Edit tour
Windows
Analysis Report
SecuriteInfo.com.Heur.Mint.Phil.57.5869.22404.exe
Overview
General Information
| Sample name: | SecuriteInfo.com.Heur.Mint.Phil.57.5869.22404.exe |
| Analysis ID: | 1489770 |
| MD5: | ff0badeb5d6675c36d8f9068a1232258 |
| SHA1: | 7d287ad2bcdce85532dea445371a2d3c8295e516 |
| SHA256: | 5b64cb5b788ccdd6006a7edefe6dcd1d36c9bf09101b53398e6a5938a1cc29c8 |
| Tags: | exe |
| Infos: |   |
 | |
Detection
XWorm
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Early bird code injection technique detected
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected XWorm
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
AI detected suspicious sample
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Contains functionality to inject threads in other processes
Creates a thread in another existing process (thread injection)
Found API chain indicative of debugger detection
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Queues an APC in another process (thread injection)
Sample uses string decryption to hide its real strings
Writes to foreign memory regions
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality to query CPU information (cpuid)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains sections with non-standard names
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: CurrentVersion Autorun Keys Modification
Uses code obfuscation techniques (call, push, ret)
Yara signature match
Classification
- System is w10x64
SecuriteInfo.com.Heur.Mint.Phil.57.5869.22404.exe (PID: 6872 cmdline: "C:\Users\ user\Deskt op\Securit eInfo.com. Heur.Mint. Phil.57.58 69.22404.e xe" MD5: FF0BADEB5D6675C36D8F9068A1232258) 
conhost.exe (PID: 6912 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
msinfo32.exe (PID: 7012 cmdline: "C:\Progra m Files\Co mmon Files \microsoft shared\MS Info\msinf o32.exe" MD5: 0AED91DA63713BF9F881B03A604A1C9D)
- FRpl.exe (PID: 6544 cmdline:
"C:\Users\ user\AppDa ta\Roaming \qNl6oqz9\ FRpl.exe" MD5: FF0BADEB5D6675C36D8F9068A1232258) - conhost.exe (PID: 6932 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - msinfo32.exe (PID: 6888 cmdline:
"C:\Progra m Files\Co mmon Files \microsoft shared\MS Info\msinf o32.exe" MD5: 0AED91DA63713BF9F881B03A604A1C9D)
- FRpl.exe (PID: 2284 cmdline:
"C:\Users\ user\AppDa ta\Roaming \qNl6oqz9\ FRpl.exe" MD5: FF0BADEB5D6675C36D8F9068A1232258) - conhost.exe (PID: 6092 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - msinfo32.exe (PID: 908 cmdline:
"C:\Progra m Files\Co mmon Files \microsoft shared\MS Info\msinf o32.exe" MD5: 0AED91DA63713BF9F881B03A604A1C9D)
- cleanup
| Name | Description | Attribution | Blogpost URLs | Link |
|---|---|---|---|---|
| XWorm | Malware with wide range of capabilities ranging from RAT to ransomware. | No Attribution |
{"C2 url": ["cameras-commitment.gl.at.ply.gg"], "Port": "20343", "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.6"}| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| Windows_Trojan_Donutloader_f40e3759 | unknown | unknown |
| |
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| MALWARE_Win_AsyncRAT | Detects AsyncRAT | ditekSHen |
| |
| Windows_Trojan_Donutloader_f40e3759 | unknown | unknown |
| |
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| Click to see the 18 entries | ||||
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| MALWARE_Win_AsyncRAT | Detects AsyncRAT | ditekSHen |
| |
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| MALWARE_Win_AsyncRAT | Detects AsyncRAT | ditekSHen |
| |
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| Click to see the 15 entries | ||||
System Summary |   |
|---|
| Source: | Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): | ||
| Timestamp: | 2024-08-08T02:38:40.864390+0200 |
| SID: | 2853193 |
| Severity: | 1 |
| Source Port: | 49746 |
| Destination Port: | 20343 |
| Protocol: | TCP |
| Classtype: | Malware Command and Control Activity Detected |
| Timestamp: | 2024-08-08T02:36:24.326130+0200 |
| SID: | 2803274 |
| Severity: | 2 |
| Source Port: | 49739 |
| Destination Port: | 443 |
| Protocol: | TCP |
| Classtype: | Potentially Bad Traffic |
| Timestamp: | 2024-08-08T02:36:16.355177+0200 |
| SID: | 2803274 |
| Severity: | 2 |
| Source Port: | 49732 |
| Destination Port: | 443 |
| Protocol: | TCP |
| Classtype: | Potentially Bad Traffic |
| Timestamp: | 2024-08-08T02:36:44.411331+0200 |
| SID: | 2855924 |
| Severity: | 1 |
| Source Port: | 49740 |
| Destination Port: | 20343 |
| Protocol: | TCP |
| Classtype: | Malware Command and Control Activity Detected |
| Timestamp: | 2024-08-08T02:36:01.741479+0200 |
| SID: | 2803274 |
| Severity: | 2 |
| Source Port: | 49730 |
| Destination Port: | 443 |
| Protocol: | TCP |
| Classtype: | Potentially Bad Traffic |
| Timestamp: | 2024-08-08T02:36:26.755485+0200 |
| SID: | 2855924 |
| Severity: | 1 |
| Source Port: | 49731 |
| Destination Port: | 20343 |
| Protocol: | TCP |
| Classtype: | Malware Command and Control Activity Detected |
Click to jump to signature section
Show All Signature Results
AV Detection | |
|---|
| Source: | Malware Configuration Extractor: | ||
| Source: | Virustotal: | Perma Link | ||
| Source: | Virustotal: | Perma Link | ||
| Source: | Integrated Neural Analysis Model: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Static PE information: | ||
Networking | |
|---|
| Source: | URLs: | ||
| Source: | TCP traffic: | ||
| Source: | IP Address: | ||
| Source: | ASN Name: | ||
| Source: | JA3 fingerprint: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | Code function: | 0_2_00294AA1 | |
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
System Summary | |
|---|
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Code function: | 0_2_00294AA1 | |
| Source: | Code function: | 0_2_002AB6F0 | |
| Source: | Code function: | 0_2_0029E00C | |
| Source: | Code function: | 0_2_0029D060 | |
| Source: | Code function: | 0_2_002BC860 | |
| Source: | Code function: | 0_2_002CA040 | |
| Source: | Code function: | 0_2_002C78A0 | |
| Source: | Code function: | 0_2_002C3880 | |
| Source: | Code function: | 0_2_002CD8D0 | |
| Source: | Code function: | 0_2_002B5120 | |
| Source: | Code function: | 0_2_0029E90D | |
| Source: | Code function: | 0_2_002B915F | |
| Source: | Code function: | 0_2_0029C150 | |
| Source: | Code function: | 0_2_002AE9E0 | |
| Source: | Code function: | 0_2_002C59E0 | |
| Source: | Code function: | 0_2_002921C7 | |
| Source: | Code function: | 0_2_002C71D0 | |
| Source: | Code function: | 0_2_002BAA2F | |
| Source: | Code function: | 0_2_002CB230 | |
| Source: | Code function: | 0_2_00292AB9 | |
| Source: | Code function: | 0_2_002A4A80 | |
| Source: | Code function: | 0_2_0029E2E4 | |
| Source: | Code function: | 0_2_002BA2C0 | |
| Source: | Code function: | 0_2_002B02C0 | |
| Source: | Code function: | 0_2_00299B20 | |
| Source: | Code function: | 0_2_002AF320 | |
| Source: | Code function: | 0_2_002B4B20 | |
| Source: | Code function: | 0_2_002A7330 | |
| Source: | Code function: | 0_2_002C5310 | |
| Source: | Code function: | 0_2_002A1B61 | |
| Source: | Code function: | 0_2_00293B76 | |
| Source: | Code function: | 0_2_002A2BFB | |
| Source: | Code function: | 0_2_002C2BC0 | |
| Source: | Code function: | 0_2_002D0410 | |
| Source: | Code function: | 0_2_002AD4B0 | |
| Source: | Code function: | 0_2_002C2480 | |
| Source: | Code function: | 0_2_002CF500 | |
| Source: | Code function: | 0_2_0029E574 | |
| Source: | Code function: | 0_2_002BDDB0 | |
| Source: | Code function: | 0_2_002C1E10 | |
| Source: | Code function: | 0_2_002B9E60 | |
| Source: | Code function: | 0_2_002C06A0 | |
| Source: | Code function: | 0_2_0029E6CC | |
| Source: | Code function: | 0_2_002C3F60 | |
| Source: | Code function: | 0_2_0029E77F | |
| Source: | Code function: | 0_2_002A9790 | |
| Source: | Code function: | 0_2_002CA790 | |
| Source: | Code function: | 2_2_000001AA11021578 | |
| Source: | Code function: | 2_2_000001AA1102119C | |
| Source: | Code function: | 2_2_000001AA110219A8 | |
| Source: | Code function: | 2_2_000001AA110202C0 | |
| Source: | Code function: | 2_2_000001AA11024C54 | |
| Source: | Code function: | 2_2_000001AA1102245C | |
| Source: | Code function: | 2_2_00007FFD9B890EFA | |
| Source: | Code function: | 2_2_00007FFD9B895CE6 | |
| Source: | Code function: | 2_2_00007FFD9B896A92 | |
| Source: | Code function: | 3_2_00B64AA1 | |
| Source: | Code function: | 3_2_00B7B6F0 | |
| Source: | Code function: | 3_2_00B978A0 | |
| Source: | Code function: | 3_2_00B93880 | |
| Source: | Code function: | 3_2_00B9D8D0 | |
| Source: | Code function: | 3_2_00B6E00C | |
| Source: | Code function: | 3_2_00B6D060 | |
| Source: | Code function: | 3_2_00B8C860 | |
| Source: | Code function: | 3_2_00B9A040 | |
| Source: | Code function: | 3_2_00B7E9E0 | |
| Source: | Code function: | 3_2_00B959E0 | |
| Source: | Code function: | 3_2_00B971D0 | |
| Source: | Code function: | 3_2_00B621C7 | |
| Source: | Code function: | 3_2_00B85120 | |
| Source: | Code function: | 3_2_00B6E90D | |
| Source: | Code function: | 3_2_00B6C150 | |
| Source: | Code function: | 3_2_00B8915F | |
| Source: | Code function: | 3_2_00B62AB9 | |
| Source: | Code function: | 3_2_00B74A80 | |
| Source: | Code function: | 3_2_00B6E2E4 | |
