Edit tour
Windows
Analysis Report
getscreen-120727697-x86.exe
Overview
General Information
| Sample name: | getscreen-120727697-x86.exe |
| Analysis ID: | 1503397 |
| MD5: | 9c765958b4d463d04c41def1103aa1f2 |
| SHA1: | 987ac08a723a10f26c2d5e7270411585456596af |
| SHA256: | 41bc389b3188eaafcc95f195774af57e2fc72b05557539bbd61975d9f82286c5 |
| Infos: |  |
 | |
Detection
| Score: | 54 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Compliance
| Score: | 47 |
| Range: | 0 - 100 |
Signatures
Modifies Internet Explorer zonemap settings
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Queries sensitive sound device information (via WMI, Win32_SoundDevice, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality to simulate mouse events
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
PE file contains executable resources (Code or Archives)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: IE Change Domain Zone
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Classification
- System is w10x64native
getscreen-120727697-x86.exe (PID: 6380 cmdline: "C:\Users\ user\Deskt op\getscre en-1207276 97-x86.exe " MD5: 9C765958B4D463D04C41DEF1103AA1F2) - getscreen-120727697-x86.exe (PID: 5796 cmdline:
"C:\Users\ user\Deskt op\getscre en-1207276 97-x86.exe " -gpipe \ \.\pipe\PC ommand97ee vsiwzhbqnw ukq -gui MD5: 9C765958B4D463D04C41DEF1103AA1F2) - getscreen-120727697-x86.exe (PID: 4320 cmdline:
"C:\Users\ user\Deskt op\getscre en-1207276 97-x86.exe " -cpipe \ \.\pipe\PC ommand96vr vrbjerbhsa igc -cmem 0000pipe0P Command96v rvrbjerbhs aigc9zl1ur wze4y5iil -child MD5: 9C765958B4D463D04C41DEF1103AA1F2)
- rzrcqgspmqryvpnwupffnbzpjfygzjn-elevate.exe (PID: 7356 cmdline:
"C:\Progra mData\Gets creen.me\r zrcqgspmqr yvpnwupffn bzpjfygzjn -elevate.e xe" -eleva te \\.\pip e\elevateG S512rzrcqg spmqryvpnw upffnbzpjf ygzjn MD5: 9C765958B4D463D04C41DEF1103AA1F2)
svchost.exe (PID: 804 cmdline: C:\Windows \system32\ svchost.ex e -k netsv cs -p -s s eclogon MD5: F586835082F632DC8D9404D83BC16316)
- cleanup
⊘No configs have been found
⊘No yara matches
| Source: | Author: frack113: | ||
| Source: | Author: vburov: | ||
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
| Source: | Code function: | 5_2_0079584E | |
| Source: | Code function: | 5_2_00795831 | |
| Source: | Code function: | 5_2_00795966 | |
| Source: | Code function: | 5_2_0079612F | |
| Source: | Code function: | 5_2_0079590A | |
| Source: | Code function: | 5_2_00796105 | |
| Source: | Code function: | 5_2_00872165 | |
| Source: | Code function: | 5_2_00795A61 | |
| Source: | Code function: | 5_2_00795A65 | |
| Source: | Code function: | 5_2_00795ABB | |
| Source: | Code function: | 5_2_00795B39 | |
| Source: | Code function: | 5_2_007A7B3F | |
| Source: | Code function: | 5_2_00795B24 | |
| Source: | Code function: | 5_2_007A7B24 | |
| Source: | Code function: | 5_2_007EE437 | |
| Source: | Code function: | 5_2_007EE42E | |
| Source: | Code function: | 5_2_00795D58 | |
| Source: | Code function: | 5_2_00795DA5 | |
| Source: | Code function: | 5_2_00795D97 | |
| Source: | Code function: | 5_2_00795D82 | |
| Source: | Code function: | 5_2_00795E14 | |
| Source: | Code function: | 5_2_00872620 | |
| Source: | Code function: | 5_2_00795ED1 | |
| Source: | Code function: | 5_2_0079576E | |
| Source: | Code function: | 5_2_00795732 | |
| Source: | Code function: | 5_2_007A3F1C | |
| Source: | Code function: | 5_2_00795782 | |
| Source: | Code function: | 7_2_00C9584E | |
| Source: | Code function: | 7_2_00C95831 | |
| Source: | Code function: | 7_2_00C95966 | |
| Source: | Code function: | 7_2_00D72165 | |
| Source: | Code function: | 7_2_00C9590A | |
| Source: | Code function: | 7_2_00C96105 | |
| Source: | Code function: | 7_2_00C9612F | |
| Source: | Code function: | 7_2_00C95ABB | |
| Source: | Code function: | 7_2_00C95A61 | |
| Source: | Code function: | 7_2_00C95A65 | |
| Source: | Code function: | 7_2_00C95B24 | |
| Source: | Code function: | 7_2_00CA7B24 | |
| Source: | Code function: | 7_2_00C95B39 | |
| Source: | Code function: | 7_2_00CA7B3F | |
| Source: | Code function: | 7_2_00CEE42E | |
| Source: | Code function: | 7_2_00CEE437 | |
| Source: | Code function: | 7_2_00C95D82 | |
| Source: | Code function: | 7_2_00C95D97 | |
| Source: | Code function: | 7_2_00C95DA5 | |
| Source: | Code function: | 7_2_00C95D58 | |
| Source: | Code function: | 7_2_00C95ED1 | |
| Source: | Code function: | 7_2_00C95E14 | |
| Source: | Code function: | 7_2_00D72620 | |
| Source: | Code function: | 7_2_00C95782 | |
| Source: | Code function: | 7_2_00C9576E | |
| Source: | Code function: | 7_2_00CA3F1C | |
| Source: | Code function: | 7_2_00C95732 | |
| Source: | Registry value created: | Jump to behavior | ||
| Source: | Registry value created: | Jump to behavior | ||
Compliance |   |
|---|
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
| Source: | IP Address: | ||
| Source: | IP Address: | ||
| Source: | ASN Name: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Code function: | 5_2_001CB080 | |
| Source: | Code function: | 5_2_001F89A0 | |
| Source: | Code function: | 5_2_001EA30D | |
| Source: | Code function: | 7_2_006CB080 | |
| Source: | Code function: | 7_2_006F89A0 | |
| Source: | Code function: | 7_2_006EA30D | |
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Static PE information: | ||
| Source: | Classification label: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Mutant created: | ||
| Source: | WMI Queries: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Key value queried: | Jump to behavior | ||
| Source: | Window detected: | ||
| Source: | Static PE information: | ||
| Source: | Static file information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
| Source: | Code function: | 5_2_018D29E0 | |
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | Code function: | 5_2_007F7449 | |
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
Malware Analysis System Evasion | |
|---|
| Source: | WMI Queries: | ||
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | System information queried: | Jump to behavior | ||
| Source: | System information queried: | Jump to behavior | ||
| Source: | System information queried: | Jump to behavior | ||
| Source: | System information queried: | Jump to behavior | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | API coverage: | ||
| Source: | API coverage: | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | Last function: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | API call chain: | graph_5-13223 | ||
| Source: | API call chain: | graph_7-12928 | ||
| Source: | Process information queried: | Jump to behavior | ||
| Source: | Code function: | 5_2_007FEE20 | |
| Source: | Code function: | 5_2_018D29E0 | |
| Source: | Code function: | 5_2_0083FCA9 | |
| Source: | Code function: | 7_2_00D3FCA9 | |
| Source: | Code function: | 5_2_00797321 | |
| Source: | Process created: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Code function: | 5_2_001F89A0 | |
| Source: | Code function: | 5_2_007AE4DD | |
Lowering of HIPS / PFW / Operating System Security Settings | |
|---|
| Source: | Registry key created or modified: | Jump to behavior | ||
| Source: | Registry key created or modified: | Jump to behavior | ||
| Source: | Registry key created or modified: | Jump to behavior | ||
| Source: | Registry value created: | Jump to behavior | ||
| Source: | Registry value created: | Jump to behavior | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | 1 Scripting | Valid Accounts | 631 Windows Management Instrumentation | 1 Scripting | 12 Process Injection | 1 Masquerading | OS Credential Dumping | 731 Security Software Discovery | Remote Services | 1 Archive Collected Data | 21 Encrypted Channel | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
| Credentials | Domains | Default Accounts | 1 Native API | 1 DLL Side-Loading | 1 DLL Side-Loading | 1 Disable or Modify Tools | LSASS Memory | 53 Virtualization/Sandbox Evasion | Remote Desktop Protocol | 1 Browser Session Hijacking | 1 Ingress Tool Transfer | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | Logon Script (Windows) | 53 Virtualization/Sandbox Evasion | Security Account Manager | 2 Process Discovery | SMB/Windows Admin Shares | Data from Network Shared Drive | 2 Non-Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | 1 Modify Registry | NTDS | 1 Application Window Discovery | Distributed Component Object Model | Input Capture | 3 Application Layer Protocol | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | Network Logon Script | 12 Process Injection | LSA Secrets | 133 System Information Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
| Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | 1 Deobfuscate/Decode Files or Information | Cached Domain Credentials | Wi-Fi Discovery | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
| DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | 11 Obfuscated Files or Information | DCSync | Remote System Discovery | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
| Network Trust Dependencies | Serverless | Drive-by Compromise | Container Orchestration Job | Scheduled Task/Job | Scheduled Task/Job | 1 Software Packing | Proc Filesystem | System Owner/User Discovery | Cloud Services | Credential API Hooking | Application Layer Protocol | Exfiltration Over Alternative Protocol | Defacement |
| Network Topology | Malvertising | Exploit Public-Facing Application | Command and Scripting Interpreter | At | At | 1 DLL Side-Loading | /etc/passwd and /etc/shadow | Network Sniffing | Direct Cloud VM Connections | Data Staged | Web Protocols | Exfiltration Over Symmetric Encrypted Non-C2 Protocol | Internal Defacement |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 3% | Virustotal | Browse | ||
| 3% | ReversingLabs |
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 3% | Virustotal | Browse | ||
| 3% | ReversingLabs |
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | Virustotal | Browse |
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 1% | Virustotal | Browse | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Virustotal | Browse | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Virustotal | Browse | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| getscreen.me | 51.89.95.37 | true | true |
| unknown |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| false |
| unknown |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 78.47.165.25 | unknown | Germany | 24940 | HETZNER-ASDE | false | |
| 51.89.95.37 | getscreen.me | France | 16276 | OVHFR | true |
| Joe Sandbox version: | 40.0.0 Tourmaline |
| Analysis ID: | 1503397 |
| Start date and time: | 2024-09-03 14:41:14 +02:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 10m 38s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 128, Firefox 91, Adobe Reader DC 21, Java 8 Update 301 |
| Run name: | Suspected VM Detection |
| Number of analysed new started processes analysed: | 8 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Sample name: | getscreen-120727697-x86.exe |
| Detection: | MAL |
| Classification: | mal54.phis.evad.winEXE@8/5@2/2 |
| EGA Information: |
|
| HCA Information: | Failed |
| Cookbook Comments: |
|
- Connection to analysis system has been lost, crash info: Unknown
- Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, backgroundTaskHost.exe
- Excluded domains from analysis (whitelisted): ctldl.windowsupdate.com, c.pki.goog
- Report size getting too big, too many NtOpenKeyEx calls found.
