Edit tour
Windows
Analysis Report
cheat_roblox.exe
Overview
General Information
| Sample name: | cheat_roblox.exe |
| Analysis ID: | 1484385 |
| MD5: | d49b1a211ce49bed3e766471501819c6 |
| SHA1: | ed8f8b0d45ad556115c14a00247c080fa82d56e9 |
| SHA256: | 1673b4f5f2d5ae3e3d2c5816534bf904ed1d2653b4a40bbb2a320231eca8259a |
| Tags: | exe |
| Infos: |  |
 | |
Detection
XWorm
| Score: | 56 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus detection for URL or domain
Antivirus detection for dropped file
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected XWorm
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Contains functionality to log keystrokes (.Net Source)
Machine Learning detection for dropped file
Machine Learning detection for sample
Tries to detect virtualization through RDTSC time measurements
Binary contains a suspicious time stamp
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to communicate with device drivers
Contains functionality to launch a program with higher privileges
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected non-DNS traffic on DNS port
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
File is packed with WinRar
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evasive API chain (date check)
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains sections with non-standard names
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Stores files to the Windows start menu directory
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Yara signature match
Classification
- System is w10x64
cheat_roblox.exe (PID: 7640 cmdline: "C:\Users\ user\Deskt op\cheat_r oblox.exe" MD5: D49B1A211CE49BED3E766471501819C6) 
cmd.exe (PID: 7764 cmdline: C:\Windows \system32\ cmd.exe /c ""C:\User s\user\App Data\Local \Temp\coin .bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 7772 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 7972 cmdline:
cmd MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 7980 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
chrome.exe (PID: 8092 cmdline: "C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --st art-maximi zed --sing le-argumen t https:// 2no.co/24R Xx6 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92) - chrome.exe (PID: 5364 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --mojo-pla tform-chan nel-handle =2172 --fi eld-trial- handle=192 0,i,106818 2183496585 4716,26122 5203469789 1369,26214 4 --disabl e-features =Optimizat ionGuideMo delDownloa ding,Optim izationHin ts,Optimiz ationHints Fetching,O ptimizatio nTargetPre diction /p refetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92) 
RobloxPlayerInstaller.exe (PID: 7788 cmdline: "C:\Users\ user\AppDa ta\Local\T emp\Roblox PlayerInst aller.exe" MD5: 27469372591B14FF1C57654FACB5E020)
- cleanup
| Name | Description | Attribution | Blogpost URLs | Link |
|---|---|---|---|---|
| XWorm | Malware with wide range of capabilities ranging from RAT to ransomware. | No Attribution |
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| MALWARE_Win_AsyncRAT | Detects AsyncRAT | ditekSHen |
| |
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| MALWARE_Win_AsyncRAT | Detects AsyncRAT | ditekSHen |
| |
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| Click to see the 1 entries | ||||
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| MALWARE_Win_AsyncRAT | Detects AsyncRAT | ditekSHen |
| |
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security |
⊘No Sigma rule has matched
⊘No Snort rule has matched
| Timestamp: | 2024-07-30T00:49:18.443625+0200 |
| SID: | 2022930 |
| Source Port: | 443 |
| Destination Port: | 49732 |
| Protocol: | TCP |
| Classtype: | A Network Trojan was detected |
| Timestamp: | 2024-07-30T00:49:42.483073+0200 |
| SID: | 2022930 |
| Source Port: | 443 |
| Destination Port: | 61123 |
| Protocol: | TCP |
| Classtype: | A Network Trojan was detected |
| Timestamp: | 2024-07-30T00:49:41.144546+0200 |
| SID: | 2022930 |
| Source Port: | 443 |
| Destination Port: | 61122 |
| Protocol: | TCP |
| Classtype: | A Network Trojan was detected |
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira: | ||
| Source: | Avira: | ||
| Source: | Avira: | ||
| Source: | ReversingLabs: | ||
| Source: | ReversingLabs: | ||
| Source: | ReversingLabs: | ||
| Source: | ReversingLabs: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Binary or memory string: | memstr_8fc75716-f | |
| Source: | HTTPS traffic detected: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Code function: | 0_2_00007FF6E7E3B190 | |
| Source: | Code function: | 0_2_00007FF6E7E240BC | |
| Source: | Code function: | 0_2_00007FF6E7E4FCA0 | |
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | IP Address: | ||
| Source: | IP Address: | ||
| Source: | IP Address: | ||
| Source: | IP Address: | ||
| Source: | JA3 fingerprint: | ||
| Source: | JA3 fingerprint: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
Key, Mouse, Clipboard, Microphone and Screen Capturing | |
|---|
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
System Summary | |
|---|
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Code function: | 0_2_00007FF6E7E1C2F0 | |
| Source: | Code function: | 0_2_00007FF6E7E24928 | |
| Source: | Code function: | 0_2_00007FF6E7E1F930 | |
| Source: | Code function: | 0_2_00007FF6E7E40754 | |
| Source: | Code function: | 0_2_00007FF6E7E2A4AC | |
| Source: | Code function: | 0_2_00007FF6E7E33484 | |
| Source: | Code function: | 0_2_00007FF6E7E3B190 | |
| Source: | Code function: | 0_2_00007FF6E7E31F20 | |
| Source: | Code function: | 0_2_00007FF6E7E3CE88 | |
| Source: | Code function: | 0_2_00007FF6E7E15E24 | |
| Source: | Code function: | 0_2_00007FF6E7E4C838 | |
| Source: | Code function: | 0_2_00007FF6E7E14840 | |
| Source: | Code function: | 0_2_00007FF6E7E176C0 | |
| Source: | Code function: | 0_2_00007FF6E7E52550 | |
| Source: | Code function: | 0_2_00007FF6E7E2B534 | |
| Source: | Code function: | 0_2_00007FF6E7E353F0 | |
| Source: | Code function: | 0_2_00007FF6E7E1A310 | |
| Source: | Code function: | 0_2_00007FF6E7E1C2F0 | |
| Source: | Code function: | 0_2_00007FF6E7E17288 | |
| Source: | Code function: | 0_2_00007FF6E7E2126C | |
| Source: | Code function: | 0_2_00007FF6E7E321D0 | |
| Source: | Code function: | 0_2_00007FF6E7E2F180 | |
| Source: | Code function: | 0_2_00007FF6E7E52080 | |
| Source: | Code function: | 0_2_00007FF6E7E2AF18 | |
| Source: | Code function: | 0_2_00007FF6E7E40754 | |
| Source: | Code function: | 0_2_00007FF6E7E38DF4 | |
| Source: | Code function: | 0_2_00007FF6E7E32D58 | |
| Source: | Code function: | 0_2_00007FF6E7E48C1C | |
| Source: | Code function: | 0_2_00007FF6E7E34B98 | |
| Source: | Code function: | 0_2_00007FF6E7E2BB90 | |
| Source: | Code function: | 0_2_00007FF6E7E25B60 | |
| Source: | Code function: | 0_2_00007FF6E7E55AF8 | |
| Source: | Code function: | 0_2_00007FF6E7E32AB0 | |
| Source: | Code function: | 0_2_00007FF6E7E11AA4 | |
| Source: | Code function: | 0_2_00007FF6E7E4FA94 | |
| Source: | Code function: | 0_2_00007FF6E7E21A48 | |
| Source: | Code function: | 0_2_00007FF6E7E489A0 | |
| Source: | Code function: | 0_2_00007FF6E7E2C96C | |
| Source: | Code function: | 0_2_00007FF6E7E33964 | |
| Source: | Dropped File: | ||
| Source: | Dropped File: | ||
| Source: | Dropped File: | ||
| Source: | Dropped File: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Classification label: | ||
| Source: | Code function: | 0_2_00007FF6E7E1B6D8 | |
| Source: | Code function: | 0_2_00007FF6E7E38624 | |
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Process created: | ||
| Source: | Static PE information: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | ReversingLabs: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Key value queried: | Jump to behavior | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | LNK file: | ||
| Source: | Automated click: | ||
| Source: | Automated click: | ||
| Source: | Automated click: | ||
| Source: | Automated click: | ||
| Source: | Automated click: | ||
| Source: | Window detected: | ||
| Source: | Static PE information: | ||
| Source: | Static file information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
Data Obfuscation | |
|---|
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | Static PE information: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Code function: | 0_2_00007FF6E7E55167 | |
| Source: | Code function: | 0_2_00007FF6E7E55157 | |
| Source: | Code function: | 4_2_010E3188 | |
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
Malware Analysis System Evasion | |
|---|
| Source: | RDTSC instruction interceptor: | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Evasive API call chain: | graph_4-1880 | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Last function: | ||
| Source: | Last function: | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | Code function: | 0_2_00007FF6E7E3B190 | |
| Source: | Code function: | 0_2_00007FF6E7E240BC | |
| Source: | Code function: | 0_2_00007FF6E7E4FCA0 | |
| Source: | Code function: | 0_2_00007FF6E7E416A4 | |
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Process information queried: | Jump to behavior | ||
| Source: | Code function: | 0_2_00007FF6E7E476D8 | |
| Source: | Code function: | 4_2_0110D0F8 | |
| Source: | Code function: | 4_2_0110D13C | |
| Source: | Code function: | 4_2_011043AC | |
| Source: | Code function: | 0_2_00007FF6E7E50D20 | |
| Source: | Code function: | 0_2_00007FF6E7E476D8 | |
| Source: | Code function: | 0_2_00007FF6E7E42510 | |
| Source: | Code function: | 0_2_00007FF6E7E43354 | |
| Source: | Code function: | 0_2_00007FF6E7E43170 | |
| Source: | Code function: | 4_2_010E2F78 | |
| Source: | Code function: | 4_2_010EE378 | |
| Source: | Code function: | 0_2_00007FF6E7E3B190 | |
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Code function: | 0_2_00007FF6E7E558E0 | |
| Source: | Code function: | 0_2_00007FF6E7E3A2CC | |
| Source: | Code function: | 0_2_00007FF6E7E40754 | |
| Source: | Code function: | 0_2_00007FF6E7E251A4 | |
| Source: | Key value queried: | Jump to behavior | ||
Stealing of Sensitive Information | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
Remote Access Functionality | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | 1 Scripting | Valid Accounts | 1 Native API | 1 Scripting | 1 Exploitation for Privilege Escalation | 2 Masquerading | 1 Input Capture | 1 System Time Discovery | Remote Services | 1 Input Capture | 11 Encrypted Channel | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
| Credentials | Domains | Default Accounts | Scheduled Task/Job | 1 Registry Run Keys / Startup Folder | 11 Process Injection | 11 Virtualization/Sandbox Evasion | LSASS Memory | 221 Security Software Discovery | Remote Desktop Protocol | 12 Archive Collected Data | 3 Ingress Tool Transfer | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | 1 DLL Side-Loading | 1 Registry Run Keys / Startup Folder | 11 Process Injection | Security Account Manager | 1 Process Discovery | SMB/Windows Admin Shares | Data from Network Shared Drive | 4 Non-Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | 1 DLL Side-Loading | 1 Deobfuscate/Decode Files or Information | NTDS | 11 Virtualization/Sandbox Evasion | Distributed Component Object Model | Input Capture | 5 Application Layer Protocol | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | Network Logon Script | 1 Obfuscated Files or Information | LSA Secrets | 1 Application Window Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
| Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | 21 Software Packing | Cached Domain Credentials | 2 File and Directory Discovery | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
| DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | 1 Timestomp | DCSync | 126 System Information Discovery | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
| Network Trust Dependencies | Serverless | Drive-by Compromise | Container Orchestration Job | Scheduled Task/Job | Scheduled Task/Job | 1 DLL Side-Loading | Proc Filesystem | System Owner/User Discovery | Cloud Services | Credential API Hooking | Application Layer Protocol | Exfiltration Over Alternative Protocol | Defacement |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 59% | ReversingLabs | ByteCode-MSIL.Backdoor.XWormRAT | ||
| 100% | Joe Sandbox ML |
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 100% | Avira | TR/Spy.Gen | ||
| 100% | Avira | TR/Spy.Gen | ||
| 100% | Avira | TR/Spy.Gen | ||
| 100% | Joe Sandbox ML | |||
| 100% | Joe Sandbox ML | |||
| 100% | Joe Sandbox ML | |||
| 76% | ReversingLabs | ByteCode-MSIL.Backdoor.XWormRAT | ||
| 76% | ReversingLabs | ByteCode-MSIL.Backdoor.XWormRAT | ||
| 82% | ReversingLabs | ByteCode-MSIL.Backdoor.XWormRAT | ||
| 0% | ReversingLabs |
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 100% | Avira URL Cloud | malware | ||
| 0% | Avira URL Cloud | safe | ||
| 100% | Avira URL Cloud | malware | ||
| 0% | Avira URL Cloud | safe |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| counter.yadro.ru | 88.212.202.52 | true | false | unknown | |
| a.nel.cloudflare.com | 35.190.80.1 | true | false | unknown | |
| edge-term4-ams2.roblox.com | 128.116.21.4 | true | false | unknown | |
| 2no.co | 172.67.149.76 | true | false | unknown | |
| cdn.iplogger.org | 104.21.4.208 | true | false | unknown | |
| www.google.com | 142.250.184.228 | true | false | unknown | |
| d2v57ias1m20gl.cloudfront.net | 99.86.4.125 | true | false | unknown | |
| ecsv2.roblox.com | unknown | unknown | false | unknown | |
| 26.165.165.52.in-addr.arpa | unknown | unknown | false | unknown | |
| client-telemetry.roblox.com | unknown | unknown | false | unknown | |
| clientsettingscdn.roblox.com | unknown | unknown | false | unknown | |
| 198.187.3.20.in-addr.arpa | unknown | unknown | false | unknown |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| false |
| unknown | |
| false |
| unknown | |
| false | unknown | ||
| false |
| unknown | |
| false |
| unknown | |
| false |
| unknown |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 128.116.21.4 | edge-term4-ams2.roblox.com | United States | 22697 | ROBLOX-PRODUCTIONUS | false | |
| 99.86.4.125 | d2v57ias1m20gl.cloudfront.net | United States | 16509 | AMAZON-02US | false | |
| 239.255.255.250 | unknown | Reserved | unknown | unknown | false | |
| 88.212.202.52 | counter.yadro.ru | Russian Federation | 39134 | UNITEDNETRU | false | |
| 142.250.181.228 | unknown | United States | 15169 | GOOGLEUS | false | |
| 35.190.80.1 | a.nel.cloudflare.com | United States | 15169 | GOOGLEUS | false | |
| 142.250.184.228 | www.google.com | United States | 15169 | GOOGLEUS | false | |
| 104.21.4.208 | cdn.iplogger.org | United States | 13335 | CLOUDFLARENETUS | false | |
| 88.212.201.204 | unknown | Russian Federation | 39134 | UNITEDNETRU | false | |
| 172.67.149.76 | 2no.co | United States | 13335 | CLOUDFLARENETUS | false |
| IP |
|---|
| 192.168.2.16 |
| 192.168.2.9 |
| 192.168.2.10 |
| 127.0.0.1 |
| Joe Sandbox version: | 40.0.0 Tourmaline |
| Analysis ID: | 1484385 |
| Start date and time: | 2024-07-30 00:48:09 +02:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 6m 44s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 16 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | cheat_roblox.exe |
| Detection: | MAL |
| Classification: | mal56.troj.spyw.evad.winEXE@24/21@20/14 |
| EGA Information: |
|
| HCA Information: | Failed |
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
- Excluded IPs from analysis (whitelisted): 199.232.214.172, 142.250.185.195, 142.250.186.78, 74.125.133.84, 34.104.35.123, 192.229.221.95, 142.250.186.131, 142.250.74.206
- Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, update.googleapis.com, clients.l.google.com
- Not all processes where analyzed, report is missing behavior information
- Report size getting too big, too many NtOpenKeyEx calls found.
- Report size getting too big, too many NtProtectVirtualMemory calls found.
- Report size getting too big, too many NtQueryValueKey calls found.