| Source: | Code function: | 3_2_00B8A2C0 | |
| Source: | Code function: | 3_2_00B802C0 | |
| Source: | Code function: | 3_2_00B9B230 | |
| Source: | Code function: | 3_2_00B8AA2F | |
| Source: | Code function: | 3_2_00B72BFB | |
| Source: | Code function: | 3_2_00B92BC0 | |
| Source: | Code function: | 3_2_00B77330 | |
| Source: | Code function: | 3_2_00B69B20 | |
| Source: | Code function: | 3_2_00B7F320 | |
| Source: | Code function: | 3_2_00B84B20 | |
| Source: | Code function: | 3_2_00B95310 | |
| Source: | Code function: | 3_2_00B63B76 | |
| Source: | Code function: | 3_2_00B71B61 | |
| Source: | Code function: | 3_2_00B7D4B0 | |
| Source: | Code function: | 3_2_00B92480 | |
| Source: | Code function: | 3_2_00BA0410 | |
| Source: | Code function: | 3_2_00B8DDB0 | |
| Source: | Code function: | 3_2_00B9F500 | |
| Source: | Code function: | 3_2_00B6E574 | |
| Source: | Code function: | 3_2_00B906A0 | |
| Source: | Code function: | 3_2_00B6E6CC | |
| Source: | Code function: | 3_2_00B91E10 | |
| Source: | Code function: | 3_2_00B89E60 | |
| Source: | Code function: | 3_2_00B79790 | |
| Source: | Code function: | 3_2_00B9A790 | |
| Source: | Code function: | 3_2_00B6E77F | |
| Source: | Code function: | 3_2_00B93F60 | |
| Source: | Code function: | 5_2_00000204FD67119C | |
| Source: | Code function: | 5_2_00000204FD671578 | |
| Source: | Code function: | 5_2_00000204FD6719A8 | |
| Source: | Code function: | 5_2_00000204FD6702C0 | |
| Source: | Code function: | 5_2_00000204FD674C54 | |
| Source: | Code function: | 5_2_00000204FD67245C | |
| Source: | Code function: | 11_2_0000027ADED7119C | |
| Source: | Code function: | 11_2_0000027ADED71578 | |
| Source: | Code function: | 11_2_0000027ADED702C0 | |
| Source: | Code function: | 11_2_0000027ADED719A8 | |
| Source: | Code function: | 11_2_0000027ADED74C54 | |
| Source: | Code function: | 11_2_0000027ADED7245C | |
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Base64 encoded string: | ||
| Source: | Base64 encoded string: | ||
| Source: | Base64 encoded string: | ||
| Source: | Base64 encoded string: | ||
| Source: | Base64 encoded string: | ||
| Source: | Base64 encoded string: | ||
| Source: | Base64 encoded string: | ||
| Source: | Base64 encoded string: | ||
| Source: | Base64 encoded string: | ||
| Source: | Base64 encoded string: | ||
| Source: | Base64 encoded string: | ||
| Source: | Base64 encoded string: | ||
| Source: | Base64 encoded string: | ||
| Source: | Base64 encoded string: | ||
| Source: | Base64 encoded string: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Classification label: | ||
| Source: | Code function: | 0_2_002AD4B0 | |
| Source: | Code function: | 0_2_002CF500 | |
| Source: | File created: | Jump to behavior | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | Static PE information: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Virustotal: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Key value queried: | Jump to behavior | ||
| Source: | Window detected: | ||
| Source: | Static PE information: | ||
Data Obfuscation | |
|---|
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Code function: | 0_2_002E7B75 | |
| Source: | Code function: | 0_2_00292CE8 | |
| Source: | Code function: | 3_2_00BB7B75 | |
| Source: | Code function: | 3_2_00B62CE8 | |
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | Registry value created or modified: | Jump to behavior | ||
| Source: | Registry value created or modified: | Jump to behavior | ||
| Source: | Registry value created or modified: | Jump to behavior | ||
| Source: | Registry value created or modified: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
Malware Analysis System Evasion | |
|---|
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | API coverage: | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Last function: | ||
| Source: | Last function: | ||
| Source: | Last function: | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
Anti Debugging | |
|---|
| Source: | Debugger detection routine: | graph_3-35241 | ||
| Source: | Debugger detection routine: | graph_0-35171 | ||
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Code function: | 0_2_00298820 | |
| Source: | Code function: | 0_2_00291180 | |
| Source: | Code function: | 0_2_002EA560 | |
| Source: | Code function: | 0_2_002D2E10 | |
| Source: | Code function: | 3_2_00B68820 | |
| Source: | Code function: | 3_2_00B61180 | |
| Source: | Code function: | 3_2_00BBA560 | |
| Source: | Code function: | 3_2_00BA2E10 | |
| Source: | Memory allocated: | Jump to behavior | ||
HIPS / PFW / Operating System Protection Evasion | |
|---|
| Source: | Process created / APC Queued / Resumed: | Jump to behavior | ||
| Source: | Process created / APC Queued / Resumed: | Jump to behavior | ||
| Source: | Process created / APC Queued / Resumed: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Code function: | 0_2_00294AA1 | |
| Source: | Code function: | 0_2_00294AA1 | |
| Source: | Code function: | 3_2_00B64AA1 | |
| Source: | Thread created: | Jump to behavior | ||
| Source: | Thread created: | Jump to behavior | ||
| Source: | Thread created: | Jump to behavior | ||
| Source: | Thread APC queued: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Code function: | 0_2_002D45F0 | |
| Source: | Code function: | 0_2_002D2D30 | |
| Source: | Key value queried: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
Stealing of Sensitive Information | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
Remote Access Functionality | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | 11 Windows Management Instrumentation | 1 Registry Run Keys / Startup Folder | 712 Process Injection | 1 Masquerading | OS Credential Dumping | 1 System Time Discovery | Remote Services | 11 Archive Collected Data | 11 Encrypted Channel | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
| Credentials | Domains | Default Accounts | Scheduled Task/Job | 1 DLL Side-Loading | 1 Registry Run Keys / Startup Folder | 1 Disable or Modify Tools | LSASS Memory | 321 Security Software Discovery | Remote Desktop Protocol | Data from Removable Media | 1 Non-Standard Port | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | 1 DLL Side-Loading | 231 Virtualization/Sandbox Evasion | Security Account Manager | 231 Virtualization/Sandbox Evasion | SMB/Windows Admin Shares | Data from Network Shared Drive | 2 Ingress Tool Transfer | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | 712 Process Injection | NTDS | 2 Process Discovery | Distributed Component Object Model | Input Capture | 2 Non-Application Layer Protocol | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | Network Logon Script | 11 Deobfuscate/Decode Files or Information | LSA Secrets | 1 Application Window Discovery | SSH | Keylogging | 13 Application Layer Protocol | Scheduled Transfer | Data Encrypted for Impact |
| Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | 21 Obfuscated Files or Information | Cached Domain Credentials | 14 System Information Discovery | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
| DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | 2 Software Packing | DCSync | Remote System Discovery | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
| Network Trust Dependencies | Serverless | Drive-by Compromise | Container Orchestration Job | Scheduled Task/Job | Scheduled Task/Job | 1 DLL Side-Loading | Proc Filesystem | System Owner/User Discovery | Cloud Services | Credential API Hooking | Application Layer Protocol | Exfiltration Over Alternative Protocol | Defacement |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 25% | Virustotal | Browse |
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 25% | Virustotal | Browse |
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | Virustotal | Browse |
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | URL Reputation | safe | ||
| 0% | Virustotal | Browse | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Virustotal | Browse | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| cameras-commitment.gl.at.ply.gg | 147.185.221.16 | true | true | unknown | |
| paste.fo | 104.21.28.76 | true | false |
| unknown |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| true |
| unknown | |
| false |
| unknown |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 147.185.221.16 | cameras-commitment.gl.at.ply.gg | United States | 12087 | SALSGIVERUS | true | |
| 104.21.28.76 | paste.fo | United States | 13335 | CLOUDFLARENETUS | false |
| Joe Sandbox version: | 40.0.0 Tourmaline |
| Analysis ID: | 1489770 |
| Start date and time: | 2024-08-08 02:35:05 +02:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 9m 29s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 13 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | SecuriteInfo.com.Heur.Mint.Phil.57.5869.22404.exe |
| Detection: | MAL |
| Classification: | mal100.troj.evad.winEXE@12/3@2/2 |
| EGA Information: |
|
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
- Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
- Not all processes where analyzed, report is missing behavior information
- Report size exceeded maximum capacity and may have missing behavior information.