- Report size getting too big, too many NtQueryValueKey calls found.
| Time | Type | Description |
|---|---|---|
| 08:43:25 | API Interceptor |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 78.47.165.25 | Get hash | malicious | Unknown | Browse | ||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| 51.89.95.37 | Get hash | malicious | Unknown | Browse | ||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| getscreen.me | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| HETZNER-ASDE | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | FormBook | Browse |
| ||
| OVHFR | Get hash | malicious | FormBook | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | AsyncRAT, Rezlt, StormKitty, VenomRAT, Vermin Keylogger, WorldWind Stealer, XWorm | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | FormBook | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | FormBook | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
|
⊘No context
⊘No context
| Process: | C:\Users\user\Desktop\getscreen-120727697-x86.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 64 |
| Entropy (8bit): | 5.78125 |
| Encrypted: | false |
| SSDEEP: | 3:BvF3qsDDWackos/TIOM+C8uzP:ypXkFRJuj |
| MD5: | EFB6D99CFEFFB4B681465A5C6FA71623 |
| SHA1: | D9D3231653A010BEB937AC50606D5D7689B0DEA0 |
| SHA-256: | 8AA160E3775FAD327B47F14D58FCFF2B29F3174D314546C89266B42F6746F878 |
| SHA-512: | 7DAEA4B0A9BA6AADFF14890E874BC60947D13CD1A05DF9CB559A1F46F1C3607DEA46FB8BBBF094C394CDB69EDFE96707D729B84A23EEE36D650835D4214DBA7B |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\ProgramData\Getscreen.me\rzrcqgspmqryvpnwupffnbzpjfygzjn-elevate.exe |
| File Type: | |
| Category: | modified |
| Size (bytes): | 4033 |
| Entropy (8bit): | 5.17666070990986 |
| Encrypted: | false |
| SSDEEP: | 96:bGNvekYUlsiAsMywsCeQvHc3QbtL77wsFosf3z0nhZ17PH8amiiP:6gkYbvZJos/whZ17PH8a9iP |
| MD5: | 749B5F85EA1623AC5723ED21C20E5FDC |
| SHA1: | 46A4132FA3D6B7CFCC1D86E6EC123845E6DB2D15 |
| SHA-256: | 80F4C32C9E53C1E5B6B9002D187E0BF06428AC2189F89A07FE1853343185A84E |
| SHA-512: | C6A1F3926FFA98C678162BEB625F3C1013AD565E4DACD6EEC5ECE36EF217F169A1A879B64995502FBB1A3BA142A1B035FFDD998CFE8FBA23E9E185CDE2AEA9DC |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Users\user\Desktop\getscreen-120727697-x86.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 3654440 |
| Entropy (8bit): | 7.931175093248247 |
| Encrypted: | false |
| SSDEEP: | 98304:w2WbzRq8h0oEPel9/DLRAHyGBydPnYMJojL5Np:w2ez4o0OmyVnvKLF |
| MD5: | 9C765958B4D463D04C41DEF1103AA1F2 |
| SHA1: | 987AC08A723A10F26C2D5E7270411585456596AF |
| SHA-256: | 41BC389B3188EAAFCC95F195774AF57E2FC72B05557539BBD61975D9F82286C5 |
| SHA-512: | 523526BEE9067845910E90888BBC1B704BACA0AC1F331F5B02CAD61A9BF868A5BC15F7D6C62956A8A3B4E8D36BD8FB07C0DEEA30314E1C9395A20FFD4B0B14EE |
| Malicious: | true |
| Antivirus: |
|
| Reputation: | low |
| Preview: |
C:\ProgramData\Getscreen.me\rzrcqgspmqryvpnwupffnbzpjfygzjn-elevate.exe:Zone.Identifier 
Download File
| Process: | C:\Users\user\Desktop\getscreen-120727697-x86.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 26 |
| Entropy (8bit): | 3.95006375643621 |
| Encrypted: | false |
| SSDEEP: | 3:ggPYV:rPYV |
| MD5: | 187F488E27DB4AF347237FE461A079AD |
| SHA1: | 6693BA299EC1881249D59262276A0D2CB21F8E64 |
| SHA-256: | 255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309 |
| SHA-512: | 89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E |
| Malicious: | true |
| Reputation: | high, very likely benign file |
| Preview: |
| Process: | C:\Users\user\Desktop\getscreen-120727697-x86.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 64 |
| Entropy (8bit): | 5.8125 |
| Encrypted: | false |
| SSDEEP: | 3:BvF3qsDDWackos/TIOMpFl8g:ypXkFROFz |
| MD5: | E444EE54DCA0021D3740527C9CEF7C38 |
| SHA1: | BF0776FBD10045A1411B62B75CD74D28B05D8328 |
| SHA-256: | 3833DC4C5BEAB75ACA4219D2FDF5795E234CD3CED75CBB056EB9CF3A24AB4C6B |
| SHA-512: | 0B043D2CE15E62A7B68082894A603978D53C3A6A37FE5CAA008764C49C3DC8B939C2B7DE0562C960A999CB621579D8835FF1620EF009088D2079A05284C3ECFD |
| Malicious: | false |
| Preview: |
| File type: | |
| Entropy (8bit): | 7.931175093248247 |
| TrID: |
|
| File name: | getscreen-120727697-x86.exe |
| File size: | 3'654'440 bytes |
| MD5: | 9c765958b4d463d04c41def1103aa1f2 |
| SHA1: | 987ac08a723a10f26c2d5e7270411585456596af |
| SHA256: | 41bc389b3188eaafcc95f195774af57e2fc72b05557539bbd61975d9f82286c5 |
| SHA512: | 523526bee9067845910e90888bbc1b704baca0ac1f331f5b02cad61a9bf868a5bc15f7d6c62956a8a3b4e8d36bd8fb07c0deea30314e1c9395a20ffd4b0b14ee |
| SSDEEP: | 98304:w2WbzRq8h0oEPel9/DLRAHyGBydPnYMJojL5Np:w2ez4o0OmyVnvKLF |
| TLSH: | 900633E1ED6939A1D33D5CB8111B56BD73FAA03658FE23C78A1D9B219E347028F52113 |
| File Content Preview: | MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$.......iI/.-(AD-(AD-(ADfPBE.(AD...D)(AD..EE5(AD9WEE.(AD-(AD./ADfPFE,(AD..BE3(AD..DE](ADfPEE.(ADfPDE.(ADfPGE/(ADfP@En(AD-(@D.*AD>.HE.(A |
 | |
| Icon Hash: | 418c6963696c9643 |
| Entrypoint: | 0x1b529e0 |
| Entrypoint Section: | UPX1 |
| Digitally signed: | true |
| Imagebase: | 0x400000 |
| Subsystem: | windows gui |
| Image File Characteristics: | EXECUTABLE_IMAGE, 32BIT_MACHINE |
| DLL Characteristics: | DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x66912FD6 [Fri Jul 12 13:29:58 2024 UTC] |
| TLS Callbacks: | 0x1b52bd3 |
| CLR (.Net) Version: | |
| OS Version Major: | 6 |
| OS Version Minor: | 0 |
| File Version Major: | 6 |
| File Version Minor: | 0 |
| Subsystem Version Major: | 6 |
| Subsystem Version Minor: | 0 |
| Import Hash: | 26c6aff4250b45d1c4ee6d86013ea70c |
| Signature Valid: | true |
| Signature Issuer: | CN=GlobalSign GCC R45 EV CodeSigning CA 2020, O=GlobalSign nv-sa, C=BE |
| Signature Validation Error: | The operation completed successfully |
| Error Number: | 0 |
| Not Before, Not After |
|
| Subject Chain |
|
| Version: | 3 |
| Thumbprint MD5: | 9B083870477F4699693EEECABF351BF8 |
| Thumbprint SHA-1: | B3C999E29AED18DEA59733F3CAA94E788B1AC3A1 |
| Thumbprint SHA-256: | 3E73B7C28C18DC6A03B9816F200365F1DF1FF80A7BD0D55DB920F1B24BBD74E7 |
| Serial: | 7AE0E9C1CFE2DCE0E21C4327 |
| Instruction |
|---|
| pushad |
| mov esi, 017DE000h |
| lea edi, dword ptr [esi-013DD000h] |
| push edi |
| or ebp, FFFFFFFFh |
| jmp 00007F6B44E41A82h |
| nop |
| nop |
| nop |
| nop |
| nop |
| nop |
| mov al, byte ptr [esi] |
| inc esi |
| mov byte ptr [edi], al |
| inc edi |
| add ebx, ebx |
| jne 00007F6B44E41A79h |
| mov ebx, dword ptr [esi] |
| sub esi, FFFFFFFCh |
| adc ebx, ebx |
| jc 00007F6B44E41A5Fh |
| mov eax, 00000001h |
| add ebx, ebx |
| jne 00007F6B44E41A79h |
| mov ebx, dword ptr [esi] |
| sub esi, FFFFFFFCh |
| adc ebx, ebx |
| adc eax, eax |
| add ebx, ebx |
| jnc 00007F6B44E41A7Dh |
| jne 00007F6B44E41A9Ah |
| mov ebx, dword ptr [esi] |
| sub esi, FFFFFFFCh |
| adc ebx, ebx |
| jc 00007F6B44E41A91h |
| dec eax |
| add ebx, ebx |
| jne 00007F6B44E41A79h |
| mov ebx, dword ptr [esi] |
| sub esi, FFFFFFFCh |
| adc ebx, ebx |
| adc eax, eax |
| jmp 00007F6B44E41A46h |
| add ebx, ebx |
| jne 00007F6B44E41A79h |
| mov ebx, dword ptr [esi] |
| sub esi, FFFFFFFCh |
| adc ebx, ebx |
| adc ecx, ecx |
| jmp 00007F6B44E41AC4h |
| xor ecx, ecx |
| sub eax, 03h |
| jc 00007F6B44E41A83h |
| shl eax, 08h |
| mov al, byte ptr [esi] |
| inc esi |
| xor eax, FFFFFFFFh |
| je 00007F6B44E41AE7h |
| sar eax, 1 |
| mov ebp, eax |
| jmp 00007F6B44E41A7Dh |
| add ebx, ebx |
| jne 00007F6B44E41A79h |
| mov ebx, dword ptr [esi] |
| sub esi, FFFFFFFCh |
| adc ebx, ebx |
| jc 00007F6B44E41A3Eh |
| inc ecx |
| add ebx, ebx |
| jne 00007F6B44E41A79h |
| mov ebx, dword ptr [esi] |
| sub esi, FFFFFFFCh |
| adc ebx, ebx |
| jc 00007F6B44E41A30h |
| add ebx, ebx |
| jne 00007F6B44E41A79h |
| mov ebx, dword ptr [esi] |
| sub esi, FFFFFFFCh |
| adc ebx, ebx |
| adc ecx, ecx |
| add ebx, ebx |
| jnc 00007F6B44E41A61h |
| jne 00007F6B44E41A7Bh |
| mov ebx, dword ptr [esi] |
| sub esi, FFFFFFFCh |
| adc ebx, ebx |
| jnc 00007F6B44E41A56h |
| add ecx, 02h |
| cmp ebp, FFFFFB00h |
| adc ecx, 02h |
| lea edx, dword ptr [eax+eax] |
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x820d90 | 0x5500 | UPX0 |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0x1756a50 | 0x6c0 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x1753000 | 0x3a50 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x379400 | 0x2f28 | UPX0 |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x1757110 | 0x20 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0x1752bf4 | 0x18 | UPX1 |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x1752c3c | 0xc0 | UPX1 |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| UPX0 | 0x1000 | 0x13dd000 | 0x0 | d41d8cd98f00b204e9800998ecf8427e | unknown | unknown | unknown | unknown | IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| UPX1 | 0x13de000 | 0x375000 | 0x374e00 | a216f7d1a8e4e14b94fdfbca52f7b652 | unknown | unknown | unknown | unknown | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .rsrc | 0x1753000 | 0x5000 | 0x4200 | 5871e1397e577651929aa76b50980e16 | False | 0.4675662878787879 | data | 5.104875966236682 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| AFX_DIALOG_LAYOUT | 0x168ca98 | 0x2 | ASCII text, with no line terminators | Russian | Russia | 5.0 |
| AFX_DIALOG_LAYOUT | 0x168caa0 | 0x2 | Non-ISO extended-ASCII text, with no line terminators | Russian | Russia | 5.0 |