- VT rate limit hit for: cheat_roblox.exe
| Time | Type | Description |
|---|---|---|
| 18:49:02 | API Interceptor |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 239.255.255.250 | Get hash | malicious | Unknown | Browse | ||
| Get hash | malicious | XWorm | Browse | |||
| Get hash | malicious | HTMLPhisher | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | HTMLPhisher | Browse | |||
| 88.212.202.52 | Get hash | malicious | Unknown | Browse |
| |
| 128.116.21.4 | Get hash | malicious | Njrat | Browse | ||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| 104.21.4.208 | Get hash | malicious | Bdaejec | Browse | ||
| Get hash | malicious | Babadeda, Bdaejec | Browse | |||
| Get hash | malicious | Babadeda, Bdaejec | Browse | |||
| Get hash | malicious | LummaC, Amadey, Babadeda, LummaC Stealer, PureLog Stealer, RedLine, Stealc | Browse | |||
| Get hash | malicious | LummaC, Mars Stealer, PureLog Stealer, RedLine, Stealc, Stealerium, Vidar | Browse | |||
| Get hash | malicious | LummaC Stealer, Mars Stealer, PureLog Stealer, Socks5Systemz, Stealc, Stealerium, Vidar | Browse | |||
| Get hash | malicious | Amadey, PureLog Stealer | Browse | |||
| Get hash | malicious | EICAR, PureLog Stealer, zgRAT | Browse | |||
| Get hash | malicious | CryptOne, GCleaner, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer | Browse | |||
| Get hash | malicious | CryptOne, Djvu, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, Vidar | Browse | |||
| 99.86.4.125 | Get hash | malicious | Unknown | Browse | ||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| cdn.iplogger.org | Get hash | malicious | XWorm | Browse |
| |
| Get hash | malicious | Babadeda, Bdaejec | Browse |
| ||
| Get hash | malicious | Babadeda, Bdaejec | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Gurcu Stealer, RedLine, Vidar | Browse |
| ||
| Get hash | malicious | Gurcu Stealer, RedLine | Browse |
| ||
| Get hash | malicious | RedLine, Typhon Logger | Browse |
| ||
| Get hash | malicious | Azorult, RedLine | Browse |
| ||
| edge-term4-ams2.roblox.com | Get hash | malicious | XWorm | Browse |
| |
| Get hash | malicious | Njrat | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| counter.yadro.ru | Get hash | malicious | XWorm | Browse |
| |
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Babadeda, Bdaejec | Browse |
| ||
| Get hash | malicious | Babadeda, Bdaejec | Browse |
| ||
| Get hash | malicious | XenoRAT | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| 2no.co | Get hash | malicious | XWorm | Browse |
| |
| Get hash | malicious | Bdaejec, BitCoin Miner, Xmrig | Browse |
| ||
| Get hash | malicious | SmokeLoader | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | XenoRAT | Browse |
| ||
| Get hash | malicious | Remcos, Blank Grabber, PrivateLoader, SmokeLoader | Browse |
| ||
| Get hash | malicious | SmokeLoader | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | RHADAMANTHYS | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| UNITEDNETRU | Get hash | malicious | XWorm | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Babadeda, Bdaejec | Browse |
| ||
| Get hash | malicious | Babadeda, Bdaejec | Browse |
| ||
| Get hash | malicious | XenoRAT | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| ROBLOX-PRODUCTIONUS | Get hash | malicious | XWorm | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Njrat | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| AMAZON-02US | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | XWorm | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 1138de370e523e824bbca92d049a3777 | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| 28a2c9bd18a11de089ef85a160da29e4 | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | XWorm | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| C:\Users\user\AppData\Local\Temp\Keyloger.exe | Get hash | malicious | XWorm | Browse | ||
| C:\Users\user\AppData\Local\Temp\RobloxPlayerInstaller.exe | Get hash | malicious | XWorm | Browse | ||
| C:\Users\user\AppData\Local\Temp\BitCoin_miner.exe | Get hash | malicious | XWorm | Browse | ||
| C:\Users\user\AppData\Local\Temp\ msedge.exe | Get hash | malicious | XWorm | Browse |
| Process: | C:\Users\user\AppData\Local\Temp\RobloxPlayerInstaller.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 3804 |
| Entropy (8bit): | 5.339616712647284 |
| Encrypted: | false |
| SSDEEP: | 48:DD/yZdviDSGAkir0ClZvKH3F1gZ6ubDgZ6ubzsgZ6ubrvKLYZJFcUDK4z/8Y5Uye:fAd8b8ov8URnrhnPJYIJEJZJqGOvbJA5 |
| MD5: | DA6067E28A5CFDC0C1EB82265109B8D3 |
| SHA1: | 9DB81A7E5BF5FDD1EFD8222B1F84F643575478AD |
| SHA-256: | 464DC28CDEB713760C93571ED60887F23676320E1425B9F569A751D35E477BD7 |
| SHA-512: | 2E3BE9007099E79E0DA78C4D86ABAA7AD36E110D3841F0A36C48B222965BF4036197F155DB8FCD8D49162AE8EC5617FE3FA849D715BD96005C517E67112A3627 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\RobloxPlayerInstaller.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 233235 |
| Entropy (8bit): | 6.025218023713329 |
| Encrypted: | false |
| SSDEEP: | 3072:OhGvwW6Jj7ITWYv0yoVH283rz9WqIAsjjg4DsUQS88UP4TFf3xVOVkCC554jMN/C:M5W+j8chWf8xyvp5iIzB4CNxza/MK |
| MD5: | 0194EB945475F93844C0FAE769C0FA0B |
| SHA1: | D72876A801C702348EA5B4B4A333C484F2A721FD |
| SHA-256: | A6BC06B8255E4AFE2EEFF34684605D04DF9EC246FC201BF5E44137987189A0D3 |
| SHA-512: | 72A00FE6B9111CAB22F1F424F815A617BE2041A3857A6265B004CA1BFD10F345CA33369CD43009B483F9436CCBCD69C70F7033A85D94527B1F39846B75B43C17 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Users\user\Desktop\cheat_roblox.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 166912 |
| Entropy (8bit): | 6.251413929646261 |
| Encrypted: | false |
| SSDEEP: | 3072:TmnOFd9UhOMQRUGKXs+S++7KFSbxeY+qDDrMK:3d9YGqStKEbxI |
| MD5: | D653AEF66E218FB009B43365919BBCE3 |
| SHA1: | D38CAFCD950B901EE79FF72EBB87FEC8B2D9582A |
| SHA-256: | E85AF6A36635490B2FC2793B50C7EBC841DA95BC202A5FC9E7A4DBB17F172A2B |
| SHA-512: | FF4776B44ACD815251908B7D726980FA9DE5E02AED32026C5A72B64A7B0A464399BE730EE37473FDE3406AE7D7D43284018ADE4D32FC160F579764344DA06EF6 |
| Malicious: | true |
| Yara Hits: |
|
| Antivirus: |
|
| Joe Sandbox View: |
|
| Reputation: | low |
| Preview: |
| Process: | C:\Users\user\Desktop\cheat_roblox.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 140288 |
| Entropy (8bit): | 5.566968845764678 |
| Encrypted: | false |
| SSDEEP: | 3072:6mnOFd9U8OM+fe295liNgTddwY0JwsR4TbswYqkX5bEdGDOjESHhddJWjjY/ffIo:Wd9UH95D |
| MD5: | 3AFF3B824FC5BCD05EF4D8EEE176E443 |
| SHA1: | 422883493E21D605CB47CC08FD48CAEAD73F414C |
| SHA-256: | 79750B0F34A49A75406A0D7D6949AFD83DF2B2FF946E35A94AEA6BFE1D399599 |
| SHA-512: | 126818953B72233B2B0C50523ACE1EA8D1004F80EEDD0414A4FD3E4E385A3CB1D29E3D9BF7B50FA28AE5CC8EF2BF543D6416531F05FB977A79E60E51A82B03AE |
| Malicious: | true |
| Yara Hits: |
|
| Antivirus: |
|
| Joe Sandbox View: |
|
| Preview: |
| Process: | C:\Users\user\Desktop\cheat_roblox.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 168960 |
| Entropy (8bit): | 5.30703099621005 |
| Encrypted: | false |
| SSDEEP: | 3072:PV8w386j+bSL1OGtLJBz65/M6If+3Js+3JFkKeTnY:PN6bsrxBt25 |
| MD5: | 520E97797B27B752130B3E982953CEAF |
| SHA1: | AB460DA7E69D43747D98A4F45F5BB09D0E971789 |
| SHA-256: | 8BC3BD8F0FF442D3C83DA8ED7DE13C8E44D095823E2480465BE866C08F7E8700 |
| SHA-512: | 3219E4FE6B23411B48930FCE21DA24C8CE9BB07C6B069FA38B26B32DCC102C668F32AE816BD526CFBB44480F8279586509EBB11E9B75138A1F59AE771AA53664 |
| Malicious: | true |
| Yara Hits: |
|
| Antivirus: |
|
| Joe Sandbox View: |
|
| Preview: |
| Process: | C:\Users\user\Desktop\cheat_roblox.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 5720984 |
| Entropy (8bit): | 6.362394353465928 |
| Encrypted: | false |
| SSDEEP: | 98304:v7v3kcOmmcMxGf3Yi4bg38mky2aB173qgDDzGxSP8R7fTA7pksuq7:70cB3djgmggDaRXAtHB |
| MD5: | 27469372591B14FF1C57654FACB5E020 |
| SHA1: | 492C166CD0E6C8D122CA4687659BF047CD48AFD7 |
| SHA-256: | 3B8FCD52686095049B1563FBB6BA0BF73113A01B13C303BEBCB36D8339A1519F |
| SHA-512: | 0CFA845DE57ACF6F17F295F0771C2A61CD846EFDEE79DA012DEF474BCAA91D9E99D3D528CF5698E6112A310C4F97E98AE74B6CFC601B2988C51E92270EBF92A2 |
| Malicious: | true |
| Antivirus: |
|
| Joe Sandbox View: |
|
| Preview: |
| Process: | C:\Users\user\Desktop\cheat_roblox.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 477 |
| Entropy (8bit): | 5.082252715861135 |
| Encrypted: | false |
| SSDEEP: | 12:Z0DtzHGtzs22yZOVqZwGJbShOVqZwGJbKy5i1bhH0HR:ZMz0zsBiO4Z+O4ZOKoQR |
| MD5: | AAA81C149A8D65AC899AF053ECF582BC |
| SHA1: | A784DDE9304A2B8108180A652C9374BEF71500D9 |
| SHA-256: | 98818D1694AE946A32DEC4CAEA1FDD219650EF5A915CCA6A68E974C028A2FD69 |
| SHA-512: | 74B6B9A1EF22CE12E3CE5076C8A3B6D0BE1C52642C6E004D52255D23AFD3506496D84049CDF6F5E37F5238C5645E014E26D88046D196CDBD3DDA90B3A27BEA92 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2673 |
| Entropy (8bit): | 3.9826015805540664 |
| Encrypted: | false |
| SSDEEP: | 48:8SdkTATJHdidAKZdA1P4ehwiZUklqehly+3:8tMpOuy |
| MD5: | 304C6D1B9386DAF0ED27A4EFEDB4CBFA |
| SHA1: | 78ACC09398F543C4B3716D516B364FBE34825750 |
| SHA-256: | C263E9DA6A9AE7211FCD410FD5C1A19DACBB57FAB7FB9A0BB78999ECF59359F1 |
| SHA-512: | C9C7D2AC1486F56F27860B27CD1BDA896E1826CA80FECC37CBE37C5726E1A30B4B485CF1D294276BC47C74E24749ADDA71139D410B81003D6C99084A763EFFDD |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2675 |
| Entropy (8bit): | 4.002926419055548 |
| Encrypted: | false |
| SSDEEP: | 48:8sdkTATJHdidAKZdA1+4eh/iZUkAQkqehey+2:8HMYF9Qzy |
| MD5: | 807736E84BD125C0CCD8CB661C1421D5 |
| SHA1: | 0116A9FB28ECEA71B976A23BB6CE4E46DEDC16AB |
| SHA-256: | 1592ACF0ED8B361D9311FC6F462EAF77948134416DA678E3BF02677D03338214 |
| SHA-512: | 7101F510D7DDEB2F2F4BDBBB8B506F87128D15E472BB2189EDEB63231C1C184D2DA94951DA23BA7BDCD88247E10AF92F70C44D8E7C4E10F8027E753DF0465DD7 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2689 |
| Entropy (8bit): | 4.007439343876962 |
| Encrypted: | false |
| SSDEEP: | 48:80dkTAVHdidAKZdA1404eh7sFiZUkmgqeh7sEy+BX:8/M9Inay |
| MD5: | 2DE298A8CE771484E06D3DE5AD616006 |
| SHA1: | 1EFF5F5D05156CDB5DAFD766A7436A3AD1D27DBD |
| SHA-256: | D1A45E76357AC7F74F6C23308A031293363982FF4804BFDFF9D4ED100F176D92 |
| SHA-512: | EE95AAFEC126DE73F07AFFD411359CEA4431B06C6565B40AB5B0FA892AA3A7E61E613B2B7650A9FA55F728BE8BE2920118FFBC49B47B923A40497F3D8B63A544 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2677 |
| Entropy (8bit): | 3.996761702525746 |
| Encrypted: | false |
| SSDEEP: | 48:8djdkTATJHdidAKZdA1p4ehDiZUkwqehyy+R:8AMv5cy |
| MD5: | 7C5DA5717DED558B4F10700B3C904C7F |
| SHA1: | 3CA906EAC9904F38AC07D55BFDF681C26509D457 |
| SHA-256: | 5EE66C2224F6CB435BE1C6066E2B09B9E9BCE01CF3D7477EC01462E3724C550E |
| SHA-512: | 0AFBFE28E51808B7DC6B9C9582F18C311732ED46361EE17C8A68F8802401F47094203F1B08A1F8965B04D917A73A5D241C9709862561F467212D65A18D5AF4FD |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2677 |
| Entropy (8bit): | 3.988930153255884 |
| Encrypted: | false |
| SSDEEP: | 48:8jdkTATJHdidAKZdA1X4ehBiZUk1W1qehAy+C:8iMxb9gy |
| MD5: | AF1AF861E75CD5E02E62B3FF20B24399 |
| SHA1: | F82355F261CC419C8AD1EB9E4E858BEF9E09C7F5 |
| SHA-256: | B9BE0A6E557EA562FBEEEB830BE5F31F3DB11ED2239414F2A81DFFABFE5ECA3C |
| SHA-512: | 7BF57AEE59E3C98B2F34787AA93E6EEBE2A195C7641BCE91E542E004327D8DA24B6E14626D6EDEBA2FB9EDC911C12E7FA4C65403681211845D69DF0B640E20E9 |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Download File
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2679 |
| Entropy (8bit): | 3.998977678358186 |
| Encrypted: | false |
| SSDEEP: | 48:8xdkTATJHdidAKZdA1duTc4ehOuTbbiZUk5OjqehOuTbay+yT+:8wMyTcJTbxWOvTbay7T |
| MD5: | 1F1D1E587DA66F30FFCB5C70637F03EE |
| SHA1: | 0FDD4DFEB25F605CC16F305479D9D593AB7701A6 |
| SHA-256: | 78C2B35F8BE8C50C3073892D4093CE1F4D65550AF7665B9B01C5651E18E4E8EC |
| SHA-512: | C59A5C002FF90D9FA7F9B8ADB835115911F5D19F1BE982C64DD623DA2D84A2328C5287857916C3CF68663FD3B0A8F8EAE90A4D8D5DCBAB1C21118EC5D869B7EF |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 2833 |
| Entropy (8bit): | 7.876846206921263 |
| Encrypted: | false |
| SSDEEP: | 48:Kw15hc/Pj2itdgjeVVO/SzBdCvhaHAlJX7XnF/HDoSH8T78atjZeHMBx/F/WssM:J15hc/Pj2mdgjMjusgl5XFD3MoIx9eg |
| MD5: | 18C023BC439B446F91BF942270882422 |
| SHA1: | 768D59E3085976DBA252232A65A4AF562675F782 |
| SHA-256: | E0E71ACEF1EFBFAB69A1A60CD8FADDED948D0E47A0A27C59A0BE7033F6A84482 |
| SHA-512: | A95AD7B48596BC0AF23D05D1E58681E5D65E707247F96C5BC088880F4525312A1834A89615A0E33AEA6B066793088A193EC29B5C96EA216F531C443487AE0735 |
| Malicious: | false |
| URL: | https://cdn.iplogger.org/favicon.ico |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2833 |
| Entropy (8bit): | 7.876846206921263 |
| Encrypted: | false |
| SSDEEP: | 48:Kw15hc/Pj2itdgjeVVO/SzBdCvhaHAlJX7XnF/HDoSH8T78atjZeHMBx/F/WssM:J15hc/Pj2mdgjMjusgl5XFD3MoIx9eg |
| MD5: | 18C023BC439B446F91BF942270882422 |
| SHA1: | 768D59E3085976DBA252232A65A4AF562675F782 |
| SHA-256: | E0E71ACEF1EFBFAB69A1A60CD8FADDED948D0E47A0A27C59A0BE7033F6A84482 |
| SHA-512: | A95AD7B48596BC0AF23D05D1E58681E5D65E707247F96C5BC088880F4525312A1834A89615A0E33AEA6B066793088A193EC29B5C96EA216F531C443487AE0735 |
| Malicious: | false |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 9909 |
| Entropy (8bit): | 5.405067042408774 |
| Encrypted: | false |
| SSDEEP: | 192:DLlw+00cv13xV1cSHYu+zogDCIIhWp6psOsW4rqSxVEGV5R2WxSi1yz:D5w+Pcv13T1FH0fuIIm6QXxVP20u |
| MD5: | 973A7FCA114110C1817ACA6D5B7CD16E |
| SHA1: | 8ED382EAF809679D595A656547889BA7CAEB6BBA |
| SHA-256: | 4BE9B1FFA53ACDAAB23D678B783DA03465206477BBF4B362B3996E9A8D220B04 |
| SHA-512: | 10F3D38E3F85B565A12EAC3B4783476781B4184FE7FF4D8680058FE1ABC647ED3881A3DFBC8FE4F598DCC340084EBD7AA86E7F997DE1AEBDF915B0E88495E7E9 |
| Malicious: | false |
| URL: | https://2no.co/24RXx6 |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | downloaded |
| Size (bytes): | 445 |
| Entropy (8bit): | 7.051559084988302 |
| Encrypted: | false |
| SSDEEP: | 6:tj+cYUFqb9Oq2EWxiWlb+hKI526WogYAGJe9UCZE12REqtVv6n:tqeqZF3WxiHKI5KopAMQUD10EqtVv6 |
| MD5: | 1BD6EB140EC5E09AF54808BCE2BE74BE |
| SHA1: | 00746108650919B88014CE35AABF72B0F20B2046 |
| SHA-256: | 3E13369E5C528A4598007330A7D572DADD181E268D0CF87BA7B62FD7668597F8 |
| SHA-512: | FA58EB9D8DB6819BCD39EC73089942D7F16CA602322E3EFA592A3418FB735A87DF9FD5388830F8E1E699CB5457234626F2B09DACEC83E265F300CE19AA907DBE |
| Malicious: | false |
| URL: | https://counter.yadro.ru/hit?q;t38.6;r;s1280*1024*24;uhttps%3A//2no.co/redirect-2;hBranded%20Short%20Domain;0.0641046345653069 |
| Preview: |
| Process: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 445 |
| Entropy (8bit): | 7.051559084988302 |
| Encrypted: | false |
| SSDEEP: | 6:tj+cYUFqb9Oq2EWxiWlb+hKI526WogYAGJe9UCZE12REqtVv6n:tqeqZF3WxiHKI5KopAMQUD10EqtVv6 |
| MD5: | 1BD6EB140EC5E09AF54808BCE2BE74BE |
| SHA1: | 00746108650919B88014CE35AABF72B0F20B2046 |
| SHA-256: | 3E13369E5C528A4598007330A7D572DADD181E268D0CF87BA7B62FD7668597F8 |
| SHA-512: | FA58EB9D8DB6819BCD39EC73089942D7F16CA602322E3EFA592A3418FB735A87DF9FD5388830F8E1E699CB5457234626F2B09DACEC83E265F300CE19AA907DBE |
| Malicious: | false |
| Preview: |
| File type: | |