- Report size getting too big, too many NtOpenKeyEx calls found.
- Report size getting too big, too many NtProtectVirtualMemory calls found.
- Report size getting too big, too many NtQueryValueKey calls found.
- Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
| Time | Type | Description |
|---|---|---|
| 01:36:05 | Autostart | |
| 01:36:14 | Autostart | |
| 20:36:04 | API Interceptor |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 147.185.221.16 | Get hash | malicious | RedLine | Browse |
| |
| Get hash | malicious | RedLine | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| paste.fo | Get hash | malicious | Redline Clipper | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| SALSGIVERUS | Get hash | malicious | Mirai | Browse |
| |
| Get hash | malicious | DCRat, XWorm | Browse |
| ||
| Get hash | malicious | XWorm | Browse |
| ||
| Get hash | malicious | XWorm | Browse |
| ||
| Get hash | malicious | AsyncRAT, VenomRAT | Browse |
| ||
| Get hash | malicious | XWorm | Browse |
| ||
| Get hash | malicious | AsyncRAT, XWorm | Browse |
| ||
| Get hash | malicious | XWorm | Browse |
| ||
| Get hash | malicious | Blank Grabber, DCRat, XWorm | Browse |
| ||
| Get hash | malicious | XWorm | Browse |
| ||
| CLOUDFLARENETUS | Get hash | malicious | Phisher | Browse |
| |
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Outlook Phishing, HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 37f463bf4616ecd445d4a1937da06e19 | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | GuLoader | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Go Injector | Browse |
| ||
| Get hash | malicious | Vidar | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Vidar | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
|
⊘No context
| Process: | C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 654 |
| Entropy (8bit): | 5.380476433908377 |
| Encrypted: | false |
| SSDEEP: | 12:Q3La/KDLI4MWuPXcp1OKbbDLI4MWuPOKfSSI6Khap+92n4MNQp3/VXM5gXu9tv:ML9E4KQwKDE4KGKZI6Kh6+84xp3/VclT |
| MD5: | 30E4BDFC34907D0E4D11152CAEBE27FA |
| SHA1: | 825402D6B151041BA01C5117387228EC9B7168BF |
| SHA-256: | A7B8F7FFB4822570DB1423D61ED74D7F4B538CE73521CC8745BC6B131C18BE63 |
| SHA-512: | 89FBCBCDB0BE5AD7A95685CF9AA4330D5B0250440E67DC40C6642260E024F52A402E9381F534A9824D2541B98B02094178A15BF2320148432EDB0D09B5F972BA |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| Preview: |
| Process: | C:\Users\user\Desktop\SecuriteInfo.com.Heur.Mint.Phil.57.5869.22404.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 354816 |
| Entropy (8bit): | 6.367150840935163 |
| Encrypted: | false |
| SSDEEP: | 6144:/GNiI1KTTWXe8D1LYWoNxQOlEJESR0HN98er80du7gZPqhHsETDdtlz42AVFAnS:/GNUuXnDNbIxQWMExt+ei7g9qW+J/eV2 |
| MD5: | FF0BADEB5D6675C36D8F9068A1232258 |
| SHA1: | 7D287AD2BCDCE85532DEA445371A2D3C8295E516 |
| SHA-256: | 5B64CB5B788CCDD6006A7EDEFE6DCD1D36C9BF09101B53398E6A5938A1CC29C8 |
| SHA-512: | DE4A382BF267C27279727F03A898B817E4B4058907FBAE384C4368CFE35BB0B8184CA8678DE3A426BDCE0D4D62027CC3A634FF0BE48549C0A32F9BEDE9365664 |
| Malicious: | true |
| Antivirus: |
|
| Reputation: | low |
| Preview: |
| Process: | C:\Users\user\Desktop\SecuriteInfo.com.Heur.Mint.Phil.57.5869.22404.exe |
| File Type: | |
| Category: | modified |
| Size (bytes): | 26 |
| Entropy (8bit): | 3.95006375643621 |
| Encrypted: | false |
| SSDEEP: | 3:ggPYV:rPYV |
| MD5: | 187F488E27DB4AF347237FE461A079AD |
| SHA1: | 6693BA299EC1881249D59262276A0D2CB21F8E64 |
| SHA-256: | 255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309 |
| SHA-512: | 89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E |
| Malicious: | true |
| Reputation: | high, very likely benign file |
| Preview: |
| File type: | |
| Entropy (8bit): | 6.367150840935163 |
| TrID: |
|
| File name: | SecuriteInfo.com.Heur.Mint.Phil.57.5869.22404.exe |
| File size: | 354'816 bytes |
| MD5: | ff0badeb5d6675c36d8f9068a1232258 |
| SHA1: | 7d287ad2bcdce85532dea445371a2d3c8295e516 |
| SHA256: | 5b64cb5b788ccdd6006a7edefe6dcd1d36c9bf09101b53398e6a5938a1cc29c8 |
| SHA512: | de4a382bf267c27279727f03a898b817e4b4058907fbae384c4368cfe35bb0b8184ca8678de3a426bdce0d4d62027cc3a634ff0be48549c0a32f9bede9365664 |
| SSDEEP: | 6144:/GNiI1KTTWXe8D1LYWoNxQOlEJESR0HN98er80du7gZPqhHsETDdtlz42AVFAnS:/GNUuXnDNbIxQWMExt+ei7g9qW+J/eV2 |
| TLSH: | 86747C17F6E1A9BCE16AC07483569673BA37B88D0220397F53D486343E66E202F5DF19 |
| File Content Preview: | MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......f...............".8...f................@......................................`....`... ............................ |
 | |
| Icon Hash: | 90cececece8e8eb0 |
| Entrypoint: | 0x4014f0 |
| Entrypoint Section: | .text |
| Digitally signed: | false |
| Imagebase: | 0x400000 |
| Subsystem: | windows cui |
| Image File Characteristics: | EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED |
| DLL Characteristics: | HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT |
| Time Stamp: | 0x66B394B1 [Wed Aug 7 15:37:21 2024 UTC] |
| TLS Callbacks: | 0x41ca20 |
| CLR (.Net) Version: | |
| OS Version Major: | 4 |
| OS Version Minor: | 0 |
| File Version Major: | 4 |
| File Version Minor: | 0 |
| Subsystem Version Major: | 4 |
| Subsystem Version Minor: | 0 |
| Import Hash: | 827e46eec0f766fadcee4c8501e1de53 |
| Instruction |
|---|
| dec eax |
| sub esp, 28h |
| dec eax |
| mov eax, dword ptr [00050B35h] |
| mov dword ptr [eax], 00000000h |
| call 00007FFAF466A54Fh |
| call 00007FFAF462899Ah |
| nop |
| nop |
| dec eax |
| add esp, 28h |
| ret |
| nop word ptr [eax+eax+00000000h] |
| nop dword ptr [eax] |
| dec eax |
| sub esp, 28h |
| call 00007FFAF466A3CCh |
| dec eax |
| test eax, eax |
| sete al |
| movzx eax, al |
| neg eax |
| dec eax |
| add esp, 28h |
| ret |
| nop |
| nop |
| nop |
| nop |
| nop |
| nop |
| nop |
| dec eax |
| lea ecx, dword ptr [00000009h] |
| jmp 00007FFAF4628CF9h |
| nop dword ptr [eax+00h] |
| ret |
| nop |
| nop |
| nop |
| nop |
| nop |
| nop |
| nop |
| nop |
| nop |
| nop |
| nop |
| nop |
| nop |
| nop |
| nop |
| inc ecx |
| push edi |
| inc ecx |
| push esi |
| inc ecx |
| push ebp |
| inc ecx |
| push esp |
| push esi |
| push edi |
| push ebp |
| push ebx |
| dec eax |
| sub esp, 000000F8h |
| inc esp |
| mov byte ptr [esp+4Fh], cl |
| dec esp |
| mov dword ptr [esp+50h], eax |
| dec ecx |
| mov esi, edx |
| dec eax |
| mov edi, ecx |
| dec ecx |
| mov esp, 00000000h |
| add byte ptr [eax], al |
| add byte ptr [eax-6F6672B8h], al |
| add dword ptr [eax], eax |
| add byte ptr [ebp+ecx*4-57h], cl |
| cwde |
| add dword ptr [eax], eax |
| add byte ptr [eax-73h], cl |
| insb |
| and al, 70h |
| dec esp |
| lea edi, dword ptr [ecx+00000168h] |
| dec eax |
| lea eax, dword ptr [ecx+30h] |
| dec eax |
| mov dword ptr [esp+000000A0h], eax |
| dec eax |
| lea eax, dword ptr [ecx+58h] |
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0x5a000 | 0x10a8 | .idata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x53000 | 0x1adc | .pdata |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x5e000 | 0x4c4 | .reloc |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0x51c00 | 0x28 | .rdata |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x5a410 | 0x370 | .idata |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x43648 | 0x43800 | 3d10269cfb91c9b23c32fb5d687fb443 | False | 0.5322771990740741 | data | 6.351920157698596 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .data | 0x45000 | 0x120 | 0x200 | 3b43ab94eff15a1e16f6e89933e63877 | False | 0.142578125 | data | 0.7505333305125921 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .rdata | 0x46000 | 0xc080 | 0xc200 | 01694037a9e9bcac5939ab5ff90c4206 | False | 0.40757893041237114 | data | 5.586527256303149 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ |
| .pdata | 0x53000 | 0x1adc | 0x1c00 | 6e204c08cda11f782adfde8ff82ec133 | False | 0.4877232142857143 | data | 5.446254059490632 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ |
| .xdata | 0x55000 | 0x3200 | 0x3200 | 562233c964b6e7288bd9b42a08383387 | False | 0.3765625 | data | 5.468108910686631 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ |
| .bss | 0x59000 | 0xa20 | 0x0 | d41d8cd98f00b204e9800998ecf8427e | False | 0 | empty | 0.0 | IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .idata | 0x5a000 | 0x10a8 | 0x1200 | c4f18e333c49f18f8c1daa24275320ca | False | 0.3207465277777778 | data | 4.315940831752453 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .CRT | 0x5c000 | 0x70 | 0x200 | 51d2a3d3e0eeb5fc057196d73692bf6a | False | 0.083984375 | data | 0.3281187745953951 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .tls | 0x5d000 | 0x10 | 0x200 | bf619eac0cdf3f68d496ea9344137e8b | False | 0.02734375 | data | 0.0 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .reloc | 0x5e000 | 0x4c4 | 0x600 | eafe9c2ec4b39419542aeea47f3ea9da | False | 0.560546875 | data | 4.796357731350743 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
| DLL | Import |
|---|---|
| KERNEL32.dll | AddVectoredExceptionHandler, CloseHandle, CopyFileExW, CreateDirectoryW, CreateFileMappingA, CreateFileW, CreateToolhelp32Snapshot, DuplicateHandle, FindClose, FindFirstFileW, FormatMessageW, GetConsoleMode, GetCurrentDirectoryW, GetCurrentProcess, GetCurrentThread, GetEnvironmentVariableW, GetFileInformationByHandle, GetFileInformationByHandleEx, GetFullPathNameW, GetLastError, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleW, GetProcAddress, GetProcessHeap, GetStartupInfoA, GetStdHandle, HeapAlloc, HeapFree, HeapReAlloc, InitOnceBeginInitialize, InitOnceComplete, MapViewOfFile, Module32FirstW, Module32NextW, MultiByteToWideChar, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, SetFileInformationByHandle, SetLastError, SetThreadStackGuarantee, SetUnhandledExceptionFilter, Sleep, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, UnmapViewOfFile, WaitForSingleObject, WriteConsoleW |
| api-ms-win-core-synch-l1-2-0.dll | WaitOnAddress, WakeByAddressAll, WakeByAddressSingle |
| ADVAPI32.dll | SystemFunction036 |
| bcrypt.dll | BCryptGenRandom |
| KERNEL32.dll | DeleteCriticalSection, EnterCriticalSection, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, GetTickCount, InitializeCriticalSection, LeaveCriticalSection, QueryPerformanceCounter, RaiseException, RtlAddFunctionTable, RtlUnwindEx, TerminateProcess, UnhandledExceptionFilter, VirtualProtect, VirtualQuery, __C_specific_handler |
| msvcrt.dll | __getmainargs, __initenv, __iob_func, __lconv_init, __set_app_type, __setusermatherr, _acmdln, _amsg_exit, _cexit, _fmode, _fpreset, _initterm, _onexit, abort, calloc, exit, fprintf, free, fwrite, malloc, memcmp, memcpy, memmove, memset, signal, strlen, strncmp, vfprintf |
| ntdll.dll | NtWriteFile, RtlNtStatusToDosError |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | Protocol | SID | Signature | Severity | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|---|---|---|---|
| 2024-08-08T02:38:40.864390+0200 | TCP | 2853193 | ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound | 1 | 49746 | 20343 | 192.168.2.4 | 147.185.221.16 |
| 2024-08-08T02:36:24.326130+0200 | TCP | 2803274 | ETPRO MALWARE Common Downloader Header Pattern UH | 2 | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| 2024-08-08T02:36:16.355177+0200 | TCP | 2803274 | ETPRO MALWARE Common Downloader Header Pattern UH | 2 | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| 2024-08-08T02:36:44.411331+0200 | TCP | 2855924 | ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound | 1 | 49740 | 20343 | 192.168.2.4 | 147.185.221.16 |
| 2024-08-08T02:36:01.741479+0200 | TCP | 2803274 | ETPRO MALWARE Common Downloader Header Pattern UH | 2 | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| 2024-08-08T02:36:26.755485+0200 | TCP | 2855924 | ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound | 1 | 49731 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Aug 8, 2024 02:36:00.822510004 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:00.822541952 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:00.822659969 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:00.845756054 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:00.845774889 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:01.326553106 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:01.326622963 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:01.381254911 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:01.381274939 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:01.381745100 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:01.381792068 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:01.383996010 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:01.424526930 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:01.741492033 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:01.741643906 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:01.741683960 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:01.741708994 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:01.741724014 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:01.741755962 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:01.741764069 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:01.741812944 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:01.741820097 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:01.741863966 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:01.741869926 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:01.741918087 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:01.741925001 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:01.741967916 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:01.741974115 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:01.742019892 