| AFX_DIALOG_LAYOUT | 0x168cb08 | 0x2 | ISO-8859 text, with no line terminators | Russian | Russia | 5.0 |
| AFX_DIALOG_LAYOUT | 0x16d4db0 | 0x2 | ASCII text, with no line terminators | 5.0 | ||
| AFX_DIALOG_LAYOUT | 0x168caa8 | 0x2 | ISO-8859 text, with CR line terminators | Russian | Russia | 5.0 |
| AFX_DIALOG_LAYOUT | 0x168cb00 | 0x2 | ISO-8859 text, with no line terminators | Russian | Russia | 5.0 |
| AFX_DIALOG_LAYOUT | 0x168cb10 | 0x2a | DOS executable (COM, 0x8C-variant) | Russian | Russia | 1.2142857142857142 |
| AFX_DIALOG_LAYOUT | 0x168cb40 | 0x22 | data | Russian | Russia | 1.2647058823529411 |
| AFX_DIALOG_LAYOUT | 0x168cb68 | 0x22 | data | Russian | Russia | 1.2647058823529411 |
| AFX_DIALOG_LAYOUT | 0x168cb90 | 0x22 | data | Russian | Russia | 1.2647058823529411 |
| AFX_DIALOG_LAYOUT | 0x168cbb8 | 0x22 | data | Russian | Russia | 1.2647058823529411 |
| AFX_DIALOG_LAYOUT | 0x168cbe0 | 0x2a | data | Russian | Russia | 1.2142857142857142 |
| AFX_DIALOG_LAYOUT | 0x168cc10 | 0x2 | ASCII text, with no line terminators | Russian | Russia | 5.0 |
| AFX_DIALOG_LAYOUT | 0x168cc28 | 0x2 | ISO-8859 text, with no line terminators | Russian | Russia | 5.0 |
| AFX_DIALOG_LAYOUT | 0x168cc20 | 0x2 | data | Russian | Russia | 5.0 |
| AFX_DIALOG_LAYOUT | 0x168cc18 | 0x2 | ASCII text | Russian | Russia | 5.0 |
| AFX_DIALOG_LAYOUT | 0x168cc30 | 0x2 | ISO-8859 text, with no line terminators | Russian | Russia | 5.0 |
| AFX_DIALOG_LAYOUT | 0x168cc38 | 0x2 | ASCII text, with no line terminators | Russian | Russia | 5.0 |
| AFX_DIALOG_LAYOUT | 0x168cc40 | 0x2 | ISO-8859 text, with no line terminators | Russian | Russia | 5.0 |
| AFX_DIALOG_LAYOUT | 0x16d4ff0 | 0x2 | ISO-8859 text, with no line terminators | English | United States | 5.0 |
| AFX_DIALOG_LAYOUT | 0x168cc48 | 0x2 | ISO-8859 text, with no line terminators | Russian | Russia | 5.0 |
| AFX_DIALOG_LAYOUT | 0x168cc50 | 0x2 | data | Russian | Russia | 5.0 |
| AFX_DIALOG_LAYOUT | 0x168cc58 | 0x2 | data | Russian | Russia | 5.0 |
| AFX_DIALOG_LAYOUT | 0x168cc60 | 0x2 | ISO-8859 text, with no line terminators | Russian | Russia | 5.0 |
| AFX_DIALOG_LAYOUT | 0x168cc68 | 0x2 | data | Russian | Russia | 5.0 |
| AFX_DIALOG_LAYOUT | 0x168cc70 | 0x2 | ISO-8859 text, with no line terminators | Russian | Russia | 5.0 |
| AFX_DIALOG_LAYOUT | 0x168cab0 | 0x42 | data | Russian | Russia | 1.1666666666666667 |
| AFX_DIALOG_LAYOUT | 0x168caf8 | 0x2 | ISO-8859 text, with no line terminators | Russian | Russia | 5.0 |
| AFX_DIALOG_LAYOUT | 0x168cc78 | 0x2 | ISO-8859 text, with no line terminators, with overstriking | Russian | Russia | 5.0 |
| INI | 0x16d3a18 | 0xa | data | Russian | Russia | 1.8 |
| LANG | 0x16ace60 | 0x1b82 | data | Russian | Russia | 0.8660891792104516 |
| LANG | 0x16ae9e8 | 0x26fb | data | Russian | Russia | 0.950796673013328 |
| LANG | 0x16b10e8 | 0x1e2b | data | Russian | Russia | 0.9835556131037162 |
| LANG | 0x16b2f18 | 0x1e5d | data | Russian | Russia | 0.9994853981731635 |
| LANG | 0x16b4d78 | 0x1ca1 | data | Russian | Russia | 0.9953608950743621 |
| LANG | 0x16b6a20 | 0x21fd | data | Russian | Russia | 0.983794966095851 |
| LANG | 0x16b8c20 | 0x1de4 | data | Russian | Russia | 0.9225039205436487 |
| LANG | 0x16baa08 | 0x1a50 | data | Russian | Russia | 0.962143705463183 |
| LANG | 0x16bc458 | 0x1d25 | data | Russian | Russia | 0.9987937273823885 |
| LANG | 0x16be180 | 0x1e03 | data | Russian | Russia | 0.9980476376415462 |
| LANG | 0x16e7c38 | 0x1ddc | data | English | United States | 0.9955520669806384 |
| OPUS | 0x16bff88 | 0xa5e5 | data | Russian | Russia | 0.9886505451034873 |
| OPUS | 0x16ca570 | 0x94a4 | data | Russian | Russia | 0.978082623777988 |
| RT_ICON | 0x168cc80 | 0x139 | data | Russian | Russia | 1.035143769968051 |
| RT_ICON | 0x168cdc0 | 0x1ef | data | Russian | Russia | 1.0222222222222221 |
| RT_ICON | 0x168cfb0 | 0x225 | data | Russian | Russia | 1.0200364298724955 |
| RT_ICON | 0x168d1d8 | 0x26b | OpenPGP Public Key | Russian | Russia | 1.0177705977382876 |
| RT_ICON | 0x168d448 | 0x326 | data | Russian | Russia | 1.0136476426799008 |
| RT_ICON | 0x168d770 | 0x402 | data | Russian | Russia | 1.010721247563353 |
| RT_ICON | 0x17550f0 | 0x13b | PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced | Russian | Russia | 1.034920634920635 |
| RT_ICON | 0x1755230 | 0x1c5 | PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced | Russian | Russia | 1.0242825607064017 |
| RT_ICON | 0x17553fc | 0x1ee | PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced | Russian | Russia | 1.0222672064777327 |
| RT_ICON | 0x17555f0 | 0x253 | PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced | Russian | Russia | 1.0184873949579831 |
| RT_ICON | 0x1755848 | 0x2e7 | PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced | Russian | Russia | 1.0148048452220726 |
| RT_ICON | 0x1755b34 | 0x3ad | PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced | Russian | Russia | 1.0116896918172158 |
| RT_ICON | 0x168ea20 | 0xac | data | Russian | Russia | 1.063953488372093 |
| RT_ICON | 0x168eae8 | 0x159 | data | Russian | Russia | 1.0318840579710145 |
| RT_ICON | 0x168ec48 | 0x1e6 | data | Russian | Russia | 1.022633744855967 |
| RT_ICON | 0x168ee30 | 0x1f6 | data | Russian | Russia | 1.0219123505976095 |
| RT_ICON | 0x168f028 | 0x26d | data | Russian | Russia | 1.0177133655394526 |
| RT_ICON | 0x168f298 | 0x31b | data | Russian | Russia | 1.0138364779874214 |
| RT_ICON | 0x168f5b8 | 0x3e7 | data | Russian | Russia | 1.011011011011011 |
| RT_ICON | 0x168fa00 | 0xdd | DOS executable (COM) | Russian | Russia | 1.0497737556561086 |
| RT_ICON | 0x168faf8 | 0x10f | data | Russian | Russia | 1.040590405904059 |
| RT_ICON | 0x168fc20 | 0x25a8 | data | Russian | Russia | 0.999896265560166 |
| RT_ICON | 0x16921e0 | 0x12d | data | Russian | Russia | 1.0365448504983388 |
| RT_ICON | 0x1692328 | 0x106 | data | Russian | Russia | 1.0419847328244274 |
| RT_ICON | 0x1692448 | 0x109 | data | Russian | Russia | 1.0415094339622641 |
| RT_ICON | 0x1692570 | 0x171 | data | Russian | Russia | 1.029810298102981 |
| RT_ICON | 0x1692700 | 0x109d | data | Russian | Russia | 1.0025864095932282 |
| RT_ICON | 0x16937b8 | 0xdd9 | data | Russian | Russia | 1.0031029619181946 |
| RT_ICON | 0x16945b0 | 0xc0e | data | Russian | Russia | 1.0035644847699288 |
| RT_ICON | 0x16951d8 | 0xb91 | data | Russian | Russia | 1.0037149611617697 |
| RT_ICON | 0x1695d88 | 0xdd9 | data | Russian | Russia | 1.0031029619181946 |
| RT_ICON | 0x1696b80 | 0x11c | data | Russian | Russia | 1.0387323943661972 |
| RT_ICON | 0x1696cb8 | 0x116 | data | Russian | Russia | 1.039568345323741 |
| RT_ICON | 0x1696de8 | 0x1c4 | data | Russian | Russia | 1.0243362831858407 |
| RT_ICON | 0x1696fc8 | 0x1a1 | data | Russian | Russia | 1.026378896882494 |
| RT_ICON | 0x1697188 | 0x182 | data | Russian | Russia | 1.028497409326425 |
| RT_ICON | 0x1697328 | 0x222 | data | Russian | Russia | 1.02014652014652 |
| RT_ICON | 0x1697568 | 0x11f | OpenPGP Secret Key | Russian | Russia | 1.038327526132404 |
| RT_ICON | 0x16976a0 | 0x103 | data | Russian | Russia | 1.0424710424710424 |
| RT_ICON | 0x16977c0 | 0x1588 | data | Russian | Russia | 1.0019956458635704 |
| RT_ICON | 0x1698d60 | 0x580 | data | Russian | Russia | 1.0078125 |
| RT_ICON | 0x16992f8 | 0x988 | data | Russian | Russia | 1.0045081967213114 |
| RT_ICON | 0x1699c98 | 0x25a8 | data | Russian | Russia | 0.9986514522821577 |
| RT_ICON | 0x169c258 | 0x10828 | data | Russian | Russia | 0.9908316573997398 |
| RT_ICON | 0x16d3a28 | 0x163 | data | 1.0309859154929577 | ||
| RT_ICON | 0x16d3b90 | 0x20d | data | 1.020952380952381 | ||
| RT_ICON | 0x16d3da0 | 0x21b | data | 1.0148423005565863 | ||
| RT_ICON | 0x16d3fc0 | 0x282 | data | 1.017133956386293 | ||
| RT_ICON | 0x16d4248 | 0x33c | data | 1.0132850241545894 | ||
| RT_ICON | 0x16d4588 | 0x413 | data | 1.0105465004793863 | ||
| RT_ICON | 0x16d4a00 | 0x152 | data | 0.9792899408284024 | ||
| RT_ICON | 0x16d4ff8 | 0x10a8 | data | English | United States | 0.9798311444652908 |
| RT_ICON | 0x16d60b8 | 0x988 | data | English | United States | 1.0045081967213114 |
| RT_ICON | 0x16d6a58 | 0x988 | data | English | United States | 0.9721311475409836 |
| RT_ICON | 0x16d73f8 | 0x10828 | data | English | United States | 0.9158286998698687 |
| RT_MENU | 0x16d4b70 | 0xf8 | data | 1.0161290322580645 | ||
| RT_MENU | 0x16acd20 | 0xd2 | data | Russian | Russia | 1.0523809523809524 |
| RT_MENU | 0x16acdf8 | 0x66 | data | Russian | Russia | 1.088235294117647 |
| RT_MENU | 0x16d4c68 | 0x46 | data | 1.1571428571428573 | ||
| RT_DIALOG | 0x168a0f0 | 0x490 | data | Russian | Russia | 1.009417808219178 |
| RT_DIALOG | 0x168a580 | 0x78 | data | Russian | Russia | 1.0916666666666666 |
| RT_DIALOG | 0x16d4cb0 | 0x100 | data | 0.9765625 | ||
| RT_DIALOG | 0x168a5f8 | 0x1f8 | data | Russian | Russia | 1.0218253968253967 |
| RT_DIALOG | 0x168acb0 | 0x190 | data | Russian | Russia | 1.0275 |
| RT_DIALOG | 0x168ae40 | 0x154 | data | Russian | Russia | 1.0323529411764707 |
| RT_DIALOG | 0x168af98 | 0xf4 | data | Russian | Russia | 1.0450819672131149 |
| RT_DIALOG | 0x168b090 | 0x12c | data | Russian | Russia | 1.0366666666666666 |
| RT_DIALOG | 0x168b1c0 | 0x110 | data | Russian | Russia | 1.0404411764705883 |
| RT_DIALOG | 0x168b2d0 | 0x128 | data | Russian | Russia | 1.037162162162162 |
| RT_DIALOG | 0x168b3f8 | 0x154 | data | Russian | Russia | 1.0323529411764707 |