| Entropy (8bit): | 7.909822900338073 |
| TrID: |
|
| File name: | cheat_roblox.exe |
| File size: | 2'675'335 bytes |
| MD5: | d49b1a211ce49bed3e766471501819c6 |
| SHA1: | ed8f8b0d45ad556115c14a00247c080fa82d56e9 |
| SHA256: | 1673b4f5f2d5ae3e3d2c5816534bf904ed1d2653b4a40bbb2a320231eca8259a |
| SHA512: | 2a0ec111c39ed2d5e02555a18a94f84bb546d1fc4f827ddeb24709b9b86259318611626a578918c5d8e60a5667e774c0d36241b6b668afb466a8806d37c2b7d2 |
| SSDEEP: | 49152:1Djlabwz97DQNxlq9fFQXLkL9g+/kW/4JNe0OL108Jgwya3fj8kSbn17:Zqw5skLZbaWL108JgwnvS5 |
| TLSH: | 48C5120AF3A509F8E073E57889474906F67A3C1A13319BCF13A5556B2F673A1CE2E352 |
| File Content Preview: | MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$.2.`.\.`.\.`.\..y..h.\..y....\..y..m.\.....b.\...X.r.\..._.j.\...Y.Y.\.i...i.\.i...b.\.i...g.\.`.].C.\...Y.R.\...\.a.\.....a.\ |
 | |
| Icon Hash: | 1515d4d4442f2d2d |
| Entrypoint: | 0x140032ee0 |
| Entrypoint Section: | .text |
| Digitally signed: | false |
| Imagebase: | 0x140000000 |
| Subsystem: | windows gui |
| Image File Characteristics: | EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE |
| DLL Characteristics: | HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x66409723 [Sun May 12 10:17:07 2024 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 5 |
| OS Version Minor: | 2 |
| File Version Major: | 5 |
| File Version Minor: | 2 |
| Subsystem Version Major: | 5 |
| Subsystem Version Minor: | 2 |
| Import Hash: | b1c5b1beabd90d9fdabd1df0779ea832 |
| Instruction |
|---|
| dec eax |
| sub esp, 28h |
| call 00007F23E4EE5C18h |
| dec eax |
| add esp, 28h |
| jmp 00007F23E4EE55AFh |
| int3 |
| int3 |
| dec eax |
| mov eax, esp |
| dec eax |
| mov dword ptr [eax+08h], ebx |
| dec eax |
| mov dword ptr [eax+10h], ebp |
| dec eax |
| mov dword ptr [eax+18h], esi |
| dec eax |
| mov dword ptr [eax+20h], edi |
| inc ecx |
| push esi |
| dec eax |
| sub esp, 20h |
| dec ebp |
| mov edx, dword ptr [ecx+38h] |
| dec eax |
| mov esi, edx |
| dec ebp |
| mov esi, eax |
| dec eax |
| mov ebp, ecx |
| dec ecx |
| mov edx, ecx |
| dec eax |
| mov ecx, esi |
| dec ecx |
| mov edi, ecx |
| inc ecx |
| mov ebx, dword ptr [edx] |
| dec eax |
| shl ebx, 04h |
| dec ecx |
| add ebx, edx |
| dec esp |
| lea eax, dword ptr [ebx+04h] |
| call 00007F23E4EE4A33h |
| mov eax, dword ptr [ebp+04h] |
| and al, 66h |
| neg al |
| mov eax, 00000001h |
| sbb edx, edx |
| neg edx |
| add edx, eax |
| test dword ptr [ebx+04h], edx |
| je 00007F23E4EE5743h |
| dec esp |
| mov ecx, edi |
| dec ebp |
| mov eax, esi |
| dec eax |
| mov edx, esi |
| dec eax |
| mov ecx, ebp |
| call 00007F23E4EE7757h |
| dec eax |
| mov ebx, dword ptr [esp+30h] |
| dec eax |
| mov ebp, dword ptr [esp+38h] |
| dec eax |
| mov esi, dword ptr [esp+40h] |
| dec eax |
| mov edi, dword ptr [esp+48h] |
| dec eax |
| add esp, 20h |
| inc ecx |
| pop esi |
| ret |
| int3 |
| int3 |
| int3 |
| dec eax |
| sub esp, 48h |
| dec eax |
| lea ecx, dword ptr [esp+20h] |
| call 00007F23E4ED3FC3h |
| dec eax |
| lea edx, dword ptr [00025747h] |
| dec eax |
| lea ecx, dword ptr [esp+20h] |
| call 00007F23E4EE6812h |
| int3 |
| jmp 00007F23E4EEC9F4h |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| Programming Language: |
|
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x597a0 | 0x34 | .rdata |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0x597d4 | 0x50 | .rdata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x70000 | 0xe3bc | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x6a000 | 0x306c | .pdata |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x7f000 | 0x970 | .reloc |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0x536c0 | 0x54 | .rdata |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0x53780 | 0x28 | .rdata |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x4b3f0 | 0x140 | .rdata |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x48000 | 0x508 | .rdata |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x588bc | 0x120 | .rdata |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x4676e | 0x46800 | f06bb06e02377ae8b223122e53be35c2 | False | 0.5372340425531915 | data | 6.47079645411382 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .rdata | 0x48000 | 0x128c4 | 0x12a00 | 2de06d4a6920a6911e64ff20000ea72f | False | 0.4499003775167785 | data | 5.273999097784603 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .data | 0x5b000 | 0xe75c | 0x1a00 | 0dbdb901a7d477980097e42e511a94fb | False | 0.28275240384615385 | data | 3.2571023907881185 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .pdata | 0x6a000 | 0x306c | 0x3200 | b0ce0f057741ad2a4ef4717079fa34e9 | False | 0.483359375 | data | 5.501810413666288 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .didat | 0x6e000 | 0x360 | 0x400 | 1fcc7b1d7a02443319f8fcc2be4ca936 | False | 0.2578125 | data | 3.0459938492946015 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| _RDATA | 0x6f000 | 0x15c | 0x200 | 3f331ec50f09ba861beaf955b33712d5 | False | 0.408203125 | data | 3.3356393424384843 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .rsrc | 0x70000 | 0xe3bc | 0xe400 | 1b279dad3e3d77fcdfb269a130bf474b | False | 0.6334121436403509 | data | 6.778407783727912 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .reloc | 0x7f000 | 0x970 | 0xa00 | 77a9ddfc47a5650d6eebbcc823e39532 | False | 0.52421875 | data | 5.336289720085303 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| PNG | 0x70674 | 0xb45 | PNG image data, 93 x 302, 8-bit/color RGB, non-interlaced | 1.0027729636048528 | ||
| PNG | 0x711bc | 0x15a9 | PNG image data, 186 x 604, 8-bit/color RGB, non-interlaced | 0.9363390441839495 | ||
| RT_ICON | 0x72768 | 0x568 | Device independent bitmap graphic, 16 x 32 x 8, image size 256, resolution 2834 x 2834 px/m, 256 important colors | 0.47832369942196534 | ||
| RT_ICON | 0x72cd0 | 0x8a8 | Device independent bitmap graphic, 32 x 64 x 8, image size 1024, resolution 2834 x 2834 px/m, 256 important colors | 0.5410649819494585 | ||
| RT_ICON | 0x73578 | 0xea8 | Device independent bitmap graphic, 48 x 96 x 8, image size 2304, resolution 2834 x 2834 px/m, 256 important colors | 0.4933368869936034 | ||
| RT_ICON | 0x74420 | 0x468 | Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2834 x 2834 px/m | 0.5390070921985816 | ||
| RT_ICON | 0x74888 | 0x10a8 | Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2834 x 2834 px/m | 0.41393058161350843 | ||
| RT_ICON | 0x75930 | 0x25a8 | Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2834 x 2834 px/m | 0.3479253112033195 | ||
| RT_ICON | 0x77ed8 | 0x3d71 | PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced | 0.9809269502193401 | ||
| RT_DIALOG | 0x7bc4c | 0x2ba | data | 0.5286532951289399 | ||
| RT_DIALOG | 0x7bf08 | 0x13a | data | 0.6560509554140127 | ||
| RT_DIALOG | 0x7c044 | 0xf2 | data | 0.71900826446281 | ||
| RT_DIALOG | 0x7c138 | 0x14a | data | 0.6 | ||
| RT_DIALOG | 0x7c284 | 0x314 | data | 0.47588832487309646 | ||
| RT_DIALOG | 0x7c598 | 0x24a | data | 0.6279863481228669 | ||
| RT_STRING | 0x7c7e4 | 0x1fc | data | 0.421259842519685 | ||
| RT_STRING | 0x7c9e0 | 0x246 | data | 0.41924398625429554 | ||
| RT_STRING | 0x7cc28 | 0x1a6 | data | 0.514218009478673 | ||
| RT_STRING | 0x7cdd0 | 0xdc | data | 0.65 | ||
| RT_STRING | 0x7ceac | 0x470 | data | 0.3873239436619718 | ||
| RT_STRING | 0x7d31c | 0x164 | data | 0.5056179775280899 | ||
| RT_STRING | 0x7d480 | 0x110 | data | 0.5772058823529411 | ||
| RT_STRING | 0x7d590 | 0x158 | data | 0.4563953488372093 | ||
| RT_STRING | 0x7d6e8 | 0xe8 | data | 0.5948275862068966 | ||
| RT_STRING | 0x7d7d0 | 0x1c6 | data | 0.5242290748898678 | ||
| RT_STRING | 0x7d998 | 0x268 | data | 0.4837662337662338 | ||
| RT_GROUP_ICON | 0x7dc00 | 0x68 | data | 0.7019230769230769 | ||
| RT_MANIFEST | 0x7dc68 | 0x753 | XML 1.0 document, ASCII text, with CRLF line terminators | 0.3957333333333333 |
| DLL | Import |
|---|---|
| KERNEL32.dll | LocalFree, GetLastError, SetLastError, FormatMessageW, GetCurrentProcess, DeviceIoControl, SetFileTime, CloseHandle, RemoveDirectoryW, CreateFileW, DeleteFileW, CreateHardLinkW, GetShortPathNameW, GetLongPathNameW, MoveFileW, GetFileType, GetStdHandle, WriteFile, ReadFile, FlushFileBuffers, SetEndOfFile, SetFilePointer, GetCurrentProcessId, CreateDirectoryW, SetFileAttributesW, GetFileAttributesW, FindClose, FindFirstFileW, FindNextFileW, GetVersionExW, GetModuleFileNameW, SetCurrentDirectoryW, GetCurrentDirectoryW, GetFullPathNameW, FoldStringW, GetModuleHandleW, FindResourceW, FreeLibrary, GetProcAddress, ExpandEnvironmentStringsW, ExitProcess, SetThreadExecutionState, Sleep, LoadLibraryW, GetSystemDirectoryW, CompareStringW, AllocConsole, FreeConsole, AttachConsole, WriteConsoleW, GetProcessAffinityMask, CreateThread, SetThreadPriority, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, SetEvent, ResetEvent, ReleaseSemaphore, WaitForSingleObject, CreateEventW, CreateSemaphoreW, GetSystemTime, SystemTimeToTzSpecificLocalTime, TzSpecificLocalTimeToSystemTime, SystemTimeToFileTime, FileTimeToLocalFileTime, LocalFileTimeToFileTime, FileTimeToSystemTime, GetCPInfo, IsDBCSLeadByte, MultiByteToWideChar, WideCharToMultiByte, GlobalAlloc, LockResource, GlobalLock, GlobalUnlock, GlobalFree, GlobalMemoryStatusEx, LoadResource, SizeofResource, GetTimeFormatW, GetDateFormatW, GetExitCodeProcess, GetLocalTime, GetTickCount, MapViewOfFile, UnmapViewOfFile, CreateFileMappingW, OpenFileMappingW, GetCommandLineW, SetEnvironmentVariableW, GetTempPathW, MoveFileExW, GetLocaleInfoW, GetNumberFormatW, SetFilePointerEx, GetConsoleMode, GetConsoleCP, HeapSize, SetStdHandle, GetProcessHeap, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineA, GetOEMCP, IsValidCodePage, FindNextFileA, RaiseException, GetSystemInfo, VirtualProtect, VirtualQuery, LoadLibraryExA, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, InitializeCriticalSectionAndSpinCount, WaitForSingleObjectEx, IsDebuggerPresent, GetStartupInfoW, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, RtlPcToFileHeader, RtlUnwindEx, EncodePointer, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, QueryPerformanceFrequency, GetModuleHandleExW, GetModuleFileNameA, GetACP, HeapFree, HeapAlloc, GetStringTypeW, HeapReAlloc, LCMapStringW, FindFirstFileExA |
| OLEAUT32.dll | SysAllocString, SysFreeString, VariantClear |
| gdiplus.dll | GdipCloneImage, GdipFree, GdipDisposeImage, GdipCreateBitmapFromStream, GdipCreateHBITMAPFromBitmap, GdiplusStartup, GdiplusShutdown, GdipAlloc |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | Protocol | SID | Signature | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|---|---|---|
| 2024-07-30T00:49:18.443625+0200 | TCP | 2022930 | ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow | 443 | 49732 | 20.114.59.183 | 192.168.2.9 |
| 2024-07-30T00:49:42.483073+0200 | TCP | 2022930 | ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow | 443 | 61123 | 40.127.169.103 | 192.168.2.9 |
| 2024-07-30T00:49:41.144546+0200 | TCP | 2022930 | ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow | 443 | 61122 | 40.127.169.103 | 192.168.2.9 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Jul 30, 2024 00:48:54.921684027 CEST | 49677 | 443 | 192.168.2.9 | 20.189.173.11 |
| Jul 30, 2024 00:48:55.233802080 CEST | 49677 | 443 | 192.168.2.9 | 20.189.173.11 |
| Jul 30, 2024 00:48:55.843199015 CEST | 49677 | 443 | 192.168.2.9 | 20.189.173.11 |
| Jul 30, 2024 00:48:55.858829021 CEST | 49673 | 443 | 192.168.2.9 | 204.79.197.203 |
| Jul 30, 2024 00:48:56.671329975 CEST | 49676 | 443 | 192.168.2.9 | 23.206.229.209 |
| Jul 30, 2024 00:48:56.674578905 CEST | 49675 | 443 | 192.168.2.9 | 23.206.229.209 |
| Jul 30, 2024 00:48:56.968183041 CEST | 49674 | 443 | 192.168.2.9 | 23.206.229.209 |
| Jul 30, 2024 00:48:57.046304941 CEST | 49677 | 443 | 192.168.2.9 | 20.189.173.11 |
| Jul 30, 2024 00:48:59.452524900 CEST | 49677 | 443 | 192.168.2.9 | 20.189.173.11 |
| Jul 30, 2024 00:49:01.750956059 CEST | 49708 | 443 | 192.168.2.9 | 128.116.21.4 |
| Jul 30, 2024 00:49:01.751002073 CEST | 443 | 49708 | 128.116.21.4 | 192.168.2.9 |
| Jul 30, 2024 00:49:01.751090050 CEST | 49708 | 443 | 192.168.2.9 | 128.116.21.4 |
| Jul 30, 2024 00:49:01.762448072 CEST | 49708 | 443 | 192.168.2.9 | 128.116.21.4 |
| Jul 30, 2024 00:49:01.762466908 CEST | 443 | 49708 | 128.116.21.4 | 192.168.2.9 |
| Jul 30, 2024 00:49:02.519165039 CEST | 443 | 49708 | 128.116.21.4 | 192.168.2.9 |
| Jul 30, 2024 00:49:02.520347118 CEST | 49708 | 443 | 192.168.2.9 | 128.116.21.4 |
| Jul 30, 2024 00:49:02.520373106 CEST | 443 | 49708 | 128.116.21.4 | 192.168.2.9 |
| Jul 30, 2024 00:49:02.521924019 CEST | 443 | 49708 | 128.116.21.4 | 192.168.2.9 |
| Jul 30, 2024 00:49:02.522001982 CEST | 49708 | 443 | 192.168.2.9 | 128.116.21.4 |
| Jul 30, 2024 00:49:02.524569988 CEST | 49708 | 443 | 192.168.2.9 | 128.116.21.4 |
| Jul 30, 2024 00:49:02.524736881 CEST | 443 | 49708 | 128.116.21.4 | 192.168.2.9 |
| Jul 30, 2024 00:49:02.524741888 CEST | 49708 | 443 | 192.168.2.9 | 128.116.21.4 |
| Jul 30, 2024 00:49:02.524799109 CEST | 49708 | 443 | 192.168.2.9 | 128.116.21.4 |
| Jul 30, 2024 00:49:02.602380037 CEST | 49711 | 443 | 192.168.2.9 | 99.86.4.125 |
| Jul 30, 2024 00:49:02.602418900 CEST | 443 | 49711 | 99.86.4.125 | 192.168.2.9 |
| Jul 30, 2024 00:49:02.602483988 CEST | 49711 | 443 | 192.168.2.9 | 99.86.4.125 |
| Jul 30, 2024 00:49:02.604423046 CEST | 49711 | 443 | 192.168.2.9 | 99.86.4.125 |
| Jul 30, 2024 00:49:02.604443073 CEST | 443 | 49711 | 99.86.4.125 | 192.168.2.9 |
| Jul 30, 2024 00:49:03.379829884 CEST | 443 | 49711 | 99.86.4.125 | 192.168.2.9 |
| Jul 30, 2024 00:49:03.383378029 CEST | 49711 | 443 | 192.168.2.9 | 99.86.4.125 |
| Jul 30, 2024 00:49:03.383407116 CEST | 443 | 49711 | 99.86.4.125 | 192.168.2.9 |
| Jul 30, 2024 00:49:03.385015965 CEST | 443 | 49711 | 99.86.4.125 | 192.168.2.9 |
| Jul 30, 2024 00:49:03.385092020 CEST | 49711 | 443 | 192.168.2.9 | 99.86.4.125 |
| Jul 30, 2024 00:49:03.386687040 CEST | 49711 | 443 | 192.168.2.9 | 99.86.4.125 |
| Jul 30, 2024 00:49:03.386902094 CEST | 443 | 49711 | 99.86.4.125 | 192.168.2.9 |
| Jul 30, 2024 00:49:03.386955023 CEST | 49711 | 443 | 192.168.2.9 | 99.86.4.125 |
| Jul 30, 2024 00:49:03.398300886 CEST | 49711 | 443 | 192.168.2.9 | 99.86.4.125 |
| Jul 30, 2024 00:49:03.500745058 CEST | 49712 | 443 | 192.168.2.9 | 99.86.4.125 |
| Jul 30, 2024 00:49:03.500793934 CEST | 443 | 49712 | 99.86.4.125 | 192.168.2.9 |
| Jul 30, 2024 00:49:03.500874996 CEST | 49712 | 443 | 192.168.2.9 | 99.86.4.125 |
| Jul 30, 2024 00:49:03.501563072 CEST | 49712 | 443 | 192.168.2.9 | 99.86.4.125 |
| Jul 30, 2024 00:49:03.501575947 CEST | 443 | 49712 | 99.86.4.125 | 192.168.2.9 |
| Jul 30, 2024 00:49:04.265136003 CEST | 49677 | 443 | 192.168.2.9 | 20.189.173.11 |
| Jul 30, 2024 00:49:05.302228928 CEST | 443 | 49712 | 99.86.4.125 | 192.168.2.9 |
| Jul 30, 2024 00:49:05.303419113 CEST | 49712 | 443 | 192.168.2.9 | 99.86.4.125 |
| Jul 30, 2024 00:49:05.303438902 CEST | 443 | 49712 | 99.86.4.125 | 192.168.2.9 |
| Jul 30, 2024 00:49:05.304955006 CEST | 443 | 49712 | 99.86.4.125 | 192.168.2.9 |
