A60DD49227C5E485A016679 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 7 |
| Start time: | 11:54:17 |
| Start date: | 25/07/2024 |
| Path: | C:\Windows\SysWOW64\rundll32.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x4d0000 |
| File size: | 61'440 bytes |
| MD5 hash: | 889B99C52A60DD49227C5E485A016679 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 8 |
| Start time: | 11:54:22 |
| Start date: | 25/07/2024 |
| Path: | C:\Windows\SysWOW64\rundll32.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x4d0000 |
| File size: | 61'440 bytes |
| MD5 hash: | 889B99C52A60DD49227C5E485A016679 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 9 |
| Start time: | 11:54:22 |
| Start date: | 25/07/2024 |
| Path: | C:\Windows\SysWOW64\rundll32.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x4d0000 |
| File size: | 61'440 bytes |
| MD5 hash: | 889B99C52A60DD49227C5E485A016679 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 10 |
| Start time: | 11:54:22 |
| Start date: | 25/07/2024 |
| Path: | C:\Windows\SysWOW64\rundll32.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x4d0000 |
| File size: | 61'440 bytes |
| MD5 hash: | 889B99C52A60DD49227C5E485A016679 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 11 |
| Start time: | 11:54:22 |
| Start date: | 25/07/2024 |
| Path: | C:\Windows\SysWOW64\rundll32.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x4d0000 |
| File size: | 61'440 bytes |
| MD5 hash: | 889B99C52A60DD49227C5E485A016679 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 12 |
| Start time: | 11:54:22 |
| Start date: | 25/07/2024 |
| Path: | C:\Windows\SysWOW64\rundll32.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x4d0000 |
| File size: | 61'440 bytes |
| MD5 hash: | 889B99C52A60DD49227C5E485A016679 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 13 |
| Start time: | 11:54:22 |
| Start date: | 25/07/2024 |
| Path: | C:\Windows\SysWOW64\rundll32.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x4d0000 |
| File size: | 61'440 bytes |
| MD5 hash: | 889B99C52A60DD49227C5E485A016679 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Has exited: | true |
| Target ID: | 14 |
| Start time: | 11:54:22 |
| Start date: | 25/07/2024 |
| Path: | C:\Windows\SysWOW64\rundll32.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x4d0000 |
| File size: | 61'440 bytes |
| MD5 hash: | 889B99C52A60DD49227C5E485A016679 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Has exited: | true |
| Target ID: | 15 |
| Start time: | 11:54:22 |
| Start date: | 25/07/2024 |
| Path: | C:\Windows\SysWOW64\rundll32.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x4d0000 |
| File size: | 61'440 bytes |
| MD5 hash: | 889B99C52A60DD49227C5E485A016679 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Has exited: | true |
| Target ID: | 16 |
| Start time: | 11:54:22 |
| Start date: | 25/07/2024 |
| Path: | C:\Windows\SysWOW64\rundll32.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x4d0000 |
| File size: | 61'440 bytes |
| MD5 hash: | 889B99C52A60DD49227C5E485A016679 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Has exited: | true |
| Target ID: | 17 |
| Start time: | 11:54:22 |
| Start date: | 25/07/2024 |
| Path: | C:\Windows\SysWOW64\rundll32.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x4d0000 |
| File size: | 61'440 bytes |
| MD5 hash: | 889B99C52A60DD49227C5E485A016679 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Has exited: | true |
| Target ID: | 18 |
| Start time: | 11:54:22 |
| Start date: | 25/07/2024 |
| Path: | C:\Windows\SysWOW64\rundll32.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x4d0000 |
| File size: | 61'440 bytes |
| MD5 hash: | 889B99C52A60DD49227C5E485A016679 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Has exited: | true |
| Target ID: | 19 |
| Start time: | 11:54:22 |
| Start date: | 25/07/2024 |
| Path: | C:\Windows\SysWOW64\rundll32.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x4d0000 |
| File size: | 61'440 bytes |
| MD5 hash: | 889B99C52A60DD49227C5E485A016679 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Has exited: | true |
| Target ID: | 20 |
| Start time: | 11:54:22 |
| Start date: | 25/07/2024 |