| RT_DIALOG | 0x168b550 | 0x7e | data | Russian | Russia | 1.0873015873015872 |
| RT_DIALOG | 0x168b808 | 0x148 | data | Russian | Russia | 1.0335365853658536 |
| RT_DIALOG | 0x168b738 | 0xd0 | data | Russian | Russia | 1.0528846153846154 |
| RT_DIALOG | 0x168b5d0 | 0x164 | data | Russian | Russia | 1.0308988764044944 |
| RT_DIALOG | 0x168b950 | 0x14c | data | Russian | Russia | 1.033132530120482 |
| RT_DIALOG | 0x168baa0 | 0x1f0 | data | Russian | Russia | 1.0221774193548387 |
| RT_DIALOG | 0x168bc90 | 0x284 | data | Russian | Russia | 1.0170807453416149 |
| RT_DIALOG | 0x16d4db8 | 0x232 | data | English | United States | 1.019572953736655 |
| RT_DIALOG | 0x168bf18 | 0x182 | data | Russian | Russia | 1.0129533678756477 |
| RT_DIALOG | 0x168c0a0 | 0x68 | data | Russian | Russia | 1.1057692307692308 |
| RT_DIALOG | 0x168c108 | 0x1f8 | DOS executable (COM, 0x8C-variant) | Russian | Russia | 1.0218253968253967 |
| RT_DIALOG | 0x168c300 | 0x218 | data | Russian | Russia | 1.0205223880597014 |
| RT_DIALOG | 0x168c518 | 0x2ba | data | Russian | Russia | 1.015759312320917 |
| RT_DIALOG | 0x168c7d8 | 0x242 | data | Russian | Russia | 1.019031141868512 |
| RT_DIALOG | 0x168a7f0 | 0x21c | data | Russian | Russia | 1.0203703703703704 |
| RT_DIALOG | 0x168aa10 | 0x29a | data | Russian | Russia | 1.0165165165165164 |
| RT_DIALOG | 0x168ca20 | 0x72 | OpenPGP Secret Key | Russian | Russia | 1.0964912280701755 |
| RT_STRING | 0x16e9a18 | 0x38 | data | Russian | Russia | 1.1964285714285714 |
| RT_GROUP_ICON | 0x1755ee8 | 0x5a | data | Russian | Russia | 0.8 |
| RT_GROUP_ICON | 0x168db78 | 0x5a | data | Russian | Russia | 1.1222222222222222 |
| RT_GROUP_ICON | 0x16d49a0 | 0x5a | data | 1.1222222222222222 | ||
| RT_GROUP_ICON | 0x16977a8 | 0x14 | data | Russian | Russia | 1.4 |
| RT_GROUP_ICON | 0x168ead0 | 0x14 | data | Russian | Russia | 1.4 |
| RT_GROUP_ICON | 0x168f9a0 | 0x5a | data | Russian | Russia | 1.1222222222222222 |
| RT_GROUP_ICON | 0x1698d48 | 0x14 | Non-ISO extended-ASCII text, with CR line terminators | Russian | Russia | 1.45 |
| RT_GROUP_ICON | 0x168fae0 | 0x14 | data | Russian | Russia | 1.45 |
| RT_GROUP_ICON | 0x168fc08 | 0x14 | data | Russian | Russia | 1.2 |
| RT_GROUP_ICON | 0x16921c8 | 0x14 | Non-ISO extended-ASCII text, with LF, NEL line terminators | Russian | Russia | 1.4 |
| RT_GROUP_ICON | 0x16d4b58 | 0x14 | Non-ISO extended-ASCII text, with no line terminators | 1.4 | ||
| RT_GROUP_ICON | 0x1692310 | 0x14 | data | Russian | Russia | 1.4 |
| RT_GROUP_ICON | 0x1692430 | 0x14 | locale data table | Russian | Russia | 1.4 |
| RT_GROUP_ICON | 0x1692558 | 0x14 | International EBCDIC text, with NEL line terminators | Russian | Russia | 1.45 |
| RT_GROUP_ICON | 0x16926e8 | 0x14 | data | Russian | Russia | 1.4 |
| RT_GROUP_ICON | 0x16937a0 | 0x14 | Non-ISO extended-ASCII text, with no line terminators, with overstriking | Russian | Russia | 1.45 |
| RT_GROUP_ICON | 0x1694598 | 0x14 | data | Russian | Russia | 1.45 |
| RT_GROUP_ICON | 0x16951c0 | 0x14 | Non-ISO extended-ASCII text, with no line terminators | Russian | Russia | 1.4 |
| RT_GROUP_ICON | 0x1695d70 | 0x14 | data | Russian | Russia | 1.45 |
| RT_GROUP_ICON | 0x1696b68 | 0x14 | data | Russian | Russia | 1.4 |
| RT_GROUP_ICON | 0x1696ca0 | 0x14 | data | Russian | Russia | 1.4 |
| RT_GROUP_ICON | 0x1696dd0 | 0x14 | data | Russian | Russia | 1.45 |
| RT_GROUP_ICON | 0x1696fb0 | 0x14 | data | Russian | Russia | 1.45 |
| RT_GROUP_ICON | 0x1697170 | 0x14 | data | Russian | Russia | 1.45 |
| RT_GROUP_ICON | 0x1697310 | 0x14 | data | Russian | Russia | 1.45 |
| RT_GROUP_ICON | 0x1697550 | 0x14 | data | Russian | Russia | 1.45 |
| RT_GROUP_ICON | 0x1697688 | 0x14 | data | Russian | Russia | 1.4 |
| RT_GROUP_ICON | 0x16992e0 | 0x14 | data | Russian | Russia | 1.45 |
| RT_GROUP_ICON | 0x1699c80 | 0x14 | data | Russian | Russia | 1.45 |
| RT_GROUP_ICON | 0x16d60a0 | 0x14 | data | English | United States | 1.45 |
| RT_GROUP_ICON | 0x169c240 | 0x14 | data | Russian | Russia | 1.45 |
| RT_GROUP_ICON | 0x16aca80 | 0x14 | data | Russian | Russia | 1.45 |
| RT_GROUP_ICON | 0x16d6a40 | 0x14 | data | English | United States | 1.4 |
| RT_GROUP_ICON | 0x16d73e0 | 0x14 | data | English | United States | 1.45 |
| RT_GROUP_ICON | 0x16e7c20 | 0x14 | data | English | United States | 1.45 |
| RT_VERSION | 0x1755f48 | 0x284 | data | Russian | Russia | 0.468944099378882 |
| RT_MANIFEST | 0x17561d0 | 0x87f | XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (2115), with CRLF line terminators | English | United States | 0.31264367816091954 |
| DLL | Import |
|---|---|
| ADVAPI32.dll | FreeSid |
| COMCTL32.dll | _TrackMouseEvent |
| d3d11.dll | D3D11CreateDevice |
| dbghelp.dll | StackWalk |
| dxgi.dll | CreateDXGIFactory1 |
| GDI32.dll | LineTo |
| gdiplus.dll | GdipFree |
| IPHLPAPI.DLL | GetIfEntry2 |
| KERNEL32.DLL | LoadLibraryA, ExitProcess, GetProcAddress, VirtualProtect |
| MPR.dll | WNetGetConnectionW |
| msdmo.dll | MoInitMediaType |
| NETAPI32.dll | NetUserGetInfo |
| ntdll.dll | RtlGetVersion |
| NTDSAPI.dll | DsMakeSpnW |
| ole32.dll | OleCreate |
| OLEAUT32.dll | SysFreeString |
| POWRPROF.dll | PowerGetActiveScheme |
| RPCRT4.dll | UuidEqual |
| SAS.dll | SendSAS |
| Secur32.dll | FreeCredentialsHandle |
| SHELL32.dll | |
| SHLWAPI.dll | PathFileExistsA |
| USER32.dll | GetDC |
| USERENV.dll | CreateEnvironmentBlock |
| UxTheme.dll | IsThemeActive |
| VERSION.dll | VerQueryValueW |
| WINHTTP.dll | WinHttpOpen |
| WINMM.dll | waveInOpen |
| WINSPOOL.DRV | GetPrinterW |
| WS2_32.dll | WSASetLastError |
| WTSAPI32.dll | WTSFreeMemory |
| Language of compilation system | Country where language is spoken | Map |
|---|---|---|
| Russian | Russia |  |
| English | United States |  |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Sep 3, 2024 14:43:26.308003902 CEST | 49748 | 443 | 192.168.11.20 | 51.89.95.37 |
| Sep 3, 2024 14:43:26.308024883 CEST | 443 | 49748 | 51.89.95.37 | 192.168.11.20 |
| Sep 3, 2024 14:43:26.308335066 CEST | 49748 | 443 | 192.168.11.20 | 51.89.95.37 |
| Sep 3, 2024 14:43:26.308608055 CEST | 49748 | 443 | 192.168.11.20 | 51.89.95.37 |
| Sep 3, 2024 14:43:26.308619022 CEST | 443 | 49748 | 51.89.95.37 | 192.168.11.20 |
| Sep 3, 2024 14:43:26.812908888 CEST | 443 | 49748 | 51.89.95.37 | 192.168.11.20 |
| Sep 3, 2024 14:43:26.813476086 CEST | 49748 | 443 | 192.168.11.20 | 51.89.95.37 |
| Sep 3, 2024 14:43:26.813504934 CEST | 443 | 49748 | 51.89.95.37 | 192.168.11.20 |
| Sep 3, 2024 14:43:26.817676067 CEST | 443 | 49748 | 51.89.95.37 | 192.168.11.20 |
| Sep 3, 2024 14:43:26.817852974 CEST | 49748 | 443 | 192.168.11.20 | 51.89.95.37 |
| Sep 3, 2024 14:43:26.819153070 CEST | 49748 | 443 | 192.168.11.20 | 51.89.95.37 |
| Sep 3, 2024 14:43:26.819364071 CEST | 443 | 49748 | 51.89.95.37 | 192.168.11.20 |
| Sep 3, 2024 14:43:26.819628000 CEST | 49748 | 443 | 192.168.11.20 | 51.89.95.37 |
| Sep 3, 2024 14:43:26.819658995 CEST | 443 | 49748 | 51.89.95.37 | 192.168.11.20 |
| Sep 3, 2024 14:43:26.866641045 CEST | 49748 | 443 | 192.168.11.20 | 51.89.95.37 |
| Sep 3, 2024 14:43:27.292135000 CEST | 443 | 49748 | 51.89.95.37 | 192.168.11.20 |
| Sep 3, 2024 14:43:27.292201042 CEST | 443 | 49748 | 51.89.95.37 | 192.168.11.20 |
| Sep 3, 2024 14:43:27.292383909 CEST | 49748 | 443 | 192.168.11.20 | 51.89.95.37 |
| Sep 3, 2024 14:43:27.969671011 CEST | 49748 | 443 | 192.168.11.20 | 51.89.95.37 |
| Sep 3, 2024 14:43:27.969691992 CEST | 443 | 49748 | 51.89.95.37 | 192.168.11.20 |
| Sep 3, 2024 14:43:27.969772100 CEST | 49748 | 443 | 192.168.11.20 | 51.89.95.37 |
| Sep 3, 2024 14:43:27.969788074 CEST | 443 | 49748 | 51.89.95.37 | 192.168.11.20 |
| Sep 3, 2024 14:43:38.976334095 CEST | 49749 | 443 | 192.168.11.20 | 51.89.95.37 |
| Sep 3, 2024 14:43:38.976357937 CEST | 443 | 49749 | 51.89.95.37 | 192.168.11.20 |
| Sep 3, 2024 14:43:38.976660967 CEST | 49749 | 443 | 192.168.11.20 | 51.89.95.37 |
| Sep 3, 2024 14:43:38.976886988 CEST | 49749 | 443 | 192.168.11.20 | 51.89.95.37 |
| Sep 3, 2024 14:43:38.976898909 CEST | 443 | 49749 | 51.89.95.37 | 192.168.11.20 |
| Sep 3, 2024 14:43:39.460633993 CEST | 443 | 49749 | 51.89.95.37 | 192.168.11.20 |
| Sep 3, 2024 14:43:39.461184025 CEST | 49749 | 443 | 192.168.11.20 | 51.89.95.37 |
| Sep 3, 2024 14:43:39.461194038 CEST | 443 | 49749 | 51.89.95.37 | 192.168.11.20 |
| Sep 3, 2024 14:43:39.462165117 CEST | 443 | 49749 | 51.89.95.37 | 192.168.11.20 |
| Sep 3, 2024 14:43:39.462397099 CEST | 49749 | 443 | 192.168.11.20 | 51.89.95.37 |
| Sep 3, 2024 14:43:39.463151932 CEST | 49749 | 443 | 192.168.11.20 | 51.89.95.37 |
| Sep 3, 2024 14:43:39.463252068 CEST | 443 | 49749 | 51.89.95.37 | 192.168.11.20 |
| Sep 3, 2024 14:43:39.463562965 CEST | 49749 | 443 | 192.168.11.20 | 51.89.95.37 |
| Sep 3, 2024 14:43:39.463572979 CEST | 443 | 49749 | 51.89.95.37 | 192.168.11.20 |
| Sep 3, 2024 14:43:39.504535913 CEST | 49749 | 443 | 192.168.11.20 | 51.89.95.37 |
| Sep 3, 2024 14:43:39.988579035 CEST | 443 | 49749 | 51.89.95.37 | 192.168.11.20 |
| Sep 3, 2024 14:43:39.988857985 CEST | 443 | 49749 | 51.89.95.37 | 192.168.11.20 |
| Sep 3, 2024 14:43:39.988989115 CEST | 49749 | 443 | 192.168.11.20 | 51.89.95.37 |
| Sep 3, 2024 14:43:39.990447044 CEST | 49749 | 443 | 192.168.11.20 | 51.89.95.37 |
| Sep 3, 2024 14:43:39.990447998 CEST | 49749 | 443 | 192.168.11.20 | 51.89.95.37 |
| Sep 3, 2024 14:43:39.990515947 CEST | 443 | 49749 | 51.89.95.37 | 192.168.11.20 |