| Jul 30, 2024 00:49:05.305108070 CEST | 49712 | 443 | 192.168.2.9 | 99.86.4.125 |
| Jul 30, 2024 00:49:05.305859089 CEST | 49712 | 443 | 192.168.2.9 | 99.86.4.125 |
| Jul 30, 2024 00:49:05.306020021 CEST | 443 | 49712 | 99.86.4.125 | 192.168.2.9 |
| Jul 30, 2024 00:49:05.306092024 CEST | 49712 | 443 | 192.168.2.9 | 99.86.4.125 |
| Jul 30, 2024 00:49:05.312160969 CEST | 49712 | 443 | 192.168.2.9 | 99.86.4.125 |
| Jul 30, 2024 00:49:05.416527987 CEST | 49715 | 443 | 192.168.2.9 | 99.86.4.125 |
| Jul 30, 2024 00:49:05.416569948 CEST | 443 | 49715 | 99.86.4.125 | 192.168.2.9 |
| Jul 30, 2024 00:49:05.416690111 CEST | 49715 | 443 | 192.168.2.9 | 99.86.4.125 |
| Jul 30, 2024 00:49:05.418431997 CEST | 49715 | 443 | 192.168.2.9 | 99.86.4.125 |
| Jul 30, 2024 00:49:05.418447971 CEST | 443 | 49715 | 99.86.4.125 | 192.168.2.9 |
| Jul 30, 2024 00:49:05.462130070 CEST | 49673 | 443 | 192.168.2.9 | 204.79.197.203 |
| Jul 30, 2024 00:49:06.163001060 CEST | 443 | 49715 | 99.86.4.125 | 192.168.2.9 |
| Jul 30, 2024 00:49:06.163455963 CEST | 49715 | 443 | 192.168.2.9 | 99.86.4.125 |
| Jul 30, 2024 00:49:06.163475990 CEST | 443 | 49715 | 99.86.4.125 | 192.168.2.9 |
| Jul 30, 2024 00:49:06.164547920 CEST | 443 | 49715 | 99.86.4.125 | 192.168.2.9 |
| Jul 30, 2024 00:49:06.164623022 CEST | 49715 | 443 | 192.168.2.9 | 99.86.4.125 |
| Jul 30, 2024 00:49:06.166629076 CEST | 49715 | 443 | 192.168.2.9 | 99.86.4.125 |
| Jul 30, 2024 00:49:06.166727066 CEST | 49715 | 443 | 192.168.2.9 | 99.86.4.125 |
| Jul 30, 2024 00:49:06.276109934 CEST | 49676 | 443 | 192.168.2.9 | 23.206.229.209 |
| Jul 30, 2024 00:49:06.276124954 CEST | 49675 | 443 | 192.168.2.9 | 23.206.229.209 |
| Jul 30, 2024 00:49:06.580159903 CEST | 49674 | 443 | 192.168.2.9 | 23.206.229.209 |
| Jul 30, 2024 00:49:08.309634924 CEST | 443 | 49704 | 23.206.229.209 | 192.168.2.9 |
| Jul 30, 2024 00:49:08.309734106 CEST | 49704 | 443 | 192.168.2.9 | 23.206.229.209 |
| Jul 30, 2024 00:49:12.516150951 CEST | 49716 | 443 | 192.168.2.9 | 99.86.4.125 |
| Jul 30, 2024 00:49:12.516268969 CEST | 443 | 49716 | 99.86.4.125 | 192.168.2.9 |
| Jul 30, 2024 00:49:12.516369104 CEST | 49716 | 443 | 192.168.2.9 | 99.86.4.125 |
| Jul 30, 2024 00:49:12.525295973 CEST | 49716 | 443 | 192.168.2.9 | 99.86.4.125 |
| Jul 30, 2024 00:49:12.525337934 CEST | 443 | 49716 | 99.86.4.125 | 192.168.2.9 |
| Jul 30, 2024 00:49:13.264359951 CEST | 443 | 49716 | 99.86.4.125 | 192.168.2.9 |
| Jul 30, 2024 00:49:13.265362024 CEST | 49716 | 443 | 192.168.2.9 | 99.86.4.125 |
| Jul 30, 2024 00:49:13.265430927 CEST | 443 | 49716 | 99.86.4.125 | 192.168.2.9 |
| Jul 30, 2024 00:49:13.266518116 CEST | 443 | 49716 | 99.86.4.125 | 192.168.2.9 |
| Jul 30, 2024 00:49:13.266587019 CEST | 49716 | 443 | 192.168.2.9 | 99.86.4.125 |
| Jul 30, 2024 00:49:13.268676996 CEST | 49716 | 443 | 192.168.2.9 | 99.86.4.125 |
| Jul 30, 2024 00:49:13.268788099 CEST | 49716 | 443 | 192.168.2.9 | 99.86.4.125 |
| Jul 30, 2024 00:49:13.387065887 CEST | 49717 | 443 | 192.168.2.9 | 99.86.4.125 |
| Jul 30, 2024 00:49:13.387101889 CEST | 443 | 49717 | 99.86.4.125 | 192.168.2.9 |
| Jul 30, 2024 00:49:13.387233019 CEST | 49717 | 443 | 192.168.2.9 | 99.86.4.125 |
| Jul 30, 2024 00:49:13.388545990 CEST | 49717 | 443 | 192.168.2.9 | 99.86.4.125 |
| Jul 30, 2024 00:49:13.388580084 CEST | 443 | 49717 | 99.86.4.125 | 192.168.2.9 |
| Jul 30, 2024 00:49:13.878117085 CEST | 49677 | 443 | 192.168.2.9 | 20.189.173.11 |
| Jul 30, 2024 00:49:14.149182081 CEST | 443 | 49717 | 99.86.4.125 | 192.168.2.9 |
| Jul 30, 2024 00:49:14.150856972 CEST | 49717 | 443 | 192.168.2.9 | 99.86.4.125 |
| Jul 30, 2024 00:49:14.150881052 CEST | 443 | 49717 | 99.86.4.125 | 192.168.2.9 |
| Jul 30, 2024 00:49:14.151952028 CEST | 443 | 49717 | 99.86.4.125 | 192.168.2.9 |
| Jul 30, 2024 00:49:14.152100086 CEST | 49717 | 443 | 192.168.2.9 | 99.86.4.125 |
| Jul 30, 2024 00:49:14.153875113 CEST | 49717 | 443 | 192.168.2.9 | 99.86.4.125 |
| Jul 30, 2024 00:49:14.154022932 CEST | 443 | 49717 | 99.86.4.125 | 192.168.2.9 |
| Jul 30, 2024 00:49:14.154042959 CEST | 49717 | 443 | 192.168.2.9 | 99.86.4.125 |
| Jul 30, 2024 00:49:14.154093027 CEST | 49717 | 443 | 192.168.2.9 | 99.86.4.125 |
| Jul 30, 2024 00:49:14.260462999 CEST | 49720 | 443 | 192.168.2.9 | 99.86.4.125 |
| Jul 30, 2024 00:49:14.260515928 CEST | 443 | 49720 | 99.86.4.125 | 192.168.2.9 |
| Jul 30, 2024 00:49:14.260585070 CEST | 49720 | 443 | 192.168.2.9 | 99.86.4.125 |
| Jul 30, 2024 00:49:14.478387117 CEST | 49720 | 443 | 192.168.2.9 | 99.86.4.125 |
| Jul 30, 2024 00:49:14.478421926 CEST | 443 | 49720 | 99.86.4.125 | 192.168.2.9 |
| Jul 30, 2024 00:49:15.112637043 CEST | 49722 | 443 | 192.168.2.9 | 172.67.149.76 |
| Jul 30, 2024 00:49:15.112668991 CEST | 443 | 49722 | 172.67.149.76 | 192.168.2.9 |
| Jul 30, 2024 00:49:15.112716913 CEST | 49722 | 443 | 192.168.2.9 | 172.67.149.76 |
| Jul 30, 2024 00:49:15.115649939 CEST | 49722 | 443 | 192.168.2.9 | 172.67.149.76 |
| Jul 30, 2024 00:49:15.115668058 CEST | 443 | 49722 | 172.67.149.76 | 192.168.2.9 |
| Jul 30, 2024 00:49:15.465991974 CEST | 443 | 49720 | 99.86.4.125 | 192.168.2.9 |
| Jul 30, 2024 00:49:15.466398954 CEST | 49720 | 443 | 192.168.2.9 | 99.86.4.125 |
| Jul 30, 2024 00:49:15.466454983 CEST | 443 | 49720 | 99.86.4.125 | 192.168.2.9 |
| Jul 30, 2024 00:49:15.467525959 CEST | 443 | 49720 | 99.86.4.125 | 192.168.2.9 |
| Jul 30, 2024 00:49:15.467664003 CEST | 49720 | 443 | 192.168.2.9 | 99.86.4.125 |
| Jul 30, 2024 00:49:15.468907118 CEST | 49720 | 443 | 192.168.2.9 | 99.86.4.125 |
| Jul 30, 2024 00:49:15.468943119 CEST | 49720 | 443 | 192.168.2.9 | 99.86.4.125 |
| Jul 30, 2024 00:49:15.606834888 CEST | 443 | 49722 | 172.67.149.76 | 192.168.2.9 |
| Jul 30, 2024 00:49:15.607289076 CEST | 49722 | 443 | 192.168.2.9 | 172.67.149.76 |
| Jul 30, 2024 00:49:15.607320070 CEST | 443 | 49722 | 172.67.149.76 | 192.168.2.9 |
| Jul 30, 2024 00:49:15.609271049 CEST | 443 | 49722 | 172.67.149.76 | 192.168.2.9 |
| Jul 30, 2024 00:49:15.609333038 CEST | 49722 | 443 | 192.168.2.9 | 172.67.149.76 |
| Jul 30, 2024 00:49:15.612157106 CEST | 49722 | 443 | 192.168.2.9 | 172.67.149.76 |
| Jul 30, 2024 00:49:15.612297058 CEST | 443 | 49722 | 172.67.149.76 | 192.168.2.9 |
| Jul 30, 2024 00:49:15.612724066 CEST | 49722 | 443 | 192.168.2.9 | 172.67.149.76 |
| Jul 30, 2024 00:49:15.612732887 CEST | 443 | 49722 | 172.67.149.76 | 192.168.2.9 |
| Jul 30, 2024 00:49:15.663101912 CEST | 49722 | 443 | 192.168.2.9 | 172.67.149.76 |
| Jul 30, 2024 00:49:16.122145891 CEST | 443 | 49722 | 172.67.149.76 | 192.168.2.9 |
| Jul 30, 2024 00:49:16.122222900 CEST | 443 | 49722 | 172.67.149.76 | 192.168.2.9 |
| Jul 30, 2024 00:49:16.122278929 CEST | 49722 | 443 | 192.168.2.9 | 172.67.149.76 |
| Jul 30, 2024 00:49:16.122289896 CEST | 443 | 49722 | 172.67.149.76 | 192.168.2.9 |
| Jul 30, 2024 00:49:16.122304916 CEST | 443 | 49722 | 172.67.149.76 | 192.168.2.9 |
| Jul 30, 2024 00:49:16.122386932 CEST | 49722 | 443 | 192.168.2.9 | 172.67.149.76 |
| Jul 30, 2024 00:49:16.122390985 CEST | 443 | 49722 | 172.67.149.76 | 192.168.2.9 |
| Jul 30, 2024 00:49:16.122405052 CEST | 443 | 49722 | 172.67.149.76 | 192.168.2.9 |
| Jul 30, 2024 00:49:16.122446060 CEST | 49722 | 443 | 192.168.2.9 | 172.67.149.76 |
| Jul 30, 2024 00:49:16.122457027 CEST | 443 | 49722 | 172.67.149.76 | 192.168.2.9 |
| Jul 30, 2024 00:49:16.123317957 CEST | 443 | 49722 | 172.67.149.76 | 192.168.2.9 |
| Jul 30, 2024 00:49:16.123449087 CEST | 443 | 49722 | 172.67.149.76 | 192.168.2.9 |
| Jul 30, 2024 00:49:16.123503923 CEST | 49722 | 443 | 192.168.2.9 | 172.67.149.76 |
| Jul 30, 2024 00:49:16.145457029 CEST | 49722 | 443 | 192.168.2.9 | 172.67.149.76 |
| Jul 30, 2024 00:49:16.145489931 CEST | 443 | 49722 | 172.67.149.76 | 192.168.2.9 |
| Jul 30, 2024 00:49:16.420614958 CEST | 49730 | 443 | 192.168.2.9 | 88.212.202.52 |
| Jul 30, 2024 00:49:16.420644999 CEST | 443 | 49730 | 88.212.202.52 | 192.168.2.9 |
| Jul 30, 2024 00:49:16.421022892 CEST | 49730 | 443 | 192.168.2.9 | 88.212.202.52 |
| Jul 30, 2024 00:49:16.421416044 CEST | 49731 | 443 | 192.168.2.9 | 104.21.4.208 |
| Jul 30, 2024 00:49:16.421449900 CEST | 443 | 49731 | 104.21.4.208 | 192.168.2.9 |
| Jul 30, 2024 00:49:16.421657085 CEST | 49731 | 443 | 192.168.2.9 | 104.21.4.208 |
| Jul 30, 2024 00:49:16.422055960 CEST | 49730 | 443 | 192.168.2.9 | 88.212.202.52 |
| Jul 30, 2024 00:49:16.422080994 CEST | 443 | 49730 | 88.212.202.52 | 192.168.2.9 |
| Jul 30, 2024 00:49:16.422375917 CEST | 49731 | 443 | 192.168.2.9 | 104.21.4.208 |
| Jul 30, 2024 00:49:16.422393084 CEST | 443 | 49731 | 104.21.4.208 | 192.168.2.9 |
| Jul 30, 2024 00:49:16.913902998 CEST | 443 | 49731 | 104.21.4.208 | 192.168.2.9 |
| Jul 30, 2024 00:49:16.968148947 CEST | 49731 | 443 | 192.168.2.9 | 104.21.4.208 |
| Jul 30, 2024 00:49:17.162724018 CEST | 49731 | 443 | 192.168.2.9 | 104.21.4.208 |
| Jul 30, 2024 00:49:17.162750959 CEST | 443 | 49731 | 104.21.4.208 | 192.168.2.9 |
| Jul 30, 2024 00:49:17.164016008 CEST | 443 | 49731 | 104.21.4.208 | 192.168.2.9 |
| Jul 30, 2024 00:49:17.164031982 CEST | 443 | 49731 | 104.21.4.208 | 192.168.2.9 |
| Jul 30, 2024 00:49:17.164175034 CEST | 49731 | 443 | 192.168.2.9 | 104.21.4.208 |
| Jul 30, 2024 00:49:17.166086912 CEST | 49731 | 443 | 192.168.2.9 | 104.21.4.208 |
| Jul 30, 2024 00:49:17.166201115 CEST | 443 | 49731 | 104.21.4.208 | 192.168.2.9 |
| Jul 30, 2024 00:49:17.166455984 CEST | 49731 | 443 | 192.168.2.9 | 104.21.4.208 |
| Jul 30, 2024 00:49:17.166476011 CEST | 443 | 49731 | 104.21.4.208 | 192.168.2.9 |
| Jul 30, 2024 00:49:17.207209110 CEST | 49731 | 443 | 192.168.2.9 | 104.21.4.208 |
| Jul 30, 2024 00:49:17.259076118 CEST | 49732 | 443 | 192.168.2.9 | 20.114.59.183 |
| Jul 30, 2024 00:49:17.259121895 CEST | 443 | 49732 | 20.114.59.183 | 192.168.2.9 |
| Jul 30, 2024 00:49:17.259207010 CEST | 49732 | 443 | 192.168.2.9 | 20.114.59.183 |
| Jul 30, 2024 00:49:17.265650988 CEST | 49732 | 443 | 192.168.2.9 | 20.114.59.183 |
| Jul 30, 2024 00:49:17.265665054 CEST | 443 | 49732 | 20.114.59.183 | 192.168.2.9 |
| Jul 30, 2024 00:49:17.279609919 CEST | 443 | 49731 | 104.21.4.208 | 192.168.2.9 |
| Jul 30, 2024 00:49:17.279704094 CEST | 443 | 49731 | 104.21.4.208 | 192.168.2.9 |
| Jul 30, 2024 00:49:17.279732943 CEST | 443 | 49731 | 104.21.4.208 | 192.168.2.9 |
| Jul 30, 2024 00:49:17.279761076 CEST | 443 | 49731 | 104.21.4.208 | 192.168.2.9 |
| Jul 30, 2024 00:49:17.279825926 CEST | 49731 | 443 | 192.168.2.9 | 104.21.4.208 |
| Jul 30, 2024 00:49:17.279850006 CEST | 443 | 49731 | 104.21.4.208 | 192.168.2.9 |
| Jul 30, 2024 00:49:17.279867887 CEST | 49731 | 443 | 192.168.2.9 | 104.21.4.208 |
| Jul 30, 2024 00:49:17.280817986 CEST | 49731 | 443 | 192.168.2.9 | 104.21.4.208 |
| Jul 30, 2024 00:49:17.280834913 CEST | 443 | 49731 | 104.21.4.208 | 192.168.2.9 |
| Jul 30, 2024 00:49:17.280875921 CEST | 49731 | 443 | 192.168.2.9 | 104.21.4.208 |
| Jul 30, 2024 00:49:17.300630093 CEST | 49733 | 443 | 192.168.2.9 | 35.190.80.1 |
| Jul 30, 2024 00:49:17.300669909 CEST | 443 | 49733 | 35.190.80.1 | 192.168.2.9 |
| Jul 30, 2024 00:49:17.300837994 CEST | 49733 | 443 | 192.168.2.9 | 35.190.80.1 |
| Jul 30, 2024 00:49:17.301341057 CEST | 49733 | 443 | 192.168.2.9 | 35.190.80.1 |
| Jul 30, 2024 00:49:17.301357985 CEST | 443 | 49733 | 35.190.80.1 | 192.168.2.9 |
| Jul 30, 2024 00:49:17.383107901 CEST | 443 | 49730 | 88.212.202.52 | 192.168.2.9 |
| Jul 30, 2024 00:49:17.383980036 CEST | 49730 | 443 | 192.168.2.9 | 88.212.202.52 |
| Jul 30, 2024 00:49:17.384011030 CEST | 443 | 49730 | 88.212.202.52 | 192.168.2.9 |
| Jul 30, 2024 00:49:17.385081053 CEST | 443 | 49730 | 88.212.202.52 | 192.168.2.9 |
| Jul 30, 2024 00:49:17.385160923 CEST | 49730 | 443 | 192.168.2.9 | 88.212.202.52 |
| Jul 30, 2024 00:49:17.391846895 CEST | 49730 | 443 | 192.168.2.9 | 88.212.202.52 |
| Jul 30, 2024 00:49:17.391928911 CEST | 443 | 49730 | 88.212.202.52 | 192.168.2.9 |
| Jul 30, 2024 00:49:17.392014980 CEST | 49730 | 443 | 192.168.2.9 | 88.212.202.52 |
| Jul 30, 2024 00:49:17.436497927 CEST | 443 | 49730 | 88.212.202.52 | 192.168.2.9 |
| Jul 30, 2024 00:49:17.446106911 CEST | 49730 | 443 | 192.168.2.9 | 88.212.202.52 |
| Jul 30, 2024 00:49:17.446126938 CEST | 443 | 49730 | 88.212.202.52 | 192.168.2.9 |
| Jul 30, 2024 00:49:17.494107962 CEST | 49730 | 443 | 192.168.2.9 | 88.212.202.52 |
| Jul 30, 2024 00:49:17.621140003 CEST | 443 | 49730 | 88.212.202.52 | 192.168.2.9 |
| Jul 30, 2024 00:49:17.621232033 CEST | 443 | 49730 | 88.212.202.52 | 192.168.2.9 |
| Jul 30, 2024 00:49:17.621438026 CEST | 49730 | 443 | 192.168.2.9 | 88.212.202.52 |
| Jul 30, 2024 00:49:17.621762991 CEST | 49730 | 443 | 192.168.2.9 | 88.212.202.52 |
| Jul 30, 2024 00:49:17.621790886 CEST | 443 | 49730 | 88.212.202.52 | 192.168.2.9 |
| Jul 30, 2024 00:49:17.621820927 CEST | 49730 | 443 | 192.168.2.9 | 88.212.202.52 |
| Jul 30, 2024 00:49:17.621841908 CEST | 49730 | 443 | 192.168.2.9 | 88.212.202.52 |
| Jul 30, 2024 00:49:17.624226093 CEST | 49736 | 443 | 192.168.2.9 | 88.212.202.52 |
| Jul 30, 2024 00:49:17.624245882 CEST | 443 | 49736 | 88.212.202.52 | 192.168.2.9 |
| Jul 30, 2024 00:49:17.624362946 CEST | 49736 | 443 | 192.168.2.9 | 88.212.202.52 |
| Jul 30, 2024 00:49:17.624562025 CEST | 49736 | 443 | 192.168.2.9 | 88.212.202.52 |
| Jul 30, 2024 00:49:17.624574900 CEST | 443 | 49736 | 88.212.202.52 | 192.168.2.9 |
| Jul 30, 2024 00:49:17.793275118 CEST | 443 | 49733 | 35.190.80.1 | 192.168.2.9 |
| Jul 30, 2024 00:49:17.806822062 CEST | 49733 | 443 | 192.168.2.9 | 35.190.80.1 |
| Jul 30, 2024 00:49:17.806858063 CEST | 443 | 49733 | 35.190.80.1 | 192.168.2.9 |
| Jul 30, 2024 00:49:17.808085918 CEST | 443 | 49733 | 35.190.80.1 | 192.168.2.9 |
| Jul 30, 2024 00:49:17.808150053 CEST | 49733 | 443 | 192.168.2.9 | 35.190.80.1 |
| Jul 30, 2024 00:49:17.810664892 CEST | 49733 | 443 | 192.168.2.9 | 35.190.80.1 |
| Jul 30, 2024 00:49:17.810734987 CEST | 443 | 49733 | 35.190.80.1 | 192.168.2.9 |
| Jul 30, 2024 00:49:17.810827971 CEST | 49733 | 443 | 192.168.2.9 | 35.190.80.1 |
| Jul 30, 2024 00:49:17.836663961 CEST | 49739 | 443 | 192.168.2.9 | 128.116.21.4 |
| Jul 30, 2024 00:49:17.836715937 CEST | 443 | 49739 | 128.116.21.4 | 192.168.2.9 |
| Jul 30, 2024 00:49:17.836878061 CEST | 49739 | 443 | 192.168.2.9 | 128.116.21.4 |
| Jul 30, 2024 00:49:17.838486910 CEST | 49739 | 443 | 192.168.2.9 | 128.116.21.4 |
| Jul 30, 2024 00:49:17.838505030 CEST | 443 | 49739 | 128.116.21.4 | 192.168.2.9 |
| Jul 30, 2024 00:49:17.856498957 CEST | 443 | 49733 | 35.190.80.1 | 192.168.2.9 |
| Jul 30, 2024 00:49:17.862107038 CEST | 49733 | 443 | 192.168.2.9 | 35.190.80.1 |
| Jul 30, 2024 00:49:17.862122059 CEST | 443 | 49733 | 35.190.80.1 | 192.168.2.9 |
| Jul 30, 2024 00:49:17.910136938 CEST | 49733 | 443 | 192.168.2.9 | 35.190.80.1 |
| Jul 30, 2024 00:49:17.945919037 CEST | 443 | 49733 | 35.190.80.1 | 192.168.2.9 |
| Jul 30, 2024 00:49:17.945986032 CEST | 443 | 49733 | 35.190.80.1 | 192.168.2.9 |
| Jul 30, 2024 00:49:17.946043968 CEST | 49733 | 443 | 192.168.2.9 | 35.190.80.1 |
| Jul 30, 2024 00:49:17.946322918 CEST | 49733 | 443 | 192.168.2.9 | 35.190.80.1 |