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:01.742141962 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:01.742196083 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:01.742232084 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:01.742280006 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:01.742312908 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:01.742361069 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:01.746095896 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:01.746165991 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:01.829777002 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:01.829963923 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:01.830013037 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:01.830035925 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:01.830048084 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:01.830091000 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:01.830095053 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:01.830142021 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:01.862971067 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:01.863059044 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:01.863121033 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:01.863147974 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:01.863157034 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:01.863189936 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:01.863210917 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:01.863218069 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:01.863233089 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:01.863291025 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:01.863297939 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:01.863323927 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:01.863352060 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:01.863363981 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:01.863375902 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:01.863425016 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:01.865397930 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:01.865483046 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:01.865525007 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:01.865550995 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:01.865559101 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:01.865580082 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:01.865602016 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:01.865605116 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:01.865642071 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:01.865647078 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:01.865688086 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:01.865689039 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:01.865704060 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:01.865725994 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:01.865756035 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:01.865761995 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:01.865798950 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:01.865842104 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:01.865849018 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:01.865856886 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:01.865884066 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:01.865901947 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:01.918297052 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:01.918420076 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:01.918431044 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:01.918474913 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:01.918512106 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:01.918668985 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:01.918723106 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:01.918730021 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:01.918773890 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:01.944881916 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:01.944962978 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:01.972656012 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:01.972706079 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:01.972742081 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:01.972753048 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:01.972778082 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:01.972791910 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:01.973052025 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:01.973109007 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:01.974229097 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:01.974299908 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:01.974370003 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:01.974421978 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:01.974488020 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:01.974535942 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:01.974575043 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:01.974627018 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:01.975390911 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:01.975452900 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:01.975480080 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:01.975541115 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:01.976185083 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:01.976238966 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:01.976329088 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:01.976382017 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:01.977148056 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:01.977215052 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:01.977235079 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:01.977289915 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:01.978037119 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:01.978102922 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:02.007390022 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:02.007457972 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:02.007498026 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:02.007555008 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:02.033296108 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:02.033379078 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:02.033418894 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:02.033510923 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:02.033528090 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:02.033646107 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:02.033653021 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:02.033669949 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:02.033690929 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:02.033710003 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:02.078887939 CEST | 49730 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:02.078907013 CEST | 443 | 49730 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:06.215801001 CEST | 49731 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:36:06.220854044 CEST | 20343 | 49731 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:36:06.221102953 CEST | 49731 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:36:06.630614996 CEST | 49731 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:36:06.636010885 CEST | 20343 | 49731 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:36:15.430533886 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:15.430578947 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:15.430649996 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:15.449425936 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:15.449441910 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:15.982836962 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:15.984535933 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:15.988408089 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:15.988418102 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:15.989226103 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:15.989800930 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:15.990751028 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.036498070 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.355235100 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.355287075 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.355304956 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.355392933 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.355398893 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.355501890 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.355505943 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.355571032 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.355576038 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.355639935 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.355644941 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.355669975 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.355716944 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.355716944 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.355755091 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.355799913 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.355838060 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.355911970 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.355926991 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.356018066 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.356021881 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.356097937 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.356132984 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.356194973 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.446018934 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.446160078 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.446167946 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.446228027 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.446252108 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.446257114 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.446291924 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.446305990 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.473778963 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.473942995 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.473957062 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.473987103 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.474034071 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.474034071 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.474065065 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.474162102 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.474167109 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.474268913 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.474271059 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.474292040 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.474333048 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.474333048 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.474904060 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.474968910 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.474982977 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.475053072 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.475431919 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.475492001 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.475518942 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.475593090 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.475604057 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.475653887 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.476259947 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.476346970 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.476351976 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.476423979 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.476428986 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.476516008 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.476520061 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.476571083 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.477109909 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.477166891 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.537611961 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.537733078 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.537736893 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.537815094 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.537817001 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.537842989 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.537959099 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.537965059 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.538038969 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.538043022 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.538079977 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.590831995 