| Sep 3, 2024 14:43:39.990540028 CEST | 443 | 49749 | 51.89.95.37 | 192.168.11.20 |
| Sep 3, 2024 14:43:58.004472017 CEST | 49752 | 443 | 192.168.11.20 | 51.89.95.37 |
| Sep 3, 2024 14:43:58.004502058 CEST | 443 | 49752 | 51.89.95.37 | 192.168.11.20 |
| Sep 3, 2024 14:43:58.004797935 CEST | 49752 | 443 | 192.168.11.20 | 51.89.95.37 |
| Sep 3, 2024 14:43:58.005018950 CEST | 49752 | 443 | 192.168.11.20 | 51.89.95.37 |
| Sep 3, 2024 14:43:58.005033016 CEST | 443 | 49752 | 51.89.95.37 | 192.168.11.20 |
| Sep 3, 2024 14:43:58.474735022 CEST | 443 | 49752 | 51.89.95.37 | 192.168.11.20 |
| Sep 3, 2024 14:43:58.475198030 CEST | 49752 | 443 | 192.168.11.20 | 51.89.95.37 |
| Sep 3, 2024 14:43:58.475217104 CEST | 443 | 49752 | 51.89.95.37 | 192.168.11.20 |
| Sep 3, 2024 14:43:58.476656914 CEST | 443 | 49752 | 51.89.95.37 | 192.168.11.20 |
| Sep 3, 2024 14:43:58.476875067 CEST | 49752 | 443 | 192.168.11.20 | 51.89.95.37 |
| Sep 3, 2024 14:43:58.477626085 CEST | 49752 | 443 | 192.168.11.20 | 51.89.95.37 |
| Sep 3, 2024 14:43:58.477772951 CEST | 443 | 49752 | 51.89.95.37 | 192.168.11.20 |
| Sep 3, 2024 14:43:58.477938890 CEST | 49752 | 443 | 192.168.11.20 | 51.89.95.37 |
| Sep 3, 2024 14:43:58.477962017 CEST | 443 | 49752 | 51.89.95.37 | 192.168.11.20 |
| Sep 3, 2024 14:43:58.531778097 CEST | 49752 | 443 | 192.168.11.20 | 51.89.95.37 |
| Sep 3, 2024 14:43:58.990669966 CEST | 443 | 49752 | 51.89.95.37 | 192.168.11.20 |
| Sep 3, 2024 14:43:58.990916014 CEST | 443 | 49752 | 51.89.95.37 | 192.168.11.20 |
| Sep 3, 2024 14:43:58.991089106 CEST | 49752 | 443 | 192.168.11.20 | 51.89.95.37 |
| Sep 3, 2024 14:43:58.992280006 CEST | 49752 | 443 | 192.168.11.20 | 51.89.95.37 |
| Sep 3, 2024 14:43:58.992347002 CEST | 443 | 49752 | 51.89.95.37 | 192.168.11.20 |
| Sep 3, 2024 14:43:58.992386103 CEST | 49752 | 443 | 192.168.11.20 | 51.89.95.37 |
| Sep 3, 2024 14:43:58.992414951 CEST | 443 | 49752 | 51.89.95.37 | 192.168.11.20 |
| Sep 3, 2024 14:44:04.860835075 CEST | 49753 | 443 | 192.168.11.20 | 51.89.95.37 |
| Sep 3, 2024 14:44:04.860872030 CEST | 443 | 49753 | 51.89.95.37 | 192.168.11.20 |
| Sep 3, 2024 14:44:04.861089945 CEST | 49753 | 443 | 192.168.11.20 | 51.89.95.37 |
| Sep 3, 2024 14:44:04.861337900 CEST | 49753 | 443 | 192.168.11.20 | 51.89.95.37 |
| Sep 3, 2024 14:44:04.861357927 CEST | 443 | 49753 | 51.89.95.37 | 192.168.11.20 |
| Sep 3, 2024 14:44:05.347266912 CEST | 443 | 49753 | 51.89.95.37 | 192.168.11.20 |
| Sep 3, 2024 14:44:05.347877026 CEST | 49753 | 443 | 192.168.11.20 | 51.89.95.37 |
| Sep 3, 2024 14:44:05.347898960 CEST | 443 | 49753 | 51.89.95.37 | 192.168.11.20 |
| Sep 3, 2024 14:44:05.349615097 CEST | 443 | 49753 | 51.89.95.37 | 192.168.11.20 |
| Sep 3, 2024 14:44:05.349970102 CEST | 49753 | 443 | 192.168.11.20 | 51.89.95.37 |
| Sep 3, 2024 14:44:05.350733995 CEST | 49753 | 443 | 192.168.11.20 | 51.89.95.37 |
| Sep 3, 2024 14:44:05.350925922 CEST | 443 | 49753 | 51.89.95.37 | 192.168.11.20 |
| Sep 3, 2024 14:44:05.351228952 CEST | 49753 | 443 | 192.168.11.20 | 51.89.95.37 |
| Sep 3, 2024 14:44:05.351252079 CEST | 443 | 49753 | 51.89.95.37 | 192.168.11.20 |
| Sep 3, 2024 14:44:05.405177116 CEST | 49753 | 443 | 192.168.11.20 | 51.89.95.37 |
| Sep 3, 2024 14:44:05.907071114 CEST | 443 | 49753 | 51.89.95.37 | 192.168.11.20 |
| Sep 3, 2024 14:44:05.907521963 CEST | 443 | 49753 | 51.89.95.37 | 192.168.11.20 |
| Sep 3, 2024 14:44:05.907706022 CEST | 49753 | 443 | 192.168.11.20 | 51.89.95.37 |
| Sep 3, 2024 14:44:05.909168005 CEST | 49753 | 443 | 192.168.11.20 | 51.89.95.37 |
| Sep 3, 2024 14:44:05.909168959 CEST | 49753 | 443 | 192.168.11.20 | 51.89.95.37 |
| Sep 3, 2024 14:44:05.909288883 CEST | 443 | 49753 | 51.89.95.37 | 192.168.11.20 |
| Sep 3, 2024 14:44:05.909318924 CEST | 443 | 49753 | 51.89.95.37 | 192.168.11.20 |
| Sep 3, 2024 14:44:15.280420065 CEST | 49754 | 443 | 192.168.11.20 | 51.89.95.37 |
| Sep 3, 2024 14:44:15.280572891 CEST | 443 | 49754 | 51.89.95.37 | 192.168.11.20 |
| Sep 3, 2024 14:44:15.280891895 CEST | 49754 | 443 | 192.168.11.20 | 51.89.95.37 |
| Sep 3, 2024 14:44:15.281037092 CEST | 49754 | 443 | 192.168.11.20 | 51.89.95.37 |
| Sep 3, 2024 14:44:15.281095982 CEST | 443 | 49754 | 51.89.95.37 | 192.168.11.20 |
| Sep 3, 2024 14:44:15.778245926 CEST | 443 | 49754 | 51.89.95.37 | 192.168.11.20 |
| Sep 3, 2024 14:44:15.778852940 CEST | 49754 | 443 | 192.168.11.20 | 51.89.95.37 |
| Sep 3, 2024 14:44:15.778889894 CEST | 443 | 49754 | 51.89.95.37 | 192.168.11.20 |
| Sep 3, 2024 14:44:15.780608892 CEST | 443 | 49754 | 51.89.95.37 | 192.168.11.20 |
| Sep 3, 2024 14:44:15.780843973 CEST | 49754 | 443 | 192.168.11.20 | 51.89.95.37 |
| Sep 3, 2024 14:44:15.781579971 CEST | 49754 | 443 | 192.168.11.20 | 51.89.95.37 |
| Sep 3, 2024 14:44:15.781754017 CEST | 443 | 49754 | 51.89.95.37 | 192.168.11.20 |
| Sep 3, 2024 14:44:15.781960011 CEST | 49754 | 443 | 192.168.11.20 | 51.89.95.37 |
| Sep 3, 2024 14:44:15.781987906 CEST | 443 | 49754 | 51.89.95.37 | 192.168.11.20 |
| Sep 3, 2024 14:44:15.824898958 CEST | 49754 | 443 | 192.168.11.20 | 51.89.95.37 |
| Sep 3, 2024 14:44:16.310478926 CEST | 443 | 49754 | 51.89.95.37 | 192.168.11.20 |
| Sep 3, 2024 14:44:16.310806036 CEST | 443 | 49754 | 51.89.95.37 | 192.168.11.20 |
| Sep 3, 2024 14:44:16.311031103 CEST | 49754 | 443 | 192.168.11.20 | 51.89.95.37 |
| Sep 3, 2024 14:44:16.312544107 CEST | 49754 | 443 | 192.168.11.20 | 51.89.95.37 |
| Sep 3, 2024 14:44:16.312545061 CEST | 49754 | 443 | 192.168.11.20 | 51.89.95.37 |
| Sep 3, 2024 14:44:16.312618017 CEST | 443 | 49754 | 51.89.95.37 | 192.168.11.20 |
| Sep 3, 2024 14:44:16.312640905 CEST | 443 | 49754 | 51.89.95.37 | 192.168.11.20 |
| Sep 3, 2024 14:44:28.805222034 CEST | 49755 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:28.805378914 CEST | 443 | 49755 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:28.805604935 CEST | 49755 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:28.805835962 CEST | 49755 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:28.805912971 CEST | 443 | 49755 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:29.248995066 CEST | 443 | 49755 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:29.249460936 CEST | 49755 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:29.249473095 CEST | 443 | 49755 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:29.250371933 CEST | 443 | 49755 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:29.250601053 CEST | 49755 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:29.251334906 CEST | 49755 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:29.251411915 CEST | 443 | 49755 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:29.251563072 CEST | 49755 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:29.251574993 CEST | 443 | 49755 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:29.306155920 CEST | 49755 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:29.734770060 CEST | 443 | 49755 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:29.735138893 CEST | 443 | 49755 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:29.735325098 CEST | 49755 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:29.736531973 CEST | 49755 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:29.736531973 CEST | 49755 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:29.736603022 CEST | 443 | 49755 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:29.736625910 CEST | 443 | 49755 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:31.245619059 CEST | 49756 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:31.245765924 CEST | 443 | 49756 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:31.246125937 CEST | 49756 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:31.246295929 CEST | 49756 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:31.246357918 CEST | 443 | 49756 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:31.702331066 CEST | 443 | 49756 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:31.702934980 CEST | 49756 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:31.702946901 CEST | 443 | 49756 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:31.704016924 CEST | 443 | 49756 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:31.704596043 CEST | 49756 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:31.705379963 CEST | 49756 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:31.705466986 CEST | 443 | 49756 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:31.705670118 CEST | 49756 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:31.705682039 CEST | 443 | 49756 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:31.758749962 CEST | 49756 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:32.190772057 CEST | 443 | 49756 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:32.191225052 CEST | 443 | 49756 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:32.191410065 CEST | 49756 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:32.192468882 CEST | 49756 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:32.192579031 CEST | 443 | 49756 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:32.192610979 CEST | 49756 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:32.192657948 CEST | 443 | 49756 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:35.760210991 CEST | 49757 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:35.760315895 