| Jul 30, 2024 00:49:17.946342945 CEST | 443 | 49733 | 35.190.80.1 | 192.168.2.9 |
| Jul 30, 2024 00:49:17.946999073 CEST | 49740 | 443 | 192.168.2.9 | 35.190.80.1 |
| Jul 30, 2024 00:49:17.947025061 CEST | 443 | 49740 | 35.190.80.1 | 192.168.2.9 |
| Jul 30, 2024 00:49:17.947309017 CEST | 49740 | 443 | 192.168.2.9 | 35.190.80.1 |
| Jul 30, 2024 00:49:17.947529078 CEST | 49740 | 443 | 192.168.2.9 | 35.190.80.1 |
| Jul 30, 2024 00:49:17.947542906 CEST | 443 | 49740 | 35.190.80.1 | 192.168.2.9 |
| Jul 30, 2024 00:49:18.082750082 CEST | 443 | 49732 | 20.114.59.183 | 192.168.2.9 |
| Jul 30, 2024 00:49:18.082840919 CEST | 49732 | 443 | 192.168.2.9 | 20.114.59.183 |
| Jul 30, 2024 00:49:18.085534096 CEST | 49732 | 443 | 192.168.2.9 | 20.114.59.183 |
| Jul 30, 2024 00:49:18.085546017 CEST | 443 | 49732 | 20.114.59.183 | 192.168.2.9 |
| Jul 30, 2024 00:49:18.085864067 CEST | 443 | 49732 | 20.114.59.183 | 192.168.2.9 |
| Jul 30, 2024 00:49:18.134115934 CEST | 49732 | 443 | 192.168.2.9 | 20.114.59.183 |
| Jul 30, 2024 00:49:18.161396980 CEST | 49732 | 443 | 192.168.2.9 | 20.114.59.183 |
| Jul 30, 2024 00:49:18.208492041 CEST | 443 | 49732 | 20.114.59.183 | 192.168.2.9 |
| Jul 30, 2024 00:49:18.228512049 CEST | 49704 | 443 | 192.168.2.9 | 23.206.229.209 |
| Jul 30, 2024 00:49:18.228552103 CEST | 49704 | 443 | 192.168.2.9 | 23.206.229.209 |
| Jul 30, 2024 00:49:18.238611937 CEST | 49741 | 443 | 192.168.2.9 | 23.206.229.209 |
| Jul 30, 2024 00:49:18.238650084 CEST | 443 | 49741 | 23.206.229.209 | 192.168.2.9 |
| Jul 30, 2024 00:49:18.239223957 CEST | 49741 | 443 | 192.168.2.9 | 23.206.229.209 |
| Jul 30, 2024 00:49:18.243215084 CEST | 49741 | 443 | 192.168.2.9 | 23.206.229.209 |
| Jul 30, 2024 00:49:18.243227005 CEST | 443 | 49741 | 23.206.229.209 | 192.168.2.9 |
| Jul 30, 2024 00:49:18.244162083 CEST | 443 | 49704 | 23.206.229.209 | 192.168.2.9 |
| Jul 30, 2024 00:49:18.244177103 CEST | 443 | 49704 | 23.206.229.209 | 192.168.2.9 |
| Jul 30, 2024 00:49:18.357819080 CEST | 443 | 49736 | 88.212.202.52 | 192.168.2.9 |
| Jul 30, 2024 00:49:18.358570099 CEST | 49736 | 443 | 192.168.2.9 | 88.212.202.52 |
| Jul 30, 2024 00:49:18.358594894 CEST | 443 | 49736 | 88.212.202.52 | 192.168.2.9 |
| Jul 30, 2024 00:49:18.359127998 CEST | 443 | 49736 | 88.212.202.52 | 192.168.2.9 |
| Jul 30, 2024 00:49:18.359529972 CEST | 49736 | 443 | 192.168.2.9 | 88.212.202.52 |
| Jul 30, 2024 00:49:18.359601021 CEST | 443 | 49736 | 88.212.202.52 | 192.168.2.9 |
| Jul 30, 2024 00:49:18.359719992 CEST | 49736 | 443 | 192.168.2.9 | 88.212.202.52 |
| Jul 30, 2024 00:49:18.404491901 CEST | 443 | 49736 | 88.212.202.52 | 192.168.2.9 |
| Jul 30, 2024 00:49:18.441020012 CEST | 443 | 49732 | 20.114.59.183 | 192.168.2.9 |
| Jul 30, 2024 00:49:18.441042900 CEST | 443 | 49732 | 20.114.59.183 | 192.168.2.9 |
| Jul 30, 2024 00:49:18.441050053 CEST | 443 | 49732 | 20.114.59.183 | 192.168.2.9 |
| Jul 30, 2024 00:49:18.441060066 CEST | 443 | 49732 | 20.114.59.183 | 192.168.2.9 |
| Jul 30, 2024 00:49:18.441077948 CEST | 443 | 49732 | 20.114.59.183 | 192.168.2.9 |
| Jul 30, 2024 00:49:18.441135883 CEST | 49732 | 443 | 192.168.2.9 | 20.114.59.183 |
| Jul 30, 2024 00:49:18.441179037 CEST | 443 | 49732 | 20.114.59.183 | 192.168.2.9 |
| Jul 30, 2024 00:49:18.441207886 CEST | 49732 | 443 | 192.168.2.9 | 20.114.59.183 |
| Jul 30, 2024 00:49:18.441227913 CEST | 49732 | 443 | 192.168.2.9 | 20.114.59.183 |
| Jul 30, 2024 00:49:18.443408012 CEST | 443 | 49732 | 20.114.59.183 | 192.168.2.9 |
| Jul 30, 2024 00:49:18.443480015 CEST | 49732 | 443 | 192.168.2.9 | 20.114.59.183 |
| Jul 30, 2024 00:49:18.443511963 CEST | 443 | 49732 | 20.114.59.183 | 192.168.2.9 |
| Jul 30, 2024 00:49:18.443532944 CEST | 443 | 49732 | 20.114.59.183 | 192.168.2.9 |
| Jul 30, 2024 00:49:18.443605900 CEST | 49732 | 443 | 192.168.2.9 | 20.114.59.183 |
| Jul 30, 2024 00:49:18.467045069 CEST | 443 | 49740 | 35.190.80.1 | 192.168.2.9 |
| Jul 30, 2024 00:49:18.476370096 CEST | 49740 | 443 | 192.168.2.9 | 35.190.80.1 |
| Jul 30, 2024 00:49:18.476391077 CEST | 443 | 49740 | 35.190.80.1 | 192.168.2.9 |
| Jul 30, 2024 00:49:18.476799965 CEST | 443 | 49740 | 35.190.80.1 | 192.168.2.9 |
| Jul 30, 2024 00:49:18.477507114 CEST | 49732 | 443 | 192.168.2.9 | 20.114.59.183 |
| Jul 30, 2024 00:49:18.477519989 CEST | 443 | 49732 | 20.114.59.183 | 192.168.2.9 |
| Jul 30, 2024 00:49:18.477533102 CEST | 49732 | 443 | 192.168.2.9 | 20.114.59.183 |
| Jul 30, 2024 00:49:18.477538109 CEST | 443 | 49732 | 20.114.59.183 | 192.168.2.9 |
| Jul 30, 2024 00:49:18.477714062 CEST | 49740 | 443 | 192.168.2.9 | 35.190.80.1 |
| Jul 30, 2024 00:49:18.477777004 CEST | 443 | 49740 | 35.190.80.1 | 192.168.2.9 |
| Jul 30, 2024 00:49:18.477999926 CEST | 49740 | 443 | 192.168.2.9 | 35.190.80.1 |
| Jul 30, 2024 00:49:18.524503946 CEST | 443 | 49740 | 35.190.80.1 | 192.168.2.9 |
| Jul 30, 2024 00:49:18.576791048 CEST | 443 | 49739 | 128.116.21.4 | 192.168.2.9 |
| Jul 30, 2024 00:49:18.584754944 CEST | 49739 | 443 | 192.168.2.9 | 128.116.21.4 |
| Jul 30, 2024 00:49:18.584791899 CEST | 443 | 49739 | 128.116.21.4 | 192.168.2.9 |
| Jul 30, 2024 00:49:18.585882902 CEST | 443 | 49739 | 128.116.21.4 | 192.168.2.9 |
| Jul 30, 2024 00:49:18.585938931 CEST | 49739 | 443 | 192.168.2.9 | 128.116.21.4 |
| Jul 30, 2024 00:49:18.589524031 CEST | 49739 | 443 | 192.168.2.9 | 128.116.21.4 |
| Jul 30, 2024 00:49:18.589699030 CEST | 443 | 49739 | 128.116.21.4 | 192.168.2.9 |
| Jul 30, 2024 00:49:18.589699984 CEST | 49739 | 443 | 192.168.2.9 | 128.116.21.4 |
| Jul 30, 2024 00:49:18.589890957 CEST | 49739 | 443 | 192.168.2.9 | 128.116.21.4 |
| Jul 30, 2024 00:49:18.618577003 CEST | 443 | 49740 | 35.190.80.1 | 192.168.2.9 |
| Jul 30, 2024 00:49:18.618709087 CEST | 443 | 49740 | 35.190.80.1 | 192.168.2.9 |
| Jul 30, 2024 00:49:18.618773937 CEST | 49740 | 443 | 192.168.2.9 | 35.190.80.1 |
| Jul 30, 2024 00:49:18.619024992 CEST | 49740 | 443 | 192.168.2.9 | 35.190.80.1 |
| Jul 30, 2024 00:49:18.619044065 CEST | 443 | 49740 | 35.190.80.1 | 192.168.2.9 |
| Jul 30, 2024 00:49:18.771528006 CEST | 443 | 49736 | 88.212.202.52 | 192.168.2.9 |
| Jul 30, 2024 00:49:18.771616936 CEST | 443 | 49736 | 88.212.202.52 | 192.168.2.9 |
| Jul 30, 2024 00:49:18.771972895 CEST | 49736 | 443 | 192.168.2.9 | 88.212.202.52 |
| Jul 30, 2024 00:49:18.783961058 CEST | 49736 | 443 | 192.168.2.9 | 88.212.202.52 |
| Jul 30, 2024 00:49:18.783984900 CEST | 443 | 49736 | 88.212.202.52 | 192.168.2.9 |
| Jul 30, 2024 00:49:18.796180964 CEST | 49742 | 443 | 192.168.2.9 | 104.21.4.208 |
| Jul 30, 2024 00:49:18.796236038 CEST | 443 | 49742 | 104.21.4.208 | 192.168.2.9 |
| Jul 30, 2024 00:49:18.796302080 CEST | 49742 | 443 | 192.168.2.9 | 104.21.4.208 |
| Jul 30, 2024 00:49:18.796549082 CEST | 49742 | 443 | 192.168.2.9 | 104.21.4.208 |
| Jul 30, 2024 00:49:18.796566010 CEST | 443 | 49742 | 104.21.4.208 | 192.168.2.9 |
| Jul 30, 2024 00:49:18.823096037 CEST | 49743 | 443 | 192.168.2.9 | 88.212.201.204 |
| Jul 30, 2024 00:49:18.823132038 CEST | 443 | 49743 | 88.212.201.204 | 192.168.2.9 |
| Jul 30, 2024 00:49:18.823201895 CEST | 49743 | 443 | 192.168.2.9 | 88.212.201.204 |
| Jul 30, 2024 00:49:18.823530912 CEST | 49743 | 443 | 192.168.2.9 | 88.212.201.204 |
| Jul 30, 2024 00:49:18.823553085 CEST | 443 | 49743 | 88.212.201.204 | 192.168.2.9 |
| Jul 30, 2024 00:49:18.926610947 CEST | 443 | 49741 | 23.206.229.209 | 192.168.2.9 |
| Jul 30, 2024 00:49:18.926682949 CEST | 49741 | 443 | 192.168.2.9 | 23.206.229.209 |
| Jul 30, 2024 00:49:18.944250107 CEST | 49744 | 443 | 192.168.2.9 | 142.250.184.228 |
| Jul 30, 2024 00:49:18.944310904 CEST | 443 | 49744 | 142.250.184.228 | 192.168.2.9 |
| Jul 30, 2024 00:49:18.944437981 CEST | 49744 | 443 | 192.168.2.9 | 142.250.184.228 |
| Jul 30, 2024 00:49:18.944639921 CEST | 49744 | 443 | 192.168.2.9 | 142.250.184.228 |
| Jul 30, 2024 00:49:18.944655895 CEST | 443 | 49744 | 142.250.184.228 | 192.168.2.9 |
| Jul 30, 2024 00:49:18.959341049 CEST | 49741 | 443 | 192.168.2.9 | 23.206.229.209 |
| Jul 30, 2024 00:49:18.959366083 CEST | 443 | 49741 | 23.206.229.209 | 192.168.2.9 |
| Jul 30, 2024 00:49:18.959701061 CEST | 443 | 49741 | 23.206.229.209 | 192.168.2.9 |
| Jul 30, 2024 00:49:18.959891081 CEST | 49741 | 443 | 192.168.2.9 | 23.206.229.209 |
| Jul 30, 2024 00:49:18.960900068 CEST | 49741 | 443 | 192.168.2.9 | 23.206.229.209 |
| Jul 30, 2024 00:49:18.960915089 CEST | 443 | 49741 | 23.206.229.209 | 192.168.2.9 |
| Jul 30, 2024 00:49:18.961138010 CEST | 49741 | 443 | 192.168.2.9 | 23.206.229.209 |
| Jul 30, 2024 00:49:19.008493900 CEST | 443 | 49741 | 23.206.229.209 | 192.168.2.9 |
| Jul 30, 2024 00:49:19.330658913 CEST | 443 | 49741 | 23.206.229.209 | 192.168.2.9 |
| Jul 30, 2024 00:49:19.330936909 CEST | 49741 | 443 | 192.168.2.9 | 23.206.229.209 |
| Jul 30, 2024 00:49:19.331314087 CEST | 443 | 49741 | 23.206.229.209 | 192.168.2.9 |
| Jul 30, 2024 00:49:19.331397057 CEST | 443 | 49741 | 23.206.229.209 | 192.168.2.9 |
| Jul 30, 2024 00:49:19.331442118 CEST | 49741 | 443 | 192.168.2.9 | 23.206.229.209 |
| Jul 30, 2024 00:49:19.331512928 CEST | 49741 | 443 | 192.168.2.9 | 23.206.229.209 |
| Jul 30, 2024 00:49:19.429191113 CEST | 443 | 49742 | 104.21.4.208 | 192.168.2.9 |
| Jul 30, 2024 00:49:19.447411060 CEST | 49742 | 443 | 192.168.2.9 | 104.21.4.208 |
| Jul 30, 2024 00:49:19.447477102 CEST | 443 | 49742 | 104.21.4.208 | 192.168.2.9 |
| Jul 30, 2024 00:49:19.448632002 CEST | 443 | 49742 | 104.21.4.208 | 192.168.2.9 |
| Jul 30, 2024 00:49:19.448702097 CEST | 49742 | 443 | 192.168.2.9 | 104.21.4.208 |
| Jul 30, 2024 00:49:19.479351044 CEST | 49742 | 443 | 192.168.2.9 | 104.21.4.208 |
| Jul 30, 2024 00:49:19.479623079 CEST | 443 | 49742 | 104.21.4.208 | 192.168.2.9 |
| Jul 30, 2024 00:49:19.479662895 CEST | 49742 | 443 | 192.168.2.9 | 104.21.4.208 |
| Jul 30, 2024 00:49:19.520508051 CEST | 443 | 49742 | 104.21.4.208 | 192.168.2.9 |
| Jul 30, 2024 00:49:19.534118891 CEST | 49742 | 443 | 192.168.2.9 | 104.21.4.208 |
| Jul 30, 2024 00:49:19.534147978 CEST | 443 | 49742 | 104.21.4.208 | 192.168.2.9 |
| Jul 30, 2024 00:49:19.582146883 CEST | 49742 | 443 | 192.168.2.9 | 104.21.4.208 |
| Jul 30, 2024 00:49:19.597414017 CEST | 443 | 49742 | 104.21.4.208 | 192.168.2.9 |
| Jul 30, 2024 00:49:19.597465992 CEST | 443 | 49742 | 104.21.4.208 | 192.168.2.9 |
| Jul 30, 2024 00:49:19.597556114 CEST | 443 | 49742 | 104.21.4.208 | 192.168.2.9 |
| Jul 30, 2024 00:49:19.597582102 CEST | 443 | 49742 | 104.21.4.208 | 192.168.2.9 |
| Jul 30, 2024 00:49:19.597605944 CEST | 49742 | 443 | 192.168.2.9 | 104.21.4.208 |
| Jul 30, 2024 00:49:19.597645044 CEST | 49742 | 443 | 192.168.2.9 | 104.21.4.208 |
| Jul 30, 2024 00:49:19.608587980 CEST | 49742 | 443 | 192.168.2.9 | 104.21.4.208 |
| Jul 30, 2024 00:49:19.608638048 CEST | 443 | 49742 | 104.21.4.208 | 192.168.2.9 |
| Jul 30, 2024 00:49:19.684720993 CEST | 443 | 49744 | 142.250.184.228 | 192.168.2.9 |
| Jul 30, 2024 00:49:19.685235023 CEST | 49744 | 443 | 192.168.2.9 | 142.250.184.228 |
| Jul 30, 2024 00:49:19.685266972 CEST | 443 | 49744 | 142.250.184.228 | 192.168.2.9 |
| Jul 30, 2024 00:49:19.686338902 CEST | 443 | 49744 | 142.250.184.228 | 192.168.2.9 |
| Jul 30, 2024 00:49:19.686404943 CEST | 49744 | 443 | 192.168.2.9 | 142.250.184.228 |
| Jul 30, 2024 00:49:19.691030025 CEST | 49744 | 443 | 192.168.2.9 | 142.250.184.228 |
| Jul 30, 2024 00:49:19.691112041 CEST | 443 | 49744 | 142.250.184.228 | 192.168.2.9 |
| Jul 30, 2024 00:49:19.694053888 CEST | 49745 | 443 | 192.168.2.9 | 184.28.90.27 |
| Jul 30, 2024 00:49:19.694076061 CEST | 443 | 49745 | 184.28.90.27 | 192.168.2.9 |
| Jul 30, 2024 00:49:19.694169044 CEST | 49745 | 443 | 192.168.2.9 | 184.28.90.27 |
| Jul 30, 2024 00:49:19.695379972 CEST | 49745 | 443 | 192.168.2.9 | 184.28.90.27 |
| Jul 30, 2024 00:49:19.695393085 CEST | 443 | 49745 | 184.28.90.27 | 192.168.2.9 |
| Jul 30, 2024 00:49:19.706334114 CEST | 49746 | 443 | 192.168.2.9 | 104.21.4.208 |
| Jul 30, 2024 00:49:19.706362009 CEST | 443 | 49746 | 104.21.4.208 | 192.168.2.9 |
| Jul 30, 2024 00:49:19.706578970 CEST | 49746 | 443 | 192.168.2.9 | 104.21.4.208 |
| Jul 30, 2024 00:49:19.706846952 CEST | 49746 | 443 | 192.168.2.9 | 104.21.4.208 |
| Jul 30, 2024 00:49:19.706864119 CEST | 443 | 49746 | 104.21.4.208 | 192.168.2.9 |
| Jul 30, 2024 00:49:19.740123034 CEST | 49744 | 443 | 192.168.2.9 | 142.250.184.228 |
| Jul 30, 2024 00:49:19.740185022 CEST | 443 | 49744 | 142.250.184.228 | 192.168.2.9 |
| Jul 30, 2024 00:49:19.787126064 CEST | 49744 | 443 | 192.168.2.9 | 142.250.184.228 |
| Jul 30, 2024 00:49:20.044446945 CEST | 443 | 49743 | 88.212.201.204 | 192.168.2.9 |
| Jul 30, 2024 00:49:20.044755936 CEST | 49743 | 443 | 192.168.2.9 | 88.212.201.204 |
| Jul 30, 2024 00:49:20.044765949 CEST | 443 | 49743 | 88.212.201.204 | 192.168.2.9 |
| Jul 30, 2024 00:49:20.045845032 CEST | 443 | 49743 | 88.212.201.204 | 192.168.2.9 |
| Jul 30, 2024 00:49:20.045996904 CEST | 49743 | 443 | 192.168.2.9 | 88.212.201.204 |
| Jul 30, 2024 00:49:20.046252012 CEST | 49743 | 443 | 192.168.2.9 | 88.212.201.204 |
| Jul 30, 2024 00:49:20.046309948 CEST | 443 | 49743 | 88.212.201.204 | 192.168.2.9 |
| Jul 30, 2024 00:49:20.046441078 CEST | 49743 | 443 | 192.168.2.9 | 88.212.201.204 |
| Jul 30, 2024 00:49:20.046447992 CEST | 443 | 49743 | 88.212.201.204 | 192.168.2.9 |
| Jul 30, 2024 00:49:20.099081993 CEST | 49743 | 443 | 192.168.2.9 | 88.212.201.204 |
| Jul 30, 2024 00:49:20.204250097 CEST | 443 | 49746 | 104.21.4.208 | 192.168.2.9 |
| Jul 30, 2024 00:49:20.204536915 CEST | 49746 | 443 | 192.168.2.9 | 104.21.4.208 |
| Jul 30, 2024 00:49:20.204565048 CEST | 443 | 49746 | 104.21.4.208 | 192.168.2.9 |
| Jul 30, 2024 00:49:20.205607891 CEST | 443 | 49746 | 104.21.4.208 | 192.168.2.9 |
| Jul 30, 2024 00:49:20.205688000 CEST | 49746 | 443 | 192.168.2.9 | 104.21.4.208 |
| Jul 30, 2024 00:49:20.206142902 CEST | 49746 | 443 | 192.168.2.9 | 104.21.4.208 |
| Jul 30, 2024 00:49:20.206202984 CEST | 443 | 49746 | 104.21.4.208 | 192.168.2.9 |
| Jul 30, 2024 00:49:20.206592083 CEST | 49746 | 443 | 192.168.2.9 | 104.21.4.208 |
| Jul 30, 2024 00:49:20.206598997 CEST | 443 | 49746 | 104.21.4.208 | 192.168.2.9 |
| Jul 30, 2024 00:49:20.252103090 CEST | 49746 | 443 | 192.168.2.9 | 104.21.4.208 |
| Jul 30, 2024 00:49:20.280524969 CEST | 443 | 49743 | 88.212.201.204 | 192.168.2.9 |
| Jul 30, 2024 00:49:20.280608892 CEST | 443 | 49743 | 88.212.201.204 | 192.168.2.9 |
| Jul 30, 2024 00:49:20.280953884 CEST | 49743 | 443 | 192.168.2.9 | 88.212.201.204 |
| Jul 30, 2024 00:49:20.281857014 CEST | 49743 | 443 | 192.168.2.9 | 88.212.201.204 |
| Jul 30, 2024 00:49:20.281884909 CEST | 443 | 49743 | 88.212.201.204 | 192.168.2.9 |
| Jul 30, 2024 00:49:20.339958906 CEST | 443 | 49746 | 104.21.4.208 | 192.168.2.9 |
| Jul 30, 2024 00:49:20.340008020 CEST | 443 | 49746 | 104.21.4.208 | 192.168.2.9 |
| Jul 30, 2024 00:49:20.340059042 CEST | 443 | 49746 | 104.21.4.208 | 192.168.2.9 |
| Jul 30, 2024 00:49:20.340063095 CEST | 49746 | 443 | 192.168.2.9 | 104.21.4.208 |
| Jul 30, 2024 00:49:20.340090990 CEST | 443 | 49746 | 104.21.4.208 | 192.168.2.9 |
| Jul 30, 2024 00:49:20.340107918 CEST | 443 | 49746 | 104.21.4.208 | 192.168.2.9 |