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.590970993 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.590976000 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.591033936 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.591043949 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.591183901 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.591185093 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.591212034 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.591269970 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.591269970 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.591298103 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.591389894 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.591398001 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.591419935 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.591465950 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.591465950 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.591515064 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.591584921 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.591598034 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.591660023 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.591717958 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.591818094 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.591836929 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.591841936 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.591872931 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.591872931 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.591911077 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.591981888 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.591998100 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.592101097 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.592147112 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.592150927 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.592195988 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.592226028 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.592226028 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.592232943 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.592279911 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.592279911 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.629002094 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.629129887 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.629134893 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.629179001 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.629201889 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.629205942 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.629257917 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.629257917 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.629281998 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.629376888 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.629426956 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.629435062 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.629472971 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.629472971 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.658179998 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.658397913 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.670892000 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.671112061 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.671117067 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.671217918 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.671217918 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.716521978 CEST | 49731 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:36:16.722326040 CEST | 20343 | 49731 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:36:16.973614931 CEST | 49732 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:16.973644018 CEST | 443 | 49732 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:23.443253994 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:23.443296909 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:23.443366051 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:23.452857018 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:23.452879906 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:23.923476934 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:23.923572063 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:23.929085016 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:23.929099083 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:23.929868937 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:23.930953026 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:23.932265043 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:23.976499081 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:24.326229095 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:24.326340914 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:24.326436996 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:24.326483011 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:24.326498032 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:24.326541901 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:24.326548100 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:24.326637983 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:24.326725960 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:24.326772928 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:24.326772928 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:24.326781034 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:24.326849937 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:24.326919079 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:24.326920033 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:24.326950073 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:24.326973915 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:24.326973915 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:24.326992989 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:24.327070951 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:24.328659058 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:24.412627935 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:24.412693977 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:24.412765026 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:24.412812948 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:24.412852049 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:24.412908077 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:24.412920952 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:24.412955046 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:24.446285963 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:24.446362019 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:24.446382999 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:24.446496964 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:24.446504116 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:24.446563959 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:24.446572065 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:24.446654081 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:24.446656942 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:24.446681976 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:24.446732044 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:24.446732044 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:24.446787119 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:24.446849108 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:24.446865082 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:24.446976900 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:24.446984053 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:24.447067022 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:24.447073936 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:24.447125912 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:24.447674036 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:24.447736979 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:24.447741985 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:24.447776079 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:24.447810888 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:24.447810888 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:24.447818041 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:24.447873116 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:24.447880030 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:24.447959900 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:24.448256016 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:24.448302031 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:24.448314905 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:24.448368073 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:24.448371887 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:24.448424101 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:24.448430061 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:24.448510885 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:24.448999882 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:24.449126005 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:24.500478983 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:24.500572920 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:24.500606060 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:24.500737906 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:24.500747919 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:24.500824928 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:24.500825882 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:24.500852108 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:24.500910997 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:24.500910997 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:24.500931025 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:24.501085997 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:24.533654928 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:24.533724070 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:24.579476118 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:24.579571962 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:24.579591036 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:24.579678059 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:24.580095053 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:24.580176115 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:24.580183029 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:24.580282927 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:24.580878019 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:24.580944061 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:24.581470013 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:24.581531048 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:24.581558943 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:24.581821918 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:24.582256079 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:24.582309008 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:24.583092928 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:24.583162069 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:24.583204985 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:24.583255053 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:24.587337017 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:24.587424994 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:24.587475061 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:24.587481976 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:24.587523937 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:24.587523937 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:24.587960958 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:24.588017941 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:24.588047981 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:24.588145018 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:24.621376991 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:24.621500015 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:24.621505022 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:24.621537924 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:24.621577024 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:24.621577024 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:24.621613979 CEST | 49739 | 443 | 192.168.2.4 | 104.21.28.76 |
| Aug 8, 2024 02:36:24.621632099 CEST | 443 | 49739 | 104.21.28.76 | 192.168.2.4 |