| Path: | C:\Windows\SysWOW64\rundll32.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x4d0000 |
| File size: | 61'440 bytes |
| MD5 hash: | 889B99C52A60DD49227C5E485A016679 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Has exited: | true |
| Target ID: | 21 |
| Start time: | 11:54:22 |
| Start date: | 25/07/2024 |
| Path: | C:\Windows\SysWOW64\rundll32.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x4d0000 |
| File size: | 61'440 bytes |
| MD5 hash: | 889B99C52A60DD49227C5E485A016679 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Has exited: | true |
| Target ID: | 22 |
| Start time: | 11:54:22 |
| Start date: | 25/07/2024 |
| Path: | C:\Windows\SysWOW64\rundll32.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x4d0000 |
| File size: | 61'440 bytes |
| MD5 hash: | 889B99C52A60DD49227C5E485A016679 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Has exited: | true |
| Target ID: | 23 |
| Start time: | 11:54:22 |
| Start date: | 25/07/2024 |
| Path: | C:\Windows\SysWOW64\rundll32.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x4d0000 |
| File size: | 61'440 bytes |
| MD5 hash: | 889B99C52A60DD49227C5E485A016679 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Has exited: | true |
| Target ID: | 24 |
| Start time: | 11:54:22 |
| Start date: | 25/07/2024 |
| Path: | C:\Windows\SysWOW64\rundll32.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x4d0000 |
| File size: | 61'440 bytes |
| MD5 hash: | 889B99C52A60DD49227C5E485A016679 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Has exited: | true |
| Target ID: | 25 |
| Start time: | 11:54:22 |
| Start date: | 25/07/2024 |
| Path: | C:\Windows\SysWOW64\rundll32.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x4d0000 |
| File size: | 61'440 bytes |
| MD5 hash: | 889B99C52A60DD49227C5E485A016679 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Has exited: | true |
| Target ID: | 26 |
| Start time: | 11:54:22 |
| Start date: | 25/07/2024 |
| Path: | C:\Windows\SysWOW64\rundll32.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x4d0000 |
| File size: | 61'440 bytes |
| MD5 hash: | 889B99C52A60DD49227C5E485A016679 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Has exited: | true |
| Target ID: | 27 |
| Start time: | 11:54:22 |
| Start date: | 25/07/2024 |
| Path: | C:\Windows\SysWOW64\rundll32.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x4d0000 |
| File size: | 61'440 bytes |
| MD5 hash: | 889B99C52A60DD49227C5E485A016679 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Has exited: | true |
| Target ID: | 28 |
| Start time: | 11:54:22 |
| Start date: | 25/07/2024 |
| Path: | C:\Windows\SysWOW64\rundll32.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x4d0000 |
| File size: | 61'440 bytes |
| MD5 hash: | 889B99C52A60DD49227C5E485A016679 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Has exited: | true |
| Target ID: | 29 |
| Start time: | 11:54:22 |
| Start date: | 25/07/2024 |
| Path: | C:\Windows\SysWOW64\rundll32.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x4d0000 |
| File size: | 61'440 bytes |
| MD5 hash: | 889B99C52A60DD49227C5E485A016679 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Has exited: | true |
| Target ID: | 30 |
| Start time: | 11:54:22 |
| Start date: | 25/07/2024 |
| Path: | C:\Windows\SysWOW64\rundll32.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x4d0000 |
| File size: | 61'440 bytes |
| MD5 hash: | 889B99C52A60DD49227C5E485A016679 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Has exited: | false |
| Target ID: | 31 |
| Start time: | 11:54:22 |
| Start date: | 25/07/2024 |
| Path: | C:\Windows\SysWOW64\rundll32.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x4d0000 |
| File size: | 61'440 bytes |
| MD5 hash: | 889B99C52A60DD49227C5E485A016679 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Has exited: | true |
| Target ID: | 32 |
| Start time: | 11:54:22 |
| Start date: | 25/07/2024 |
| Path: | C:\Windows\SysWOW64\rundll32.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x4d0000 |
| File size: | 61'440 bytes |
| MD5 hash: | 889B99C52A60DD49227C5E485A016679 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Has exited: | true |
| Target ID: | 33 |
| Start time: | 11:54:22 |
| Start date: | 25/07/2024 |