| Jul 30, 2024 00:49:20.340152025 CEST | 49746 | 443 | 192.168.2.9 | 104.21.4.208 |
| Jul 30, 2024 00:49:20.341438055 CEST | 49746 | 443 | 192.168.2.9 | 104.21.4.208 |
| Jul 30, 2024 00:49:20.341460943 CEST | 443 | 49746 | 104.21.4.208 | 192.168.2.9 |
| Jul 30, 2024 00:49:20.357779026 CEST | 443 | 49745 | 184.28.90.27 | 192.168.2.9 |
| Jul 30, 2024 00:49:20.357870102 CEST | 49745 | 443 | 192.168.2.9 | 184.28.90.27 |
| Jul 30, 2024 00:49:20.359870911 CEST | 49745 | 443 | 192.168.2.9 | 184.28.90.27 |
| Jul 30, 2024 00:49:20.359878063 CEST | 443 | 49745 | 184.28.90.27 | 192.168.2.9 |
| Jul 30, 2024 00:49:20.360141039 CEST | 443 | 49745 | 184.28.90.27 | 192.168.2.9 |
| Jul 30, 2024 00:49:20.399698019 CEST | 49745 | 443 | 192.168.2.9 | 184.28.90.27 |
| Jul 30, 2024 00:49:20.444494009 CEST | 443 | 49745 | 184.28.90.27 | 192.168.2.9 |
| Jul 30, 2024 00:49:20.640281916 CEST | 443 | 49745 | 184.28.90.27 | 192.168.2.9 |
| Jul 30, 2024 00:49:20.640353918 CEST | 443 | 49745 | 184.28.90.27 | 192.168.2.9 |
| Jul 30, 2024 00:49:20.640619993 CEST | 49745 | 443 | 192.168.2.9 | 184.28.90.27 |
| Jul 30, 2024 00:49:20.640619993 CEST | 49745 | 443 | 192.168.2.9 | 184.28.90.27 |
| Jul 30, 2024 00:49:20.640660048 CEST | 49745 | 443 | 192.168.2.9 | 184.28.90.27 |
| Jul 30, 2024 00:49:20.640676975 CEST | 443 | 49745 | 184.28.90.27 | 192.168.2.9 |
| Jul 30, 2024 00:49:20.678009033 CEST | 49747 | 443 | 192.168.2.9 | 184.28.90.27 |
| Jul 30, 2024 00:49:20.678057909 CEST | 443 | 49747 | 184.28.90.27 | 192.168.2.9 |
| Jul 30, 2024 00:49:20.678273916 CEST | 49747 | 443 | 192.168.2.9 | 184.28.90.27 |
| Jul 30, 2024 00:49:20.678522110 CEST | 49747 | 443 | 192.168.2.9 | 184.28.90.27 |
| Jul 30, 2024 00:49:20.678543091 CEST | 443 | 49747 | 184.28.90.27 | 192.168.2.9 |
| Jul 30, 2024 00:49:20.910489082 CEST | 60079 | 53 | 192.168.2.9 | 1.1.1.1 |
| Jul 30, 2024 00:49:20.926155090 CEST | 53 | 60079 | 1.1.1.1 | 192.168.2.9 |
| Jul 30, 2024 00:49:20.926299095 CEST | 60079 | 53 | 192.168.2.9 | 1.1.1.1 |
| Jul 30, 2024 00:49:20.941904068 CEST | 53 | 60079 | 1.1.1.1 | 192.168.2.9 |
| Jul 30, 2024 00:49:21.336513996 CEST | 443 | 49747 | 184.28.90.27 | 192.168.2.9 |
| Jul 30, 2024 00:49:21.336587906 CEST | 49747 | 443 | 192.168.2.9 | 184.28.90.27 |
| Jul 30, 2024 00:49:21.337852001 CEST | 49747 | 443 | 192.168.2.9 | 184.28.90.27 |
| Jul 30, 2024 00:49:21.337862015 CEST | 443 | 49747 | 184.28.90.27 | 192.168.2.9 |
| Jul 30, 2024 00:49:21.338104963 CEST | 443 | 49747 | 184.28.90.27 | 192.168.2.9 |
| Jul 30, 2024 00:49:21.339317083 CEST | 49747 | 443 | 192.168.2.9 | 184.28.90.27 |
| Jul 30, 2024 00:49:21.384540081 CEST | 443 | 49747 | 184.28.90.27 | 192.168.2.9 |
| Jul 30, 2024 00:49:21.391017914 CEST | 60079 | 53 | 192.168.2.9 | 1.1.1.1 |
| Jul 30, 2024 00:49:21.406929016 CEST | 53 | 60079 | 1.1.1.1 | 192.168.2.9 |
| Jul 30, 2024 00:49:21.406996965 CEST | 60079 | 53 | 192.168.2.9 | 1.1.1.1 |
| Jul 30, 2024 00:49:21.623672009 CEST | 443 | 49747 | 184.28.90.27 | 192.168.2.9 |
| Jul 30, 2024 00:49:21.623763084 CEST | 443 | 49747 | 184.28.90.27 | 192.168.2.9 |
| Jul 30, 2024 00:49:21.623831034 CEST | 49747 | 443 | 192.168.2.9 | 184.28.90.27 |
| Jul 30, 2024 00:49:21.664633036 CEST | 49747 | 443 | 192.168.2.9 | 184.28.90.27 |
| Jul 30, 2024 00:49:21.664657116 CEST | 443 | 49747 | 184.28.90.27 | 192.168.2.9 |
| Jul 30, 2024 00:49:21.664668083 CEST | 49747 | 443 | 192.168.2.9 | 184.28.90.27 |
| Jul 30, 2024 00:49:21.664673090 CEST | 443 | 49747 | 184.28.90.27 | 192.168.2.9 |
| Jul 30, 2024 00:49:30.394463062 CEST | 443 | 49744 | 142.250.184.228 | 192.168.2.9 |
| Jul 30, 2024 00:49:30.394531965 CEST | 443 | 49744 | 142.250.184.228 | 192.168.2.9 |
| Jul 30, 2024 00:49:30.394619942 CEST | 49744 | 443 | 192.168.2.9 | 142.250.184.228 |
| Jul 30, 2024 00:49:31.518857002 CEST | 49744 | 443 | 192.168.2.9 | 142.250.184.228 |
| Jul 30, 2024 00:49:31.518887997 CEST | 443 | 49744 | 142.250.184.228 | 192.168.2.9 |
| Jul 30, 2024 00:49:33.475732088 CEST | 61118 | 53 | 192.168.2.9 | 162.159.36.2 |
| Jul 30, 2024 00:49:33.491411924 CEST | 53 | 61118 | 162.159.36.2 | 192.168.2.9 |
| Jul 30, 2024 00:49:33.491513968 CEST | 61118 | 53 | 192.168.2.9 | 162.159.36.2 |
| Jul 30, 2024 00:49:33.507250071 CEST | 53 | 61118 | 162.159.36.2 | 192.168.2.9 |
| Jul 30, 2024 00:49:33.947777033 CEST | 61118 | 53 | 192.168.2.9 | 162.159.36.2 |
| Jul 30, 2024 00:49:33.964658022 CEST | 53 | 61118 | 162.159.36.2 | 192.168.2.9 |
| Jul 30, 2024 00:49:33.964752913 CEST | 61118 | 53 | 192.168.2.9 | 162.159.36.2 |
| Jul 30, 2024 00:49:33.987051010 CEST | 61119 | 443 | 192.168.2.9 | 20.3.187.198 |
| Jul 30, 2024 00:49:33.987101078 CEST | 443 | 61119 | 20.3.187.198 | 192.168.2.9 |
| Jul 30, 2024 00:49:33.987178087 CEST | 61119 | 443 | 192.168.2.9 | 20.3.187.198 |
| Jul 30, 2024 00:49:33.987524033 CEST | 61119 | 443 | 192.168.2.9 | 20.3.187.198 |
| Jul 30, 2024 00:49:33.987543106 CEST | 443 | 61119 | 20.3.187.198 | 192.168.2.9 |
| Jul 30, 2024 00:49:34.811558008 CEST | 443 | 61119 | 20.3.187.198 | 192.168.2.9 |
| Jul 30, 2024 00:49:34.811686993 CEST | 61119 | 443 | 192.168.2.9 | 20.3.187.198 |
| Jul 30, 2024 00:49:34.813460112 CEST | 61119 | 443 | 192.168.2.9 | 20.3.187.198 |
| Jul 30, 2024 00:49:34.813472986 CEST | 443 | 61119 | 20.3.187.198 | 192.168.2.9 |
| Jul 30, 2024 00:49:34.813734055 CEST | 443 | 61119 | 20.3.187.198 | 192.168.2.9 |
| Jul 30, 2024 00:49:34.814852953 CEST | 61119 | 443 | 192.168.2.9 | 20.3.187.198 |
| Jul 30, 2024 00:49:34.856571913 CEST | 443 | 61119 | 20.3.187.198 | 192.168.2.9 |
| Jul 30, 2024 00:49:35.058593988 CEST | 443 | 61119 | 20.3.187.198 | 192.168.2.9 |
| Jul 30, 2024 00:49:35.058686018 CEST | 443 | 61119 | 20.3.187.198 | 192.168.2.9 |
| Jul 30, 2024 00:49:35.058860064 CEST | 61119 | 443 | 192.168.2.9 | 20.3.187.198 |
| Jul 30, 2024 00:49:35.059232950 CEST | 61119 | 443 | 192.168.2.9 | 20.3.187.198 |
| Jul 30, 2024 00:49:35.059257030 CEST | 443 | 61119 | 20.3.187.198 | 192.168.2.9 |
| Jul 30, 2024 00:49:35.102745056 CEST | 61120 | 443 | 192.168.2.9 | 20.114.59.183 |
| Jul 30, 2024 00:49:35.102776051 CEST | 443 | 61120 | 20.114.59.183 | 192.168.2.9 |
| Jul 30, 2024 00:49:35.102845907 CEST | 61120 | 443 | 192.168.2.9 | 20.114.59.183 |
| Jul 30, 2024 00:49:35.103204966 CEST | 61120 | 443 | 192.168.2.9 | 20.114.59.183 |
| Jul 30, 2024 00:49:35.103214025 CEST | 443 | 61120 | 20.114.59.183 | 192.168.2.9 |
| Jul 30, 2024 00:49:36.896433115 CEST | 61120 | 443 | 192.168.2.9 | 20.114.59.183 |
| Jul 30, 2024 00:49:37.783307076 CEST | 61121 | 443 | 192.168.2.9 | 52.165.165.26 |
| Jul 30, 2024 00:49:37.783348083 CEST | 443 | 61121 | 52.165.165.26 | 192.168.2.9 |
| Jul 30, 2024 00:49:37.783468008 CEST | 61121 | 443 | 192.168.2.9 | 52.165.165.26 |
| Jul 30, 2024 00:49:37.783792019 CEST | 61121 | 443 | 192.168.2.9 | 52.165.165.26 |
| Jul 30, 2024 00:49:37.783816099 CEST | 443 | 61121 | 52.165.165.26 | 192.168.2.9 |
| Jul 30, 2024 00:49:38.713001013 CEST | 443 | 61121 | 52.165.165.26 | 192.168.2.9 |
| Jul 30, 2024 00:49:38.713228941 CEST | 61121 | 443 | 192.168.2.9 | 52.165.165.26 |
| Jul 30, 2024 00:49:38.714957952 CEST | 61121 | 443 | 192.168.2.9 | 52.165.165.26 |
| Jul 30, 2024 00:49:38.714973927 CEST | 443 | 61121 | 52.165.165.26 | 192.168.2.9 |
| Jul 30, 2024 00:49:38.715250969 CEST | 443 | 61121 | 52.165.165.26 | 192.168.2.9 |
| Jul 30, 2024 00:49:38.716434956 CEST | 61121 | 443 | 192.168.2.9 | 52.165.165.26 |
| Jul 30, 2024 00:49:38.756505966 CEST | 443 | 61121 | 52.165.165.26 | 192.168.2.9 |
| Jul 30, 2024 00:49:38.903934002 CEST | 443 | 61121 | 52.165.165.26 | 192.168.2.9 |
| Jul 30, 2024 00:49:38.904191017 CEST | 443 | 61121 | 52.165.165.26 | 192.168.2.9 |
| Jul 30, 2024 00:49:38.904306889 CEST | 61121 | 443 | 192.168.2.9 | 52.165.165.26 |
| Jul 30, 2024 00:49:38.904406071 CEST | 61121 | 443 | 192.168.2.9 | 52.165.165.26 |
| Jul 30, 2024 00:49:38.904406071 CEST | 61121 | 443 | 192.168.2.9 | 52.165.165.26 |
| Jul 30, 2024 00:49:38.904432058 CEST | 443 | 61121 | 52.165.165.26 | 192.168.2.9 |
| Jul 30, 2024 00:49:38.904444933 CEST | 443 | 61121 | 52.165.165.26 | 192.168.2.9 |
| Jul 30, 2024 00:49:39.984611988 CEST | 61122 | 443 | 192.168.2.9 | 40.127.169.103 |
| Jul 30, 2024 00:49:39.984652042 CEST | 443 | 61122 | 40.127.169.103 | 192.168.2.9 |
| Jul 30, 2024 00:49:39.984750032 CEST | 61122 | 443 | 192.168.2.9 | 40.127.169.103 |
| Jul 30, 2024 00:49:39.985225916 CEST | 61122 | 443 | 192.168.2.9 | 40.127.169.103 |
| Jul 30, 2024 00:49:39.985235929 CEST | 443 | 61122 | 40.127.169.103 | 192.168.2.9 |
| Jul 30, 2024 00:49:40.805022955 CEST | 443 | 61122 | 40.127.169.103 | 192.168.2.9 |
| Jul 30, 2024 00:49:40.805136919 CEST | 61122 | 443 | 192.168.2.9 | 40.127.169.103 |
| Jul 30, 2024 00:49:40.806538105 CEST | 61122 | 443 | 192.168.2.9 | 40.127.169.103 |
| Jul 30, 2024 00:49:40.806566000 CEST | 443 | 61122 | 40.127.169.103 | 192.168.2.9 |
| Jul 30, 2024 00:49:40.806828976 CEST | 443 | 61122 | 40.127.169.103 | 192.168.2.9 |
| Jul 30, 2024 00:49:40.808001995 CEST | 61122 | 443 | 192.168.2.9 | 40.127.169.103 |
| Jul 30, 2024 00:49:40.852504969 CEST | 443 | 61122 | 40.127.169.103 | 192.168.2.9 |
| Jul 30, 2024 00:49:41.141707897 CEST | 443 | 61122 | 40.127.169.103 | 192.168.2.9 |
| Jul 30, 2024 00:49:41.141757011 CEST | 443 | 61122 | 40.127.169.103 | 192.168.2.9 |
| Jul 30, 2024 00:49:41.141771078 CEST | 443 | 61122 | 40.127.169.103 | 192.168.2.9 |
| Jul 30, 2024 00:49:41.141908884 CEST | 61122 | 443 | 192.168.2.9 | 40.127.169.103 |
| Jul 30, 2024 00:49:41.141937971 CEST | 443 | 61122 | 40.127.169.103 | 192.168.2.9 |
| Jul 30, 2024 00:49:41.142041922 CEST | 61122 | 443 | 192.168.2.9 | 40.127.169.103 |
| Jul 30, 2024 00:49:41.144329071 CEST | 443 | 61122 | 40.127.169.103 | 192.168.2.9 |
| Jul 30, 2024 00:49:41.144423008 CEST | 443 | 61122 | 40.127.169.103 | 192.168.2.9 |
| Jul 30, 2024 00:49:41.144445896 CEST | 61122 | 443 | 192.168.2.9 | 40.127.169.103 |
| Jul 30, 2024 00:49:41.144494057 CEST | 61122 | 443 | 192.168.2.9 | 40.127.169.103 |
| Jul 30, 2024 00:49:41.144927025 CEST | 61122 | 443 | 192.168.2.9 | 40.127.169.103 |
| Jul 30, 2024 00:49:41.144927025 CEST | 61122 | 443 | 192.168.2.9 | 40.127.169.103 |
| Jul 30, 2024 00:49:41.144943953 CEST | 443 | 61122 | 40.127.169.103 | 192.168.2.9 |
| Jul 30, 2024 00:49:41.144953966 CEST | 443 | 61122 | 40.127.169.103 | 192.168.2.9 |
| Jul 30, 2024 00:49:41.322896004 CEST | 61123 | 443 | 192.168.2.9 | 40.127.169.103 |
| Jul 30, 2024 00:49:41.322925091 CEST | 443 | 61123 | 40.127.169.103 | 192.168.2.9 |
| Jul 30, 2024 00:49:41.322999001 CEST | 61123 | 443 | 192.168.2.9 | 40.127.169.103 |
| Jul 30, 2024 00:49:41.323396921 CEST | 61123 | 443 | 192.168.2.9 | 40.127.169.103 |
| Jul 30, 2024 00:49:41.323405981 CEST | 443 | 61123 | 40.127.169.103 | 192.168.2.9 |
| Jul 30, 2024 00:49:42.139254093 CEST | 443 | 61123 | 40.127.169.103 | 192.168.2.9 |
| Jul 30, 2024 00:49:42.139425039 CEST | 61123 | 443 | 192.168.2.9 | 40.127.169.103 |
| Jul 30, 2024 00:49:42.141288042 CEST | 61123 | 443 | 192.168.2.9 | 40.127.169.103 |
| Jul 30, 2024 00:49:42.141310930 CEST | 443 | 61123 | 40.127.169.103 | 192.168.2.9 |
| Jul 30, 2024 00:49:42.141638041 CEST | 443 | 61123 | 40.127.169.103 | 192.168.2.9 |
| Jul 30, 2024 00:49:42.142836094 CEST | 61123 | 443 | 192.168.2.9 | 40.127.169.103 |
| Jul 30, 2024 00:49:42.188492060 CEST | 443 | 61123 | 40.127.169.103 | 192.168.2.9 |
| Jul 30, 2024 00:49:42.478075981 CEST | 443 | 61123 | 40.127.169.103 | 192.168.2.9 |
| Jul 30, 2024 00:49:42.478101015 CEST | 443 | 61123 | 40.127.169.103 | 192.168.2.9 |
| Jul 30, 2024 00:49:42.478131056 CEST | 443 | 61123 | 40.127.169.103 | 192.168.2.9 |
| Jul 30, 2024 00:49:42.478208065 CEST | 61123 | 443 | 192.168.2.9 | 40.127.169.103 |
| Jul 30, 2024 00:49:42.478234053 CEST | 443 | 61123 | 40.127.169.103 | 192.168.2.9 |
| Jul 30, 2024 00:49:42.478251934 CEST | 61123 | 443 | 192.168.2.9 | 40.127.169.103 |
| Jul 30, 2024 00:49:42.478280067 CEST | 61123 | 443 | 192.168.2.9 | 40.127.169.103 |
| Jul 30, 2024 00:49:42.482860088 CEST | 443 | 61123 | 40.127.169.103 | 192.168.2.9 |
| Jul 30, 2024 00:49:42.482898951 CEST | 443 | 61123 | 40.127.169.103 | 192.168.2.9 |
| Jul 30, 2024 00:49:42.482940912 CEST | 61123 | 443 | 192.168.2.9 | 40.127.169.103 |
| Jul 30, 2024 00:49:42.482949018 CEST | 443 | 61123 | 40.127.169.103 | 192.168.2.9 |
| Jul 30, 2024 00:49:42.482965946 CEST | 61123 | 443 | 192.168.2.9 | 40.127.169.103 |
| Jul 30, 2024 00:49:42.482975006 CEST | 443 | 61123 | 40.127.169.103 | 192.168.2.9 |
| Jul 30, 2024 00:49:42.483493090 CEST | 61123 | 443 | 192.168.2.9 | 40.127.169.103 |
| Jul 30, 2024 00:49:42.485455990 CEST | 61123 | 443 | 192.168.2.9 | 40.127.169.103 |
| Jul 30, 2024 00:49:42.485469103 CEST | 443 | 61123 | 40.127.169.103 | 192.168.2.9 |
| Jul 30, 2024 00:49:42.485493898 CEST | 61123 | 443 | 192.168.2.9 | 40.127.169.103 |
| Jul 30, 2024 00:49:42.485500097 CEST | 443 | 61123 | 40.127.169.103 | 192.168.2.9 |
| Jul 30, 2024 00:49:47.326420069 CEST | 49741 | 443 | 192.168.2.9 | 23.206.229.209 |
| Jul 30, 2024 00:49:47.326420069 CEST | 49741 | 443 | 192.168.2.9 | 23.206.229.209 |
| Jul 30, 2024 00:49:47.326474905 CEST | 443 | 49741 | 23.206.229.209 | 192.168.2.9 |
| Jul 30, 2024 00:49:47.326525927 CEST | 49741 | 443 | 192.168.2.9 | 23.206.229.209 |
| Jul 30, 2024 00:50:19.008589983 CEST | 61125 | 443 | 192.168.2.9 | 142.250.181.228 |
| Jul 30, 2024 00:50:19.008634090 CEST | 443 | 61125 | 142.250.181.228 | 192.168.2.9 |
| Jul 30, 2024 00:50:19.008814096 CEST | 61125 | 443 | 192.168.2.9 | 142.250.181.228 |
| Jul 30, 2024 00:50:19.008970022 CEST | 61125 | 443 | 192.168.2.9 | 142.250.181.228 |
| Jul 30, 2024 00:50:19.008981943 CEST | 443 | 61125 | 142.250.181.228 | 192.168.2.9 |
| Jul 30, 2024 00:50:19.664407969 CEST | 443 | 61125 | 142.250.181.228 | 192.168.2.9 |
| Jul 30, 2024 00:50:19.664683104 CEST | 61125 | 443 | 192.168.2.9 | 142.250.181.228 |
| Jul 30, 2024 00:50:19.664701939 CEST | 443 | 61125 | 142.250.181.228 | 192.168.2.9 |
| Jul 30, 2024 00:50:19.665220976 CEST | 443 | 61125 | 142.250.181.228 | 192.168.2.9 |
| Jul 30, 2024 00:50:19.665517092 CEST | 61125 | 443 | 192.168.2.9 | 142.250.181.228 |
| Jul 30, 2024 00:50:19.665571928 CEST | 443 | 61125 | 142.250.181.228 | 192.168.2.9 |
| Jul 30, 2024 00:50:19.720438004 CEST | 61125 | 443 | 192.168.2.9 | 142.250.181.228 |
| Jul 30, 2024 00:50:29.586137056 CEST | 443 | 61125 | 142.250.181.228 | 192.168.2.9 |
| Jul 30, 2024 00:50:29.586210012 CEST | 443 | 61125 | 142.250.181.228 | 192.168.2.9 |
| Jul 30, 2024 00:50:29.586266994 CEST | 61125 | 443 | 192.168.2.9 | 142.250.181.228 |
| Jul 30, 2024 00:50:31.520147085 CEST | 61125 | 443 | 192.168.2.9 | 142.250.181.228 |
| Jul 30, 2024 00:50:31.520179033 CEST | 443 | 61125 | 142.250.181.228 | 192.168.2.9 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Jul 30, 2024 00:49:01.688865900 CEST | 55932 | 53 | 192.168.2.9 | 1.1.1.1 |
| Jul 30, 2024 00:49:01.706537962 CEST | 53 | 55932 | 1.1.1.1 | 192.168.2.9 |
| Jul 30, 2024 00:49:02.582036018 CEST | 49338 | 53 | 192.168.2.9 | 1.1.1.1 |
| Jul 30, 2024 00:49:02.601408005 CEST | 53 | 49338 | 1.1.1.1 | 192.168.2.9 |