CEST | 443 | 49757 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:35.760520935 CEST | 49757 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:35.760752916 CEST | 49757 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:35.760828018 CEST | 443 | 49757 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:36.209028959 CEST | 443 | 49757 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:36.209619999 CEST | 49757 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:36.209630013 CEST | 443 | 49757 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:36.210530996 CEST | 443 | 49757 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:36.210757971 CEST | 49757 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:36.211540937 CEST | 49757 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:36.211616993 CEST | 443 | 49757 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:36.211921930 CEST | 49757 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:36.211935997 CEST | 443 | 49757 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:36.257792950 CEST | 49757 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:36.689661980 CEST | 443 | 49757 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:36.690010071 CEST | 443 | 49757 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:36.690448999 CEST | 49757 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:36.698162079 CEST | 49757 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:36.698162079 CEST | 49757 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:36.698285103 CEST | 443 | 49757 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:36.698316097 CEST | 443 | 49757 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:40.291436911 CEST | 49758 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:40.291583061 CEST | 443 | 49758 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:40.291824102 CEST | 49758 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:40.292072058 CEST | 49758 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:40.292141914 CEST | 443 | 49758 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:40.742638111 CEST | 443 | 49758 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:40.743083000 CEST | 49758 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:40.743114948 CEST | 443 | 49758 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:40.745853901 CEST | 443 | 49758 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:40.746098995 CEST | 49758 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:40.746845961 CEST | 49758 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:40.747059107 CEST | 443 | 49758 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:40.747191906 CEST | 49758 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:40.747217894 CEST | 443 | 49758 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:40.788162947 CEST | 49758 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:41.230652094 CEST | 443 | 49758 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:41.230967999 CEST | 443 | 49758 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:41.231137037 CEST | 49758 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:41.232439041 CEST | 49758 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:41.232439995 CEST | 49758 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:41.232530117 CEST | 443 | 49758 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:41.232561111 CEST | 443 | 49758 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:44.602051973 CEST | 49759 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:44.602174997 CEST | 443 | 49759 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:44.602413893 CEST | 49759 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:44.602663040 CEST | 49759 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:44.602737904 CEST | 443 | 49759 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:44.609364033 CEST | 49759 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:44.633141041 CEST | 49760 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:44.633196115 CEST | 443 | 49760 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:44.633359909 CEST | 49760 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:44.633630037 CEST | 49760 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:44.633666992 CEST | 443 | 49760 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:44.639981031 CEST | 49760 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:44.652204037 CEST | 443 | 49759 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:44.664510012 CEST | 49761 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:44.664561033 CEST | 443 | 49761 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:44.664732933 CEST | 49761 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:44.664977074 CEST | 49761 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:44.665019989 CEST | 443 | 49761 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:44.667507887 CEST | 49761 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:44.684281111 CEST | 443 | 49760 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:44.695700884 CEST | 49762 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:44.695718050 CEST | 443 | 49762 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:44.695945978 CEST | 49762 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:44.696151972 CEST | 49762 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:44.696162939 CEST | 443 | 49762 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:44.698646069 CEST | 49762 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:44.708218098 CEST | 443 | 49761 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:44.727314949 CEST | 49763 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:44.727330923 CEST | 443 | 49763 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:44.727549076 CEST | 49763 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:44.727780104 CEST | 49763 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:44.727792025 CEST | 443 | 49763 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:44.732687950 CEST | 49763 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:44.744210958 CEST | 443 | 49762 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:44.761399984 CEST | 49764 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:44.761416912 CEST | 443 | 49764 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:44.761663914 CEST | 49764 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:44.761899948 CEST | 49764 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:44.761912107 CEST | 443 | 49764 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:44.764158964 CEST | 49764 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:44.776177883 CEST | 443 | 49763 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:44.789362907 CEST | 49765 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:44.789465904 CEST | 443 | 49765 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:44.789686918 CEST | 49765 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:44.789911032 CEST | 49765 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:44.789968967 CEST | 443 | 49765 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:44.796705961 CEST | 49765 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:44.804222107 CEST | 443 | 49764 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:44.820429087 CEST | 49766 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:44.820517063 CEST | 443 | 49766 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:44.820760965 CEST | 49766 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:44.820996046 CEST | 49766 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:44.821050882 CEST | 443 | 49766 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:44.828041077 CEST | 49766 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:44.840265036 CEST | 443 | 49765 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:44.851713896 CEST | 49767 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:44.851767063 CEST | 443 | 49767 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:44.851999044 CEST | 49767 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:44.852195978 CEST | 49767 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:44.852230072 CEST | 443 | 49767 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:44.854840040 CEST | 49767 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:44.872189045 CEST | 443 | 49766 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:44.883074045 CEST | 49768 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:44.883097887 CEST | 443 | 49768 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:44.883280039 CEST | 49768 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:44.883503914 CEST | 49768 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:44.883517027 CEST | 443 | 49768 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:44.886257887 CEST | 49768 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:44.900221109 CEST | 443 | 49767 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:44.914829016 CEST | 49769 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:44.914850950 CEST | 443 | 49769 