| Path: | C:\Windows\SysWOW64\rundll32.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x4d0000 |
| File size: | 61'440 bytes |
| MD5 hash: | 889B99C52A60DD49227C5E485A016679 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Has exited: | true |
| Target ID: | 34 |
| Start time: | 11:54:22 |
| Start date: | 25/07/2024 |
| Path: | C:\Windows\SysWOW64\rundll32.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x4d0000 |
| File size: | 61'440 bytes |
| MD5 hash: | 889B99C52A60DD49227C5E485A016679 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Has exited: | true |
| Target ID: | 35 |
| Start time: | 11:54:22 |
| Start date: | 25/07/2024 |
| Path: | C:\Windows\SysWOW64\rundll32.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x4d0000 |
| File size: | 61'440 bytes |
| MD5 hash: | 889B99C52A60DD49227C5E485A016679 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Has exited: | true |
| Target ID: | 36 |
| Start time: | 11:54:23 |
| Start date: | 25/07/2024 |
| Path: | C:\Windows\SysWOW64\rundll32.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x4d0000 |
| File size: | 61'440 bytes |
| MD5 hash: | 889B99C52A60DD49227C5E485A016679 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Has exited: | true |
| Target ID: | 37 |
| Start time: | 11:54:23 |
| Start date: | 25/07/2024 |
| Path: | C:\Windows\SysWOW64\rundll32.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x4d0000 |
| File size: | 61'440 bytes |
| MD5 hash: | 889B99C52A60DD49227C5E485A016679 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Has exited: | true |
| Target ID: | 38 |
| Start time: | 11:54:23 |
| Start date: | 25/07/2024 |
| Path: | C:\Windows\SysWOW64\rundll32.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x4d0000 |
| File size: | 61'440 bytes |
| MD5 hash: | 889B99C52A60DD49227C5E485A016679 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Has exited: | true |
| Target ID: | 39 |
| Start time: | 11:54:23 |
| Start date: | 25/07/2024 |
| Path: | C:\Windows\SysWOW64\rundll32.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x4d0000 |
| File size: | 61'440 bytes |
| MD5 hash: | 889B99C52A60DD49227C5E485A016679 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Has exited: | true |
| Target ID: | 40 |
| Start time: | 11:54:23 |
| Start date: | 25/07/2024 |
| Path: | C:\Windows\SysWOW64\rundll32.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x4d0000 |
| File size: | 61'440 bytes |
| MD5 hash: | 889B99C52A60DD49227C5E485A016679 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Has exited: | true |
| Target ID: | 41 |
| Start time: | 11:54:23 |
| Start date: | 25/07/2024 |
| Path: | C:\Windows\SysWOW64\rundll32.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x4d0000 |
| File size: | 61'440 bytes |
| MD5 hash: | 889B99C52A60DD49227C5E485A016679 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Has exited: | true |
Execution Graph
| Execution Coverage: | 1.6% |
| Dynamic/Decrypted Code Coverage: | 0% |
| Signature Coverage: | 15.2% |
| Total number of Nodes: | 46 |
| Total number of Limit Nodes: | 1 |
Graph
Function 6CD51000 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 44sleepCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6CD51880 Relevance: .0, Instructions: 25COMMON
Download Yara Rule
Control-flow Graph
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6CD536C0 Relevance: 1.3, APIs: 1, Instructions: 32memoryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6CD523F0 Relevance: 1.3, APIs: 1, Instructions: 28stringCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6CD528E0 Relevance: 1.3, Strings: 1, Instructions: 62COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6CD52C90 Relevance: .3, Instructions: 345COMMONLIBRARYCODE
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6CD5E2F0 Relevance: .2, Instructions: 245COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6CD5E040 Relevance: .2, Instructions: 213COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6CD5E308 Relevance: .1, Instructions: 133COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6CD5E32D Relevance: .1, Instructions: 127COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6CD56B50 Relevance: .0, Instructions: 44COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6CD56690 Relevance: .0, Instructions: 32COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6CD591E0 Relevance: .0, Instructions: 15COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6CD52680 Relevance: 7.6, APIs: 5, Instructions: 63fileCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6CD6E650 Relevance: 6.1, APIs: 4, Instructions: 74COMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Execution Graph