| Jul 30, 2024 00:49:15.079936028 CEST | 57716 | 53 | 192.168.2.9 | 1.1.1.1 |
| Jul 30, 2024 00:49:15.088238955 CEST | 50439 | 53 | 192.168.2.9 | 1.1.1.1 |
| Jul 30, 2024 00:49:15.096395016 CEST | 53 | 61666 | 1.1.1.1 | 192.168.2.9 |
| Jul 30, 2024 00:49:15.099297047 CEST | 53 | 57716 | 1.1.1.1 | 192.168.2.9 |
| Jul 30, 2024 00:49:15.111344099 CEST | 53 | 50439 | 1.1.1.1 | 192.168.2.9 |
| Jul 30, 2024 00:49:15.132184029 CEST | 53 | 65502 | 1.1.1.1 | 192.168.2.9 |
| Jul 30, 2024 00:49:16.174592972 CEST | 63209 | 53 | 192.168.2.9 | 1.1.1.1 |
| Jul 30, 2024 00:49:16.174592972 CEST | 63569 | 53 | 192.168.2.9 | 1.1.1.1 |
| Jul 30, 2024 00:49:16.175045013 CEST | 64684 | 53 | 192.168.2.9 | 1.1.1.1 |
| Jul 30, 2024 00:49:16.175419092 CEST | 55808 | 53 | 192.168.2.9 | 1.1.1.1 |
| Jul 30, 2024 00:49:16.414450884 CEST | 53 | 64684 | 1.1.1.1 | 192.168.2.9 |
| Jul 30, 2024 00:49:16.414562941 CEST | 53 | 55808 | 1.1.1.1 | 192.168.2.9 |
| Jul 30, 2024 00:49:16.414840937 CEST | 53 | 50826 | 1.1.1.1 | 192.168.2.9 |
| Jul 30, 2024 00:49:16.416661978 CEST | 53 | 63209 | 1.1.1.1 | 192.168.2.9 |
| Jul 30, 2024 00:49:16.417731047 CEST | 53 | 63569 | 1.1.1.1 | 192.168.2.9 |
| Jul 30, 2024 00:49:17.282303095 CEST | 63424 | 53 | 192.168.2.9 | 1.1.1.1 |
| Jul 30, 2024 00:49:17.282519102 CEST | 50950 | 53 | 192.168.2.9 | 1.1.1.1 |
| Jul 30, 2024 00:49:17.299848080 CEST | 53 | 63424 | 1.1.1.1 | 192.168.2.9 |
| Jul 30, 2024 00:49:17.299866915 CEST | 53 | 50950 | 1.1.1.1 | 192.168.2.9 |
| Jul 30, 2024 00:49:17.816975117 CEST | 62445 | 53 | 192.168.2.9 | 1.1.1.1 |
| Jul 30, 2024 00:49:17.834578037 CEST | 53 | 62445 | 1.1.1.1 | 192.168.2.9 |
| Jul 30, 2024 00:49:18.803457975 CEST | 54520 | 53 | 192.168.2.9 | 1.1.1.1 |
| Jul 30, 2024 00:49:18.803853035 CEST | 64177 | 53 | 192.168.2.9 | 1.1.1.1 |
| Jul 30, 2024 00:49:18.821640015 CEST | 53 | 54520 | 1.1.1.1 | 192.168.2.9 |
| Jul 30, 2024 00:49:18.822715998 CEST | 53 | 64177 | 1.1.1.1 | 192.168.2.9 |
| Jul 30, 2024 00:49:18.925489902 CEST | 65089 | 53 | 192.168.2.9 | 1.1.1.1 |
| Jul 30, 2024 00:49:18.925760984 CEST | 54565 | 53 | 192.168.2.9 | 1.1.1.1 |
| Jul 30, 2024 00:49:18.943311930 CEST | 53 | 54565 | 1.1.1.1 | 192.168.2.9 |
| Jul 30, 2024 00:49:18.943326950 CEST | 53 | 65089 | 1.1.1.1 | 192.168.2.9 |
| Jul 30, 2024 00:49:19.683522940 CEST | 62552 | 53 | 192.168.2.9 | 1.1.1.1 |
| Jul 30, 2024 00:49:19.683684111 CEST | 54561 | 53 | 192.168.2.9 | 1.1.1.1 |
| Jul 30, 2024 00:49:19.703157902 CEST | 53 | 62552 | 1.1.1.1 | 192.168.2.9 |
| Jul 30, 2024 00:49:19.705604076 CEST | 53 | 54561 | 1.1.1.1 | 192.168.2.9 |
| Jul 30, 2024 00:49:20.910059929 CEST | 53 | 59833 | 1.1.1.1 | 192.168.2.9 |
| Jul 30, 2024 00:49:33.314136028 CEST | 53 | 61092 | 1.1.1.1 | 192.168.2.9 |
| Jul 30, 2024 00:49:33.474468946 CEST | 53 | 57634 | 162.159.36.2 | 192.168.2.9 |
| Jul 30, 2024 00:49:33.966759920 CEST | 62906 | 53 | 192.168.2.9 | 1.1.1.1 |
| Jul 30, 2024 00:49:33.985019922 CEST | 53 | 62906 | 1.1.1.1 | 192.168.2.9 |
| Jul 30, 2024 00:49:37.762084007 CEST | 60927 | 53 | 192.168.2.9 | 1.1.1.1 |
| Jul 30, 2024 00:49:37.781248093 CEST | 53 | 60927 | 1.1.1.1 | 192.168.2.9 |
| Jul 30, 2024 00:49:54.351481915 CEST | 138 | 138 | 192.168.2.9 | 192.168.2.255 |
| Jul 30, 2024 00:50:18.988418102 CEST | 56168 | 53 | 192.168.2.9 | 1.1.1.1 |
| Jul 30, 2024 00:50:19.007097006 CEST | 53 | 56168 | 1.1.1.1 | 192.168.2.9 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Jul 30, 2024 00:49:01.688865900 CEST | 192.168.2.9 | 1.1.1.1 | 0x5955 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Jul 30, 2024 00:49:02.582036018 CEST | 192.168.2.9 | 1.1.1.1 | 0x5a56 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Jul 30, 2024 00:49:15.079936028 CEST | 192.168.2.9 | 1.1.1.1 | 0x17ab | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Jul 30, 2024 00:49:15.088238955 CEST | 192.168.2.9 | 1.1.1.1 | 0xf5df | Standard query (0) | 65 | IN (0x0001) | false | |
| Jul 30, 2024 00:49:16.174592972 CEST | 192.168.2.9 | 1.1.1.1 | 0xe2f2 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Jul 30, 2024 00:49:16.174592972 CEST | 192.168.2.9 | 1.1.1.1 | 0x6c13 | Standard query (0) | 65 | IN (0x0001) | false | |
| Jul 30, 2024 00:49:16.175045013 CEST | 192.168.2.9 | 1.1.1.1 | 0xcd73 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Jul 30, 2024 00:49:16.175419092 CEST | 192.168.2.9 | 1.1.1.1 | 0x8569 | Standard query (0) | 65 | IN (0x0001) | false | |
| Jul 30, 2024 00:49:17.282303095 CEST | 192.168.2.9 | 1.1.1.1 | 0xdd23 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Jul 30, 2024 00:49:17.282519102 CEST | 192.168.2.9 | 1.1.1.1 | 0xa311 | Standard query (0) | 65 | IN (0x0001) | false | |
| Jul 30, 2024 00:49:17.816975117 CEST | 192.168.2.9 | 1.1.1.1 | 0x3618 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Jul 30, 2024 00:49:18.803457975 CEST | 192.168.2.9 | 1.1.1.1 | 0x57ef | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Jul 30, 2024 00:49:18.803853035 CEST | 192.168.2.9 | 1.1.1.1 | 0xeccb | Standard query (0) | 65 | IN (0x0001) | false | |
| Jul 30, 2024 00:49:18.925489902 CEST | 192.168.2.9 | 1.1.1.1 | 0x2bc2 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Jul 30, 2024 00:49:18.925760984 CEST | 192.168.2.9 | 1.1.1.1 | 0x6d68 | Standard query (0) | 65 | IN (0x0001) | false | |
| Jul 30, 2024 00:49:19.683522940 CEST | 192.168.2.9 | 1.1.1.1 | 0x8fcf | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Jul 30, 2024 00:49:19.683684111 CEST | 192.168.2.9 | 1.1.1.1 | 0x81ef | Standard query (0) | 65 | IN (0x0001) | false | |
| Jul 30, 2024 00:49:33.966759920 CEST | 192.168.2.9 | 1.1.1.1 | 0xebeb | Standard query (0) | PTR (Pointer record) | IN (0x0001) | false | |
| Jul 30, 2024 00:49:37.762084007 CEST | 192.168.2.9 | 1.1.1.1 | 0x7859 | Standard query (0) | PTR (Pointer record) | IN (0x0001) | false | |
| Jul 30, 2024 00:50:18.988418102 CEST | 192.168.2.9 | 1.1.1.1 | 0x865b | Standard query (0) | A (IP address) | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Jul 30, 2024 00:49:01.706537962 CEST | 1.1.1.1 | 192.168.2.9 | 0x5955 | No error (0) | titanium.roblox.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Jul 30, 2024 00:49:01.706537962 CEST | 1.1.1.1 | 192.168.2.9 | 0x5955 | No error (0) | edge-term4.roblox.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Jul 30, 2024 00:49:01.706537962 CEST | 1.1.1.1 | 192.168.2.9 | 0x5955 | No error (0) | edge-term4-ams2.roblox.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Jul 30, 2024 00:49:01.706537962 CEST | 1.1.1.1 | 192.168.2.9 | 0x5955 | No error (0) | 128.116.21.4 | A (IP address) | IN (0x0001) | false | ||
| Jul 30, 2024 00:49:02.601408005 CEST | 1.1.1.1 | 192.168.2.9 | 0x5a56 | No error (0) | d2v57ias1m20gl.cloudfront.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Jul 30, 2024 00:49:02.601408005 CEST | 1.1.1.1 | 192.168.2.9 | 0x5a56 | No error (0) | 99.86.4.125 | A (IP address) | IN (0x0001) | false | ||
| Jul 30, 2024 00:49:02.601408005 CEST | 1.1.1.1 | 192.168.2.9 | 0x5a56 | No error (0) | 99.86.4.62 | A (IP address) | IN (0x0001) | false | ||
| Jul 30, 2024 00:49:02.601408005 CEST | 1.1.1.1 | 192.168.2.9 | 0x5a56 | No error (0) | 99.86.4.8 | A (IP address) | IN (0x0001) | false | ||
| Jul 30, 2024 00:49:02.601408005 CEST | 1.1.1.1 | 192.168.2.9 | 0x5a56 | No error (0) | 99.86.4.20 | A (IP address) | IN (0x0001) | false | ||
| Jul 30, 2024 00:49:15.099297047 CEST | 1.1.1.1 | 192.168.2.9 | 0x17ab | No error (0) | 172.67.149.76 | A (IP address) | IN (0x0001) | false | ||
| Jul 30, 2024 00:49:15.099297047 CEST | 1.1.1.1 | 192.168.2.9 | 0x17ab | No error (0) | 104.21.79.229 | A (IP address) | IN (0x0001) | false | ||
| Jul 30, 2024 00:49:15.111344099 CEST | 1.1.1.1 | 192.168.2.9 | 0xf5df | No error (0) | 65 | IN (0x0001) | false | |||
| Jul 30, 2024 00:49:16.414450884 CEST | 1.1.1.1 | 192.168.2.9 | 0xcd73 | No error (0) | 88.212.202.52 | A (IP address) | IN (0x0001) | false | ||
| Jul 30, 2024 00:49:16.414450884 CEST | 1.1.1.1 | 192.168.2.9 | 0xcd73 | No error (0) | 88.212.201.204 | A (IP address) | IN (0x0001) | false | ||
| Jul 30, 2024 00:49:16.414450884 CEST | 1.1.1.1 | 192.168.2.9 | 0xcd73 | No error (0) | 88.212.201.198 | A (IP address) | IN (0x0001) | false | ||
| Jul 30, 2024 00:49:16.416661978 CEST | 1.1.1.1 | 192.168.2.9 | 0xe2f2 | No error (0) | 104.21.4.208 | A (IP address) | IN (0x0001) | false | ||
| Jul 30, 2024 00:49:16.416661978 CEST | 1.1.1.1 | 192.168.2.9 | 0xe2f2 | No error (0) | 172.67.132.113 | A (IP address) | IN (0x0001) | false | ||
| Jul 30, 2024 00:49:16.417731047 CEST | 1.1.1.1 | 192.168.2.9 | 0x6c13 | No error (0) | 65 | IN (0x0001) | false | |||
| Jul 30, 2024 00:49:17.299848080 CEST | 1.1.1.1 | 192.168.2.9 | 0xdd23 | No error (0) | 35.190.80.1 | A (IP address) | IN (0x0001) | false | ||
| Jul 30, 2024 00:49:17.834578037 CEST | 1.1.1.1 | 192.168.2.9 | 0x3618 | No error (0) | titanium.roblox.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Jul 30, 2024 00:49:17.834578037 CEST | 1.1.1.1 | 192.168.2.9 | 0x3618 | No error (0) | edge-term4.roblox.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Jul 30, 2024 00:49:17.834578037 CEST | 1.1.1.1 | 192.168.2.9 | 0x3618 | No error (0) | edge-term4-ams2.roblox.com | CNAME (Canonical name) | IN (0x0001) | false | ||
| Jul 30, 2024 00:49:17.834578037 CEST | 1.1.1.1 | 192.168.2.9 | 0x3618 | No error (0) | 128.116.21.4 | A (IP address) | IN (0x0001) | false | ||
| Jul 30, 2024 00:49:18.821640015 CEST | 1.1.1.1 | 192.168.2.9 | 0x57ef | No error (0) | 88.212.201.204 | A (IP address) | IN (0x0001) | false | ||
| Jul 30, 2024 00:49:18.821640015 CEST | 1.1.1.1 | 192.168.2.9 | 0x57ef | No error (0) | 88.212.201.198 | A (IP address) | IN (0x0001) | false | ||
| Jul 30, 2024 00:49:18.821640015 CEST | 1.1.1.1 | 192.168.2.9 | 0x57ef | No error (0) | 88.212.202.52 | A (IP address) | IN (0x0001) | false | ||
| Jul 30, 2024 00:49:18.943311930 CEST | 1.1.1.1 | 192.168.2.9 | 0x6d68 | No error (0) | 65 | IN (0x0001) | false | |||
| Jul 30, 2024 00:49:18.943326950 CEST | 1.1.1.1 | 192.168.2.9 | 0x2bc2 | No error (0) | 142.250.184.228 | A (IP address) | IN (0x0001) | false | ||
| Jul 30, 2024 00:49:19.703157902 CEST | 1.1.1.1 | 192.168.2.9 | 0x8fcf | No error (0) | 104.21.4.208 | A (IP address) | IN (0x0001) | false | ||
| Jul 30, 2024 00:49:19.703157902 CEST | 1.1.1.1 | 192.168.2.9 | 0x8fcf | No error (0) | 172.67.132.113 | A (IP address) | IN (0x0001) | false | ||
| Jul 30, 2024 00:49:19.705604076 CEST | 1.1.1.1 | 192.168.2.9 | 0x81ef | No error (0) | 65 | IN (0x0001) | false | |||
| Jul 30, 2024 00:49:33.985019922 CEST | 1.1.1.1 | 192.168.2.9 | 0xebeb | Name error (3) | none | none | PTR (Pointer record) | IN (0x0001) | false | |
| Jul 30, 2024 00:49:37.781248093 CEST | 1.1.1.1 | 192.168.2.9 | 0x7859 | Name error (3) | none | none | PTR (Pointer record) | IN (0x0001) | false | |
| Jul 30, 2024 00:50:19.007097006 CEST | 1.1.1.1 | 192.168.2.9 | 0x865b | No error (0) | 142.250.181.228 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.9 | 49722 | 172.67.149.76 | 443 | 5364 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-07-29 22:49:15 UTC | 655 | OUT | |
| 2024-07-29 22:49:16 UTC | 1089 | IN | |
| 2024-07-29 22:49:16 UTC | 280 | IN | |
| 2024-07-29 22:49:16 UTC | 1369 | IN | |
| 2024-07-29 22:49:16 UTC | 1369 | IN | |
| 2024-07-29 22:49:16 UTC | 1369 | IN | |
| 2024-07-29 22:49:16 UTC | 1369 | IN | |
| 2024-07-29 22:49:16 UTC | 1369 | IN | |
| 2024-07-29 22:49:16 UTC | 1369 | IN | |
| 2024-07-29 22:49:16 UTC | 1369 | IN | |
| 2024-07-29 22:49:16 UTC | 54 | IN | |
| 2024-07-29 22:49:16 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.9 | 49731 | 104.21.4.208 | 443 | 5364 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-07-29 22:49:17 UTC | 588 | OUT | |
| 2024-07-29 22:49:17 UTC | 1285 | IN | |
| 2024-07-29 22:49:17 UTC | 699 | IN | |
| 2024-07-29 22:49:17 UTC | 1369 | IN | |
| 2024-07-29 22:49:17 UTC | 1369 | IN | |
| 2024-07-29 22:49:17 UTC | 1369 | IN | |
| 2024-07-29 22:49:17 UTC | 1369 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 2 | 192.168.2.9 | 49730 | 88.212.202.52 | 443 | 5364 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-07-29 22:49:17 UTC | 665 | OUT | |
| 2024-07-29 22:49:17 UTC | 602 | IN | |
| 2024-07-29 22:49:17 UTC | 32 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 3 | 192.168.2.9 | 49733 | 35.190.80.1 | 443 | 5364 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-07-29 22:49:17 UTC | 543 | OUT | |
| 2024-07-29 22:49:17 UTC | 336 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 4 | 192.168.2.9 | 49732 | 20.114.59.183 | 443 |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-07-29 22:49:18 UTC | 306 | OUT | |
| 2024-07-29 22:49:18 UTC | 560 | IN | |
| 2024-07-29 22:49:18 UTC | 15824 | IN | |
| 2024-07-29 22:49:18 UTC | 8666 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 5 | 192.168.2.9 | 49736 | 88.212.202.52 | 443 | 5364 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-07-29 22:49:18 UTC | 706 | OUT | |
| 2024-07-29 22:49:18 UTC | 481 | IN | |
| 2024-07-29 22:49:18 UTC | 445 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 6 | 192.168.2.9 | 49740 | 35.190.80.1 | 443 | 5364 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-07-29 22:49:18 UTC | 484 | OUT | |
| 2024-07-29 22:49:18 UTC | 423 | OUT | |
| 2024-07-29 22:49:18 UTC | 168 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port |
|---|---|---|---|---|
| 7 | 192.168.2.9 | 49741 | 23.206.229.209 | 443 |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-07-29 22:49:18 UTC | 2223 | OUT | |
| 2024-07-29 22:49:18 UTC | 1 | OUT | |
| 2024-07-29 22:49:18 UTC | 515 | OUT | |
| 2024-07-29 22:49:19 UTC | 480 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 8 | 192.168.2.9 | 49742 | 104.21.4.208 | 443 | 5364 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-07-29 22:49:19 UTC | 577 | OUT | |
| 2024-07-29 22:49:19 UTC | 755 | IN | |
| 2024-07-29 22:49:19 UTC | 614 | IN | |
| 2024-07-29 22:49:19 UTC | 1369 | IN | |
| 2024-07-29 22:49:19 UTC | 850 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 9 | 192.168.2.9 | 49743 | 88.212.201.204 | 443 | 5364 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-07-29 22:49:20 UTC | 510 | OUT | |
| 2024-07-29 22:49:20 UTC | 459 | IN | |
| 2024-07-29 22:49:20 UTC | 445 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 10 | 192.168.2.9 | 49746 | 104.21.4.208 | 443 | 5364 | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-07-29 22:49:20 UTC | 351 | OUT | |
| 2024-07-29 22:49:20 UTC | 753 | IN | |
| 2024-07-29 22:49:20 UTC | 616 | IN | |
| 2024-07-29 22:49:20 UTC | 1369 | IN | |
| 2024-07-29 22:49:20 UTC | 848 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 11 | 192.168.2.9 | 49745 | 184.28.90.27 | 443 |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-07-29 22:49:20 UTC | 161 | OUT | |
| 2024-07-29 22:49:20 UTC | 467 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 12 | 192.168.2.9 | 49747 | 184.28.90.27 | 443 |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-07-29 22:49:21 UTC | 239 | OUT | |
| 2024-07-29 22:49:21 UTC | 515 | IN | |