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:44.915030003 CEST | 49769 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:44.915220976 CEST | 49769 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:44.915235996 CEST | 443 | 49769 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:44.917390108 CEST | 49769 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:44.928215981 CEST | 443 | 49768 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:44.945656061 CEST | 49770 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:44.945672035 CEST | 443 | 49770 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:44.945823908 CEST | 49770 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:44.946034908 CEST | 49770 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:44.946046114 CEST | 443 | 49770 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:44.952869892 CEST | 49770 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:44.960176945 CEST | 443 | 49769 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:44.976761103 CEST | 49771 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:44.976775885 CEST | 443 | 49771 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:44.977011919 CEST | 49771 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:44.977262974 CEST | 49771 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:44.977273941 CEST | 443 | 49771 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:44.979988098 CEST | 49771 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:44.996222019 CEST | 443 | 49770 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.008068085 CEST | 49772 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:45.008084059 CEST | 443 | 49772 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.008306980 CEST | 49772 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:45.008582115 CEST | 49772 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:45.008593082 CEST | 443 | 49772 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.011213064 CEST | 49772 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:45.020226002 CEST | 443 | 49771 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.039608002 CEST | 49773 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:45.039623976 CEST | 443 | 49773 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.039844036 CEST | 49773 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:45.040117979 CEST | 49773 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:45.040128946 CEST | 443 | 49773 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.042793036 CEST | 49773 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:45.047822952 CEST | 443 | 49759 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.047934055 CEST | 49759 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:45.056219101 CEST | 443 | 49772 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.070363045 CEST | 49774 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:45.070389986 CEST | 443 | 49774 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.070642948 CEST | 49774 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:45.070904970 CEST | 49774 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:45.070918083 CEST | 443 | 49774 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.073499918 CEST | 49774 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:45.076489925 CEST | 443 | 49760 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.076611996 CEST | 443 | 49760 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.076699018 CEST | 49760 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:45.076759100 CEST | 49760 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:45.084217072 CEST | 443 | 49773 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.102510929 CEST | 49775 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:45.102526903 CEST | 443 | 49775 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.102696896 CEST | 49775 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:45.102931023 CEST | 49775 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:45.102941990 CEST | 443 | 49775 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.105115891 CEST | 49775 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:45.110889912 CEST | 443 | 49761 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.111027002 CEST | 443 | 49761 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.111156940 CEST | 49761 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:45.111234903 CEST | 49761 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:45.116218090 CEST | 443 | 49774 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.133471012 CEST | 49776 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:45.133554935 CEST | 443 | 49776 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.133723021 CEST | 49776 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:45.133970976 CEST | 49776 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:45.134022951 CEST | 443 | 49776 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.140043974 CEST | 443 | 49762 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.140152931 CEST | 443 | 49762 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.140212059 CEST | 49762 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:45.140265942 CEST | 49762 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:45.140705109 CEST | 49776 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:45.148179054 CEST | 443 | 49775 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.164048910 CEST | 49777 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:45.164071083 CEST | 443 | 49777 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.164262056 CEST | 49777 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:45.164546967 CEST | 49777 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:45.164560080 CEST | 443 | 49777 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.167514086 CEST | 49777 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:45.169372082 CEST | 443 | 49763 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.169493914 CEST | 443 | 49763 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.169514894 CEST | 49763 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:45.169616938 CEST | 49763 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:45.184235096 CEST | 443 | 49776 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.195384979 CEST | 49778 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:45.195467949 CEST | 443 | 49778 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.195774078 CEST | 49778 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:45.195965052 CEST | 49778 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:45.196010113 CEST | 443 | 49778 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.199999094 CEST | 49778 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:45.208292007 CEST | 443 | 49777 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.216017962 CEST | 443 | 49764 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.216201067 CEST | 49764 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:45.226908922 CEST | 49779 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:45.227001905 CEST | 443 | 49779 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.227349043 CEST | 49779 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:45.227576017 CEST | 49779 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:45.227634907 CEST | 443 | 49779 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.229792118 CEST | 49779 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:45.238559961 CEST | 443 | 49765 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.238792896 CEST | 49765 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:45.240221977 CEST | 443 | 49778 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.258239031 CEST | 49780 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:45.258327007 CEST | 443 | 49780 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.258550882 CEST | 49780 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:45.258764029 CEST | 49780 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:45.258934021 CEST | 443 | 49780 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.259175062 CEST | 49780 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:45.267699003 CEST | 443 | 49766 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.267867088 CEST | 49766 | 443 | 192.168.11.20 | 78.47.165.25 |