| Aug 8, 2024 02:36:26.755485058 CEST | 49731 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:36:26.760746956 CEST | 20343 | 49731 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:36:27.601955891 CEST | 20343 | 49731 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:36:27.602051973 CEST | 49731 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:36:30.989034891 CEST | 49731 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:36:30.990709066 CEST | 49740 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:36:30.994544983 CEST | 20343 | 49731 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:36:30.996361971 CEST | 20343 | 49740 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:36:30.996459007 CEST | 49740 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:36:31.026499033 CEST | 49740 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:36:31.032362938 CEST | 20343 | 49740 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:36:44.411330938 CEST | 49740 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:36:44.416395903 CEST | 20343 | 49740 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:36:52.383972883 CEST | 20343 | 49740 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:36:52.384149075 CEST | 49740 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:36:53.755251884 CEST | 49740 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:36:53.757356882 CEST | 49741 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:36:53.760410070 CEST | 20343 | 49740 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:36:53.762813091 CEST | 20343 | 49741 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:36:53.763020992 CEST | 49741 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:36:53.805351973 CEST | 49741 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:36:53.810736895 CEST | 20343 | 49741 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:37:07.020849943 CEST | 49741 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:37:07.333005905 CEST | 49741 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:37:07.524631023 CEST | 20343 | 49741 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:37:07.526546001 CEST | 20343 | 49741 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:37:10.458077908 CEST | 49741 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:37:10.464673042 CEST | 20343 | 49741 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:37:11.427078962 CEST | 49741 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:37:11.432766914 CEST | 20343 | 49741 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:37:12.303143024 CEST | 49741 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:37:12.312433004 CEST | 20343 | 49741 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:37:13.583539963 CEST | 49741 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:37:13.589796066 CEST | 20343 | 49741 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:37:13.801913023 CEST | 49741 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:37:13.807581902 CEST | 20343 | 49741 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:37:13.928436995 CEST | 49741 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:37:13.933806896 CEST | 20343 | 49741 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:37:13.989367008 CEST | 49741 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:37:13.995143890 CEST | 20343 | 49741 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:37:15.181395054 CEST | 20343 | 49741 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:37:15.181684017 CEST | 49741 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:37:19.006165981 CEST | 49741 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:37:19.009916067 CEST | 49743 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:37:19.011718988 CEST | 20343 | 49741 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:37:19.015382051 CEST | 20343 | 49743 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:37:19.015631914 CEST | 49743 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:37:19.109487057 CEST | 49743 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:37:19.310761929 CEST | 20343 | 49743 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:37:20.645476103 CEST | 49743 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:37:20.650861979 CEST | 20343 | 49743 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:37:24.161261082 CEST | 49743 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:37:24.166687012 CEST | 20343 | 49743 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:37:24.817415953 CEST | 49743 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:37:24.837595940 CEST | 20343 | 49743 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:37:26.645503044 CEST | 49743 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:37:26.650785923 CEST | 20343 | 49743 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:37:35.395586014 CEST | 49743 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:37:35.401371002 CEST | 20343 | 49743 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:37:39.553999901 CEST | 49743 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:37:39.559753895 CEST | 20343 | 49743 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:37:40.383708954 CEST | 20343 | 49743 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:37:40.383795023 CEST | 49743 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:37:44.551465034 CEST | 49743 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:37:44.557008028 CEST | 20343 | 49743 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:37:44.557835102 CEST | 49744 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:37:44.564554930 CEST | 20343 | 49744 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:37:44.564629078 CEST | 49744 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:37:44.606161118 CEST | 49744 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:37:44.610914946 CEST | 20343 | 49744 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:37:53.473609924 CEST | 49744 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:37:53.478686094 CEST | 20343 | 49744 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:38:05.966955900 CEST | 20343 | 49744 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:38:05.967111111 CEST | 49744 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:38:10.035933971 CEST | 49744 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:38:10.041105986 CEST | 20343 | 49744 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:38:10.043289900 CEST | 49745 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:38:10.048877001 CEST | 20343 | 49745 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:38:10.048970938 CEST | 49745 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:38:10.096297026 CEST | 49745 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:38:10.101852894 CEST | 20343 | 49745 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:38:20.239388943 CEST | 49745 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:38:20.244415998 CEST | 20343 | 49745 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:38:20.255114079 CEST | 49745 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:38:20.260452032 CEST | 20343 | 49745 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:38:20.286277056 CEST | 49745 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:38:20.291503906 CEST | 20343 | 49745 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:38:20.333023071 CEST | 49745 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:38:20.338212013 CEST | 20343 | 49745 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:38:20.395731926 CEST | 49745 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:38:20.401077032 CEST | 20343 | 49745 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:38:26.582948923 CEST | 49745 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:38:26.588355064 CEST | 20343 | 49745 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:38:31.418616056 CEST | 20343 | 49745 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:38:31.418723106 CEST | 49745 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:38:35.552031994 CEST | 49745 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:38:35.557674885 CEST | 20343 | 49745 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:38:35.600383043 CEST | 49746 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:38:35.605916977 CEST | 20343 | 49746 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:38:35.606029034 CEST | 49746 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:38:35.664263010 CEST | 49746 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:38:35.672635078 CEST | 20343 | 49746 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:38:35.754786015 CEST | 49746 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:38:35.760046959 CEST | 20343 | 49746 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:38:36.849044085 CEST | 49746 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:38:36.854626894 CEST | 20343 | 49746 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:38:40.864389896 CEST | 49746 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:38:40.869956970 CEST | 20343 | 49746 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:38:40.942393064 CEST | 49746 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:38:40.948041916 CEST | 20343 | 49746 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:38:40.958134890 CEST | 49746 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:38:40.963480949 CEST | 20343 | 49746 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:38:41.020468950 CEST | 49746 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:38:41.026542902 CEST | 20343 | 49746 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:38:41.036175013 CEST | 49746 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:38:41.041132927 CEST | 20343 | 49746 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:38:41.145818949 CEST | 49746 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:38:41.151103020 CEST | 20343 | 49746 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:38:41.161236048 CEST | 49746 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:38:41.166357040 CEST | 20343 | 49746 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:38:41.192459106 CEST | 49746 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:38:41.197916985 CEST | 20343 | 49746 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:38:41.239301920 CEST | 49746 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:38:41.244887114 CEST | 20343 | 49746 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:38:51.270566940 CEST | 49746 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:38:51.276165962 CEST | 20343 | 49746 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:38:56.979634047 CEST | 20343 | 49746 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:38:56.979851007 CEST | 49746 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:39:01.350532055 CEST | 49746 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:39:01.356179953 CEST | 20343 | 49746 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:39:01.362129927 CEST | 49747 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:39:01.367858887 CEST | 20343 | 49747 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:39:01.368012905 CEST | 49747 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:39:01.427769899 CEST | 49747 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:39:01.433238983 CEST | 20343 | 49747 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:39:03.098787069 CEST | 49747 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:39:03.104165077 CEST | 20343 | 49747 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:39:06.927217007 CEST | 49747 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:39:06.932713032 CEST | 20343 | 49747 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:39:18.947268009 CEST | 49747 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:39:18.952621937 CEST | 20343 | 49747 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:39:22.730789900 CEST | 20343 | 49747 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:39:22.731257915 CEST | 49747 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:39:27.098586082 CEST | 49747 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:39:27.103668928 CEST | 49748 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:39:27.103996992 CEST | 20343 | 49747 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:39:27.109141111 CEST | 20343 | 49748 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:39:27.109328985 CEST | 49748 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:39:27.160307884 CEST | 49748 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:39:27.165425062 CEST | 20343 | 49748 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:39:40.631170034 CEST | 49748 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:39:40.637993097 CEST | 20343 | 49748 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:39:42.911227942 CEST | 49748 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:39:42.916847944 CEST | 20343 | 49748 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:39:44.162189960 CEST | 49748 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:39:44.167587042 CEST | 20343 | 49748 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:39:44.461373091 CEST | 49748 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:39:44.468125105 CEST | 20343 | 49748 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:39:44.833352089 CEST | 49748 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:39:45.051547050 CEST | 49748 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:39:45.056802034 CEST | 20343 | 49748 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:39:45.058475018 CEST | 20343 | 49748 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:39:46.585501909 CEST | 49748 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:39:46.590909004 CEST | 20343 | 49748 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:39:46.770541906 CEST | 49748 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:39:46.780005932 CEST | 20343 | 49748 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:39:48.466545105 CEST | 20343 | 49748 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:39:48.473171949 