| Execution Coverage: | 8.4% |
| Dynamic/Decrypted Code Coverage: | 0% |
| Signature Coverage: | 1.3% |
| Total number of Nodes: | 1175 |
| Total number of Limit Nodes: | 127 |
Graph
Function 6CD51000 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 44sleepCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6CD66580 Relevance: 1.5, APIs: 1, Instructions: 36COMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6CD72DE0 Relevance: 1.5, APIs: 1, Instructions: 32networkCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6CD72B70 Relevance: 1.5, APIs: 1, Instructions: 30networkCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6CD751A0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40networkCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6CD63D10 Relevance: 1.5, APIs: 1, Instructions: 48COMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6CD76E00 Relevance: 1.5, APIs: 1, Instructions: 42networkCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6CD750B0 Relevance: 1.5, APIs: 1, Instructions: 40networkCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6CD76FE0 Relevance: 1.5, APIs: 1, Instructions: 38networkCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6CD76F60 Relevance: 1.5, APIs: 1, Instructions: 38networkCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6CD71CA0 Relevance: 1.5, APIs: 1, Instructions: 36networkCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6CD5F810 Relevance: 1.5, APIs: 1, Instructions: 36threadCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6CD66730 Relevance: 1.5, APIs: 1, Instructions: 34COMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6CD71AF0 Relevance: 1.5, APIs: 1, Instructions: 34networkCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6CD72BE0 Relevance: 1.5, APIs: 1, Instructions: 34COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6CD63E70 Relevance: 1.5, APIs: 1, Instructions: 32timeCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6CD76D90 Relevance: 1.5, APIs: 1, Instructions: 30networkCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6CD66510 Relevance: 1.5, APIs: 1, Instructions: 30COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6CD72D10 Relevance: 1.5, APIs: 1, Instructions: 30COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6CD76E80 Relevance: 1.5, APIs: 1, Instructions: 30COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6CD527C0 Relevance: 1.5, APIs: 1, Instructions: 30memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6CD52830 Relevance: 1.5, APIs: 1, Instructions: 30memoryCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6CD72B00 Relevance: 1.5, APIs: 1, Instructions: 30networkCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6CD76CD0 Relevance: 1.5, APIs: 1, Instructions: 28networkCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6CD72C50 Relevance: 1.5, APIs: 1, Instructions: 28COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6CD74F90 Relevance: 1.5, APIs: 1, Instructions: 28threadCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6CD71C40 Relevance: 1.5, APIs: 1, Instructions: 26networkCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6CD6D910 Relevance: 1.5, APIs: 1, Instructions: 26networkCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6CD536C0 Relevance: 1.3, APIs: 1, Instructions: 32memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6CD523F0 Relevance: 1.3, APIs: 1, Instructions: 28stringCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6CD52210 Relevance: 1.3, APIs: 1, Instructions: 26sleepCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6CD52680 Relevance: 7.6, APIs: 5, Instructions: 63fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6CD6E650 Relevance: 6.1, APIs: 4, Instructions: 74COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|