| 2024-07-29 22:49:21 UTC | 55 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 13 | 192.168.2.9 | 61119 | 20.3.187.198 | 443 |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-07-29 22:49:34 UTC | 142 | OUT | |
| 2024-07-29 22:49:35 UTC | 234 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 14 | 192.168.2.9 | 61121 | 52.165.165.26 | 443 |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-07-29 22:49:38 UTC | 124 | OUT | |
| 2024-07-29 22:49:38 UTC | 318 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 15 | 192.168.2.9 | 61122 | 40.127.169.103 | 443 |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-07-29 22:49:40 UTC | 306 | OUT | |
| 2024-07-29 22:49:41 UTC | 560 | IN | |
| 2024-07-29 22:49:41 UTC | 15824 | IN | |
| 2024-07-29 22:49:41 UTC | 8666 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 16 | 192.168.2.9 | 61123 | 40.127.169.103 | 443 |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-07-29 22:49:42 UTC | 306 | OUT | |
| 2024-07-29 22:49:42 UTC | 560 | IN | |
| 2024-07-29 22:49:42 UTC | 15824 | IN | |
| 2024-07-29 22:49:42 UTC | 14181 | IN |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
| Target ID: | 0 |
| Start time: | 18:48:58 |
| Start date: | 29/07/2024 |
| Path: | C:\Users\user\Desktop\cheat_roblox.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff6e7e10000 |
| File size: | 2'675'335 bytes |
| MD5 hash: | D49B1A211CE49BED3E766471501819C6 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Reputation: | low |
| Has exited: | true |
| Target ID: | 2 |
| Start time: | 18:48:59 |
| Start date: | 29/07/2024 |
| Path: | C:\Windows\System32\cmd.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff7c8fd0000 |
| File size: | 289'792 bytes |
| MD5 hash: | 8A2122E8162DBEF04694B9C3E0B6CDEE |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 3 |
| Start time: | 18:48:59 |
| Start date: | 29/07/2024 |
| Path: | C:\Windows\System32\conhost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff70f010000 |
| File size: | 862'208 bytes |
| MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 4 |
| Start time: | 18:48:59 |
| Start date: | 29/07/2024 |
| Path: | C:\Users\user\AppData\Local\Temp\RobloxPlayerInstaller.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0xdf0000 |
| File size: | 5'720'984 bytes |
| MD5 hash: | 27469372591B14FF1C57654FACB5E020 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Antivirus matches: |
|
| Reputation: | low |
| Has exited: | true |
| Target ID: | 5 |
| Start time: | 18:49:09 |
| Start date: | 29/07/2024 |
| Path: | C:\Windows\System32\cmd.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff7c8fd0000 |
| File size: | 289'792 bytes |
| MD5 hash: | 8A2122E8162DBEF04694B9C3E0B6CDEE |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | false |
| Target ID: | 6 |
| Start time: | 18:49:09 |
| Start date: | 29/07/2024 |
| Path: | C:\Windows\System32\conhost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff70f010000 |
| File size: | 862'208 bytes |
| MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | false |
| Target ID: | 8 |
| Start time: | 18:49:10 |
| Start date: | 29/07/2024 |
| Path: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff6b2cb0000 |
| File size: | 3'242'272 bytes |
| MD5 hash: | 5BBFA6CBDF4C254EB368D534F9E23C92 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | false |
| Target ID: | 10 |
| Start time: | 18:49:12 |
| Start date: | 29/07/2024 |
| Path: | C:\Program Files\Google\Chrome\Application\chrome.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff6b2cb0000 |
| File size: | 3'242'272 bytes |
| MD5 hash: | 5BBFA6CBDF4C254EB368D534F9E23C92 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | false |
Execution Graph
| Execution Coverage: | 12.1% |
| Dynamic/Decrypted Code Coverage: | 0% |
| Signature Coverage: | 27% |
| Total number of Nodes: | 2000 |
| Total number of Limit Nodes: | 23 |
Graph
Function 00007FF6E7E3B190 Relevance: 123.9, APIs: 60, Strings: 10, Instructions: 1421windowfilesleepCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E3CE88 Relevance: 65.0, APIs: 26, Strings: 10, Instructions: 1963fileCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E40754 Relevance: 45.9, APIs: 21, Strings: 5, Instructions: 380filesleeptimeCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E2A4AC Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 250COMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E38624 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 101memorywindowCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E1F930 Relevance: 17.2, APIs: 8, Strings: 1, Instructions: 1417COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E14840 Relevance: 12.1, APIs: 5, Strings: 1, Instructions: 1624COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E15E24 Relevance: 7.6, APIs: 3, Strings: 1, Instructions: 586COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E31F20 Relevance: .3, Instructions: 337COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E33484 Relevance: .3, Instructions: 302COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E24928 Relevance: .1, Instructions: 136COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E2DFD0 Relevance: 143.9, APIs: 16, Strings: 66, Instructions: 440libraryfileloaderCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E298DC Relevance: 25.2, APIs: 3, Strings: 11, Instructions: 702COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E41900 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 195libraryCOMMONLIBRARYCODE
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E3F4E0 Relevance: 17.8, APIs: 6, Strings: 4, Instructions: 285COMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E224C0 Relevance: 9.2, APIs: 6, Instructions: 164filetimeCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E3FD0C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 76COMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E3B014 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54windowCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E391E8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33COMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E2EAA4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42threadCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E3946C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26comCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E4D90C Relevance: 3.0, APIs: 2, Instructions: 19threadCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E41558 Relevance: 1.5, APIs: 1, Instructions: 38COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E4FA04 Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E4D94C Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E27FC4 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E1C2F0 Relevance: 49.8, APIs: 24, Strings: 4, Instructions: 754fileCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E2F180 Relevance: 43.2, APIs: 22, Strings: 2, Instructions: 1205COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E52550 Relevance: 22.3, APIs: 8, Strings: 4, Instructions: 1310COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E21A48 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 375fileCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E476D8 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E4FA94 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 164COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E52080 Relevance: 4.8, APIs: 3, Instructions: 340COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E4FCA0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 97COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E55AF8 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E48C1C Relevance: 1.5, Strings: 1, Instructions: 219COMMONLIBRARYCODE
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E489A0 Relevance: 1.4, Strings: 1, Instructions: 199COMMONLIBRARYCODE
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E33964 Relevance: .9, Instructions: 931COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E176C0 Relevance: .9, Instructions: 893COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E353F0 Relevance: .9, Instructions: 891COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E2BB90 Relevance: .6, Instructions: 587COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E34B98 Relevance: .6, Instructions: 578COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E17288 Relevance: .3, Instructions: 294COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E32D58 Relevance: .3, Instructions: 268COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E2AF18 Relevance: .2, Instructions: 244COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E1A310 Relevance: .2, Instructions: 230COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E2B534 Relevance: .2, Instructions: 181COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E321D0 Relevance: .1, Instructions: 137COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E32AB0 Relevance: .1, Instructions: 112COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E558E0 Relevance: .0, Instructions: 32COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E43354 Relevance: .0, Instructions: 2COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E1D7D0 Relevance: 26.3, APIs: 1, Strings: 14, Instructions: 98COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E42A10 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 61libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E26A0C Relevance: 16.2, APIs: 6, Strings: 3, Instructions: 444COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E3A440 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 257COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E4E650 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 117COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E3F390 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E36E80 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 204memoryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E3AE90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E2B9B4 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 84libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E387D8 Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 415COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E457EC Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 317COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E24F38 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 158COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E472EC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E41604 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 43libraryloaderCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E27918 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 233COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E45CE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 191COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E44F80 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E1CEE0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 139COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E37B28 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 122COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E3FED4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 52COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E4BFB0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E23AF8 Relevance: 7.7, APIs: 5, Instructions: 164filetimeCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E4F414 Relevance: 7.6, APIs: 5, Instructions: 114libraryloaderCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E556D8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E3FE24 Relevance: 7.5, APIs: 5, Instructions: 29windowsynchronizationCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E4625C Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E480F4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E51758 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E466A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 117COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E54360 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100fileCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E390B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E2E870 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E385E0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 19COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E4DB5C Relevance: 6.1, APIs: 4, Instructions: 104COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E4D440 Relevance: 6.0, APIs: 4, Instructions: 43COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E1E34C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 176COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E4E1F4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E29408 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 108COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E4C2C0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E39B40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E29638 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E4EB04 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E44078 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E2EA5C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16synchronizationCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF6E7E2A43C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Execution Graph
| Execution Coverage: | 21% |
| Dynamic/Decrypted Code Coverage: | 0% |
| Signature Coverage: | 2.1% |
| Total number of Nodes: | 485 |
| Total number of Limit Nodes: | 8 |
Graph
Callgraph
Function 0110D0F8 Relevance: .0, Instructions: 29COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0110C9FF Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 010F443F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38threadCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 010F44F4 Relevance: 4.5, APIs: 3, Instructions: 30threadCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0110437B Relevance: 4.5, APIs: 3, Instructions: 15COMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0110A4B0 Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE
Download Yara Rule
Control-flow Graph
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0110A1C5 Relevance: 2.6, APIs: 2, Instructions: 125COMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0110B99B Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0110A4EA Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 01107A3B Relevance: 1.5, APIs: 1, Instructions: 20COMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0110D13C Relevance: .0, Instructions: 22COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 011043AC Relevance: .0, Instructions: 12COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 011043CE Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 42libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|