CEST | 49748 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:39:53.004923105 CEST | 49748 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:39:53.010464907 CEST | 49749 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:39:53.010540962 CEST | 20343 | 49748 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:39:53.015652895 CEST | 20343 | 49749 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:39:53.015850067 CEST | 49749 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:39:53.052258015 CEST | 49749 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:39:53.057212114 CEST | 20343 | 49749 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:39:53.083250046 CEST | 49749 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:39:53.090679884 CEST | 20343 | 49749 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:39:53.130085945 CEST | 49749 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:39:53.135382891 CEST | 20343 | 49749 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:39:53.161791086 CEST | 49749 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:39:53.166975021 CEST | 20343 | 49749 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:39:53.271959066 CEST | 49749 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:39:53.277009964 CEST | 20343 | 49749 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:39:53.364308119 CEST | 49749 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:39:53.369699955 CEST | 20343 | 49749 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:39:54.145683050 CEST | 49749 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:39:54.151221991 CEST | 20343 | 49749 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:40:05.708097935 CEST | 49749 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:40:05.713519096 CEST | 20343 | 49749 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:40:06.098608971 CEST | 49749 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:40:06.105479956 CEST | 20343 | 49749 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:40:14.435059071 CEST | 20343 | 49749 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:40:14.435314894 CEST | 49749 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:40:20.223577023 CEST | 49749 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:40:20.224728107 CEST | 49750 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:40:20.228650093 CEST | 20343 | 49749 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:40:20.229650974 CEST | 20343 | 49750 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:40:20.229748011 CEST | 49750 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:40:20.252666950 CEST | 49750 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:40:20.257510900 CEST | 20343 | 49750 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:40:34.459342957 CEST | 49750 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Aug 8, 2024 02:40:34.464875937 CEST | 20343 | 49750 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:40:41.606859922 CEST | 20343 | 49750 | 147.185.221.16 | 192.168.2.4 |
| Aug 8, 2024 02:40:41.606996059 CEST | 49750 | 20343 | 192.168.2.4 | 147.185.221.16 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Aug 8, 2024 02:36:00.800692081 CEST | 60813 | 53 | 192.168.2.4 | 1.1.1.1 |
| Aug 8, 2024 02:36:00.813788891 CEST | 53 | 60813 | 1.1.1.1 | 192.168.2.4 |
| Aug 8, 2024 02:36:06.168222904 CEST | 51533 | 53 | 192.168.2.4 | 1.1.1.1 |
| Aug 8, 2024 02:36:06.181755066 CEST | 53 | 51533 | 1.1.1.1 | 192.168.2.4 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Aug 8, 2024 02:36:00.800692081 CEST | 192.168.2.4 | 1.1.1.1 | 0xb0bd | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Aug 8, 2024 02:36:06.168222904 CEST | 192.168.2.4 | 1.1.1.1 | 0xbeb | Standard query (0) | A (IP address) | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Aug 8, 2024 02:36:00.813788891 CEST | 1.1.1.1 | 192.168.2.4 | 0xb0bd | No error (0) | 104.21.28.76 | A (IP address) | IN (0x0001) | false | ||
| Aug 8, 2024 02:36:00.813788891 CEST | 1.1.1.1 | 192.168.2.4 | 0xb0bd | No error (0) | 172.67.144.225 | A (IP address) | IN (0x0001) | false | ||
| Aug 8, 2024 02:36:06.181755066 CEST | 1.1.1.1 | 192.168.2.4 | 0xbeb | No error (0) | 147.185.221.16 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.4 | 49730 | 104.21.28.76 | 443 | 6872 | C:\Users\user\Desktop\SecuriteInfo.com.Heur.Mint.Phil.57.5869.22404.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-08-08 00:36:01 UTC | 73 | OUT | |
| 2024-08-08 00:36:01 UTC | 834 | IN | |
| 2024-08-08 00:36:01 UTC | 535 | IN | |
| 2024-08-08 00:36:01 UTC | 1369 | IN | |
| 2024-08-08 00:36:01 UTC | 1369 | IN | |
| 2024-08-08 00:36:01 UTC | 1369 | IN | |
| 2024-08-08 00:36:01 UTC | 1369 | IN | |
| 2024-08-08 00:36:01 UTC | 1369 | IN | |
| 2024-08-08 00:36:01 UTC | 1369 | IN | |
| 2024-08-08 00:36:01 UTC | 1369 | IN | |
| 2024-08-08 00:36:01 UTC | 1369 | IN | |
| 2024-08-08 00:36:01 UTC | 1369 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.4 | 49732 | 104.21.28.76 | 443 | 6544 | C:\Users\user\AppData\Roaming\qNl6oqz9\FRpl.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-08-08 00:36:15 UTC | 73 | OUT | |
| 2024-08-08 00:36:16 UTC | 838 | IN | |
| 2024-08-08 00:36:16 UTC | 531 | IN | |
| 2024-08-08 00:36:16 UTC | 1369 | IN | |
| 2024-08-08 00:36:16 UTC | 1369 | IN | |
| 2024-08-08 00:36:16 UTC | 1369 | IN | |
| 2024-08-08 00:36:16 UTC | 1369 | IN | |
| 2024-08-08 00:36:16 UTC | 1369 | IN | |
| 2024-08-08 00:36:16 UTC | 1369 | IN | |
| 2024-08-08 00:36:16 UTC | 1369 | IN | |
| 2024-08-08 00:36:16 UTC | 1369 | IN | |
| 2024-08-08 00:36:16 UTC | 1369 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 2 | 192.168.2.4 | 49739 | 104.21.28.76 | 443 | 2284 | C:\Users\user\AppData\Roaming\qNl6oqz9\FRpl.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-08-08 00:36:23 UTC | 73 | OUT | |
| 2024-08-08 00:36:24 UTC | 836 | IN | |
| 2024-08-08 00:36:24 UTC | 533 | IN | |
| 2024-08-08 00:36:24 UTC | 1369 | IN | |
| 2024-08-08 00:36:24 UTC | 1201 | IN | |
| 2024-08-08 00:36:24 UTC | 1369 | IN | |
| 2024-08-08 00:36:24 UTC | 1369 | IN | |
| 2024-08-08 00:36:24 UTC | 1369 | IN | |
| 2024-08-08 00:36:24 UTC | 1369 | IN | |
| 2024-08-08 00:36:24 UTC | 1369 | IN | |
| 2024-08-08 00:36:24 UTC | 1369 | IN | |
| 2024-08-08 00:36:24 UTC | 1369 | IN |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
| Target ID: | 0 |
| Start time: | 20:35:59 |
| Start date: | 07/08/2024 |
| Path: | C:\Users\user\Desktop\SecuriteInfo.com.Heur.Mint.Phil.57.5869.22404.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x290000 |
| File size: | 354'816 bytes |
| MD5 hash: | FF0BADEB5D6675C36D8F9068A1232258 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Reputation: | low |
| Has exited: | true |
| Target ID: | 1 |
| Start time: | 20:35:59 |
| Start date: | 07/08/2024 |
| Path: | C:\Windows\System32\conhost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff7699e0000 |
| File size: | 862'208 bytes |
| MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 2 |
| Start time: | 20:35:59 |
| Start date: | 07/08/2024 |
| Path: | C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff64f7a0000 |
| File size: | 385'024 bytes |
| MD5 hash: | 0AED91DA63713BF9F881B03A604A1C9D |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Reputation: | low |
| Has exited: | false |
| Target ID: | 3 |
| Start time: | 20:36:14 |
| Start date: | 07/08/2024 |
| Path: | C:\Users\user\AppData\Roaming\qNl6oqz9\FRpl.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0xb60000 |
| File size: | 354'816 bytes |
| MD5 hash: | FF0BADEB5D6675C36D8F9068A1232258 |
| Has elevated privileges: | false |
| Has administrator privileges: | false |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Antivirus matches: |
|
| Reputation: | low |
| Has exited: | true |
| Target ID: | 4 |
| Start time: | 20:36:14 |
| Start date: | 07/08/2024 |
| Path: | C:\Windows\System32\conhost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff7699e0000 |
| File size: | 862'208 bytes |
| MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
| Has elevated privileges: | false |
| Has administrator privileges: | false |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 5 |
| Start time: | 20:36:14 |
| Start date: | 07/08/2024 |
| Path: | C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff64f7a0000 |
| File size: | 385'024 bytes |
| MD5 hash: | 0AED91DA63713BF9F881B03A604A1C9D |
| Has elevated privileges: | false |
| Has administrator privileges: | false |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Reputation: | low |
| Has exited: | true |
| Target ID: | 9 |
| Start time: | 20:36:22 |
| Start date: | 07/08/2024 |
| Path: | C:\Users\user\AppData\Roaming\qNl6oqz9\FRpl.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0xb60000 |
| File size: | 354'816 bytes |
| MD5 hash: | FF0BADEB5D6675C36D8F9068A1232258 |
| Has elevated privileges: | false |
| Has administrator privileges: | false |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Reputation: | low |
| Has exited: | true |
| Target ID: | 10 |
| Start time: | 20:36:22 |
| Start date: | 07/08/2024 |
| Path: | C:\Windows\System32\conhost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff7699e0000 |
| File size: | 862'208 bytes |
| MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
| Has elevated privileges: | false |
| Has administrator privileges: | false |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 11 |
| Start time: | 20:36:22 |
| Start date: | 07/08/2024 |
| Path: | C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff64f7a0000 |
| File size: | 385'024 bytes |
| MD5 hash: | 0AED91DA63713BF9F881B03A604A1C9D |
| Has elevated privileges: | false |
| Has administrator privileges: | false |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Reputation: | low |
| Has exited: | true |
Analysis Process: SecuriteInfo.com.Heur.Mint.Phil.57.5869.22404.exePID: 6872, Parent PID: 2580COMMON
Execution Graph
| Execution Coverage: | 3% |
| Dynamic/Decrypted Code Coverage: | 0% |
| Signature Coverage: | 55.5% |
| Total number of Nodes: | 865 |
| Total number of Limit Nodes: | 6 |
Graph
Function 00294AA1 Relevance: 85.4, APIs: 37, Strings: 10, Instructions: 3134injectionnetworkregistryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00298820 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 112threadCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002ABAA0 Relevance: 6.1, APIs: 4, Instructions: 97COMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002CEC40 Relevance: 2.7, APIs: 2, Instructions: 208COMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002AC2E0 Relevance: 1.4, APIs: 1, Instructions: 112COMMON
Download Yara Rule
Control-flow Graph
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002AC40D Relevance: 1.3, APIs: 1, Instructions: 60COMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002CDBB0 Relevance: 1.3, APIs: 1, Instructions: 58COMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00293444 Relevance: 1.3, APIs: 1, Instructions: 32COMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002CF500 Relevance: 37.5, APIs: 19, Strings: 2, Instructions: 737processCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002AD4B0 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 337windowCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002D2E10 Relevance: 12.0, APIs: 8, Instructions: 50COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002B9E60 Relevance: 5.2, APIs: 4, Instructions: 225COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002A9790 Relevance: 4.6, Strings: 3, Instructions: 802COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002C78A0 Relevance: 4.5, APIs: 3, Instructions: 736COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002CA790 Relevance: 4.5, APIs: 3, Instructions: 710COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002C59E0 Relevance: 4.4, APIs: 3, Instructions: 674COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002C3F60 Relevance: 4.4, APIs: 3, Instructions: 629COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002C2BC0 Relevance: 4.4, APIs: 3, Instructions: 625COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002D0410 Relevance: 4.2, APIs: 3, Instructions: 488COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002A1B61 Relevance: 4.1, Strings: 3, Instructions: 301COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00293B76 Relevance: 3.3, APIs: 2, Instructions: 802COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002B5120 Relevance: 3.1, APIs: 1, Instructions: 1844COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002C2480 Relevance: 2.9, APIs: 2, Instructions: 441COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002C5310 Relevance: 2.9, APIs: 2, Instructions: 417COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002C3880 Relevance: 2.9, APIs: 2, Instructions: 416COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002C71D0 Relevance: 2.9, APIs: 2, Instructions: 416COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002BA2C0 Relevance: 2.0, APIs: 1, Instructions: 755COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002921C7 Relevance: 1.6, Strings: 1, Instructions: 354COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0029D060 Relevance: 1.6, APIs: 1, Instructions: 349COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00292AB9 Relevance: 1.5, Strings: 1, Instructions: 270COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002BDDB0 Relevance: 1.5, Instructions: 1484COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002CD8D0 Relevance: 1.4, Strings: 1, Instructions: 190COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0029C150 Relevance: 1.4, Strings: 1, Instructions: 134COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002A7330 Relevance: 1.4, Strings: 1, Instructions: 127COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002C06A0 Relevance: .7, Instructions: 674COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002BC860 Relevance: .6, Instructions: 606COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002AE9E0 Relevance: .3, Instructions: 340COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00299B20 Relevance: .3, Instructions: 325COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002AF320 Relevance: .3, Instructions: 289COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002A2BFB Relevance: .3, Instructions: 270COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002CB230 Relevance: .3, Instructions: 251COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002B4B20 Relevance: .2, Instructions: 250COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0029E2E4 Relevance: .2, Instructions: 208COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002C1E10 Relevance: .2, Instructions: 175COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002B915F Relevance: .1, Instructions: 139COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0029E574 Relevance: .1, Instructions: 112COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0029E77F Relevance: .1, Instructions: 101COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002CA040 Relevance: .1, Instructions: 99COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0029E00C Relevance: .1, Instructions: 91COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0029E90D Relevance: .1, Instructions: 83COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0029E6CC Relevance: .1, Instructions: 69COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002BAA2F Relevance: .0, Instructions: 48COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002EA560 Relevance: .0, Instructions: 31COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002D45F0 Relevance: .0, Instructions: 7COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002ACA20 Relevance: 12.7, APIs: 10, Instructions: 181COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002CC020 Relevance: 9.2, APIs: 6, Instructions: 173COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002AFDF0 Relevance: 9.1, APIs: 6, Instructions: 147fileCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002CCD20 Relevance: 7.7, APIs: 5, Instructions: 214COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002AC560 Relevance: 7.6, APIs: 6, Instructions: 115COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002D28B0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 002D007E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123fileCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Execution Graph
| Execution Coverage: | 16.4% |
| Dynamic/Decrypted Code Coverage: | 0% |
| Signature Coverage: | 0% |
| Total number of Nodes: | 88 |
| Total number of Limit Nodes: | 5 |
Graph
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Control-flow Graph
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B895CE6 Relevance: .5, Instructions: 470COMMON
Download Yara Rule
Control-flow Graph
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B896A92 Relevance: .5, Instructions: 456COMMON
Download Yara Rule
Control-flow Graph
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 000001AA110229B4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 104libraryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Control-flow Graph
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B897C25 Relevance: .8, Instructions: 787COMMON
Download Yara Rule
Control-flow Graph
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B890E58 Relevance: .4, Instructions: 393COMMON
Download Yara Rule
Control-flow Graph
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B897CA0 Relevance: .4, Instructions: 390COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B891B29 Relevance: .4, Instructions: 376COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B8966A6 Relevance: .3, Instructions: 329COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B890E98 Relevance: .2, Instructions: 250COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B8985F0 Relevance: .2, Instructions: 248COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B89151D Relevance: .2, Instructions: 242COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B8985EC Relevance: .2, Instructions: 222COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B89754D Relevance: .2, Instructions: 211COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B891878 Relevance: .2, Instructions: 196COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B8935DC Relevance: .2, Instructions: 194COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B890E80 Relevance: .2, Instructions: 192COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B898B9A Relevance: .2, Instructions: 185COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B890EC0 Relevance: .2, Instructions: 182COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B8913A1 Relevance: .1, Instructions: 146COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B890E50 Relevance: .1, Instructions: 145COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B898318 Relevance: .1, Instructions: 145COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B897779 Relevance: .1, Instructions: 130COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B890E90 Relevance: .1, Instructions: 123COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B8924E5 Relevance: .1, Instructions: 120COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B89067D Relevance: .1, Instructions: 120COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B890AF0 Relevance: .1, Instructions: 116COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B892205 Relevance: .1, Instructions: 109COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B890849 Relevance: .1, Instructions: 107COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B8909C3 Relevance: .1, Instructions: 106COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B891120 Relevance: .1, Instructions: 105COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B898FA1 Relevance: .1, Instructions: 102COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B898071 Relevance: .1, Instructions: 97COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B898D81 Relevance: .1, Instructions: 88COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B898463 Relevance: .1, Instructions: 88COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B8971F0 Relevance: .1, Instructions: 86COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B89055D Relevance: .1, Instructions: 79COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B898EAD Relevance: .1, Instructions: 77COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B890ED0 Relevance: .1, Instructions: 77COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B8979EB Relevance: .1, Instructions: 67COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B8901F8 Relevance: .1, Instructions: 59COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B8983D3 Relevance: .1, Instructions: 58COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B8907D6 Relevance: .1, Instructions: 55COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B890E78 Relevance: .0, Instructions: 46COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B8914BD Relevance: .0, Instructions: 34COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B897A44 Relevance: .0, Instructions: 30COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B890120 Relevance: .0, Instructions: 30COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B898F1D Relevance: .0, Instructions: 29COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B8923E3 Relevance: .0, Instructions: 27COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B891364 Relevance: .0, Instructions: 26COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B89122D Relevance: .0, Instructions: 20COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B8924B4 Relevance: .0, Instructions: 18COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B892427 Relevance: .0, Instructions: 16COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B892456 Relevance: .0, Instructions: 16COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B892385 Relevance: .0, Instructions: 16COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B8923B4 Relevance: .0, Instructions: 16COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B892356 Relevance: .0, Instructions: 16COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B892485 Relevance: .0, Instructions: 16COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B890ED8 Relevance: .0, Instructions: 8COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Execution Graph
| Execution Coverage: | 2.6% |
| Dynamic/Decrypted Code Coverage: | 0% |
| Signature Coverage: | 0% |
| Total number of Nodes: | 762 |
| Total number of Limit Nodes: | 6 |
Graph
Function 00B64AA1 Relevance: 78.4, APIs: 35, Strings: 8, Instructions: 3134injectionnetworklibraryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00B68820 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 112threadCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00B7BAA0 Relevance: 6.1, APIs: 4, Instructions: 97COMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00B71956 Relevance: 5.1, APIs: 4, Instructions: 119COMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00B9EC40 Relevance: 2.7, APIs: 2, Instructions: 208COMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00B7C2E0 Relevance: 1.4, APIs: 1, Instructions: 112COMMON
Download Yara Rule
Control-flow Graph
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00B7C40D Relevance: 1.3, APIs: 1, Instructions: 60COMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00B63444 Relevance: 1.3, APIs: 1, Instructions: 32COMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00BA2E10 Relevance: 12.0, APIs: 8, Instructions: 50COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00B7D4B0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 337windowCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00B89E60 Relevance: 5.2, APIs: 4, Instructions: 225COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00B7CA20 Relevance: 12.7, APIs: 10, Instructions: 181COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00B9C020 Relevance: 9.2, APIs: 6, Instructions: 173COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00B7FDF0 Relevance: 9.1, APIs: 6, Instructions: 147fileCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00B9CD20 Relevance: 7.7, APIs: 5, Instructions: 214COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00B7C560 Relevance: 7.6, APIs: 6, Instructions: 115COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00BA28B0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00BA007E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123fileCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Execution Graph
| Execution Coverage: | 11.5% |
| Dynamic/Decrypted Code Coverage: | 0% |
| Signature Coverage: | 0% |
| Total number of Nodes: | 88 |
| Total number of Limit Nodes: | 5 |
Graph
Callgraph
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00000204FD6729B4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 104libraryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00007FFD9B8A0E15 Relevance: .5, Instructions: 511COMMON
Download Yara Rule
Control-flow Graph
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B8A055D Relevance: .3, Instructions: 261COMMON
Download Yara Rule
Control-flow Graph
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B8A0949 Relevance: .2, Instructions: 159COMMON
Download Yara Rule
Control-flow Graph
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B8A0AD1 Relevance: .1, Instructions: 130COMMON
Download Yara Rule
Control-flow Graph
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B8A0849 Relevance: .1, Instructions: 108COMMON
Download Yara Rule
Control-flow Graph
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B8A07D6 Relevance: .1, Instructions: 55COMMON
Download Yara Rule
Control-flow Graph
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B8A0120 Relevance: .0, Instructions: 30COMMON
Download Yara Rule
Control-flow Graph
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Execution Graph
| Execution Coverage: | 11.4% |
| Dynamic/Decrypted Code Coverage: | 0% |
| Signature Coverage: | 0% |
| Total number of Nodes: | 89 |
| Total number of Limit Nodes: | 4 |
Graph
Callgraph
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0000027ADED729B4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 104libraryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00007FFD9B8C0E15 Relevance: .5, Instructions: 511COMMON
Download Yara Rule
Control-flow Graph
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B8C055D Relevance: .3, Instructions: 261COMMON
Download Yara Rule
Control-flow Graph
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B8C0949 Relevance: .2, Instructions: 159COMMON
Download Yara Rule
Control-flow Graph
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B8C0AD1 Relevance: .1, Instructions: 130COMMON
Download Yara Rule
Control-flow Graph
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B8C0849 Relevance: .1, Instructions: 108COMMON
Download Yara Rule
Control-flow Graph
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B8C07D6 Relevance: .1, Instructions: 55COMMON
Download Yara Rule
Control-flow Graph
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD9B8C0120 Relevance: .0, Instructions: 30COMMON
Download Yara Rule
Control-flow Graph
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|