| Sep 3, 2024 14:44:45.272233963 CEST | 443 | 49779 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.306853056 CEST | 443 | 49767 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.307519913 CEST | 443 | 49767 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.312333107 CEST | 443 | 49767 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.330096960 CEST | 443 | 49768 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.330640078 CEST | 443 | 49768 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.336374044 CEST | 443 | 49768 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.363692999 CEST | 443 | 49769 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.364316940 CEST | 443 | 49769 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.372375011 CEST | 443 | 49769 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.392146111 CEST | 443 | 49770 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.392827988 CEST | 443 | 49770 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.400381088 CEST | 443 | 49770 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.421489000 CEST | 443 | 49771 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.421892881 CEST | 443 | 49771 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.432388067 CEST | 443 | 49771 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.457437992 CEST | 443 | 49772 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.458077908 CEST | 443 | 49772 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.464379072 CEST | 443 | 49772 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.487766981 CEST | 443 | 49773 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.488383055 CEST | 443 | 49773 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.496320009 CEST | 443 | 49773 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.518821955 CEST | 443 | 49774 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.519478083 CEST | 443 | 49774 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.520263910 CEST | 443 | 49767 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.524380922 CEST | 443 | 49774 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.548306942 CEST | 443 | 49768 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.552525997 CEST | 443 | 49775 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.553124905 CEST | 443 | 49775 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.560384035 CEST | 443 | 49775 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.583945036 CEST | 443 | 49776 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.584228992 CEST | 443 | 49769 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.584530115 CEST | 443 | 49776 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.596318007 CEST | 443 | 49776 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.608298063 CEST | 443 | 49770 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.613593102 CEST | 443 | 49777 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.613989115 CEST | 443 | 49777 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.620377064 CEST | 443 | 49777 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.643147945 CEST | 443 | 49778 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.643567085 CEST | 443 | 49778 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.644231081 CEST | 443 | 49771 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.648308992 CEST | 443 | 49778 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.672302961 CEST | 443 | 49772 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.680068970 CEST | 443 | 49779 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.680519104 CEST | 443 | 49779 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.688369989 CEST | 443 | 49779 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.704394102 CEST | 443 | 49773 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.732383013 CEST | 443 | 49774 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.768404007 CEST | 443 | 49775 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.804397106 CEST | 443 | 49776 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.828383923 CEST | 443 | 49777 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.856321096 CEST | 443 | 49778 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.896332026 CEST | 443 | 49779 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.960372925 CEST | 443 | 49768 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:45.960372925 CEST | 443 | 49767 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:46.024391890 CEST | 443 | 49769 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:46.024415016 CEST | 443 | 49770 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:46.056379080 CEST | 443 | 49771 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:46.088407040 CEST | 443 | 49772 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:46.120306015 CEST | 443 | 49773 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:46.156316996 CEST | 443 | 49774 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:46.184331894 CEST | 443 | 49775 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:46.216370106 CEST | 443 | 49776 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:46.248341084 CEST | 443 | 49777 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:46.280390978 CEST | 443 | 49778 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:46.312303066 CEST | 443 | 49779 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:46.792386055 CEST | 443 | 49768 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:46.792386055 CEST | 443 | 49767 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:46.856395960 CEST | 443 | 49769 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:46.856415033 CEST | 443 | 49770 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:46.888369083 CEST | 443 | 49771 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:46.920312881 CEST | 443 | 49772 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:46.952395916 CEST | 443 | 49773 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:46.984344006 CEST | 443 | 49774 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:47.016377926 CEST | 443 | 49775 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:47.048393011 CEST | 443 | 49776 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:47.080390930 CEST | 443 | 49777 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:47.112399101 CEST | 443 | 49778 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:47.144329071 CEST | 443 | 49779 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:48.456202030 CEST | 443 | 49768 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:48.456232071 CEST | 443 | 49767 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:48.520330906 CEST | 443 | 49769 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:48.520330906 CEST | 443 | 49770 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:48.552340984 CEST | 443 | 49771 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:48.584394932 CEST | 443 | 49772 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:48.620258093 CEST | 443 | 49773 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:48.648367882 CEST | 443 | 49774 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:48.680382967 CEST | 443 | 49775 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:48.712377071 CEST | 443 | 49776 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:48.744395018 CEST | 443 | 49777 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:48.776380062 CEST | 443 | 49778 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:48.808372021 CEST | 443 | 49779 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:51.848427057 CEST | 443 | 49771 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:51.848427057 CEST | 443 | 49767 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:51.848428011 CEST | 443 | 49769 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:51.848453045 CEST | 443 | 49770 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:51.848483086 CEST | 443 | 49768 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:52.104420900 CEST | 443 | 49775 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:52.104420900 CEST | 443 | 49772 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:52.104422092 CEST | 443 | 49777 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:52.104422092 CEST | 443 | 49779 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:52.104446888 CEST | 443 | 49774 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:52.104475975 CEST | 443 | 49773 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:52.104484081 CEST | 443 | 49778 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:52.104512930 CEST | 443 | 49776 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:58.504410028 CEST | 443 | 49770 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:58.504410028 CEST | 443 | 49768 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:58.504431009 CEST | 443 | 49767 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:58.504462957 CEST | 443 | 49769 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:58.504472017 CEST | 443 | 49771 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:58.760323048 CEST | 443 | 49775 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:58.760324001 CEST | 443 | 49772 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:58.760324001 CEST | 443 | 49776 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:58.760344028 CEST | 443 | 49773 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:58.760346889 CEST | 443 | 49774 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:58.760351896 CEST | 443 | 49777 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:58.760390043 CEST | 443 | 49778 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:44:58.760416985 CEST | 443 | 49779 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:45:11.816404104 CEST | 443 | 49769 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:45:11.816405058 CEST | 443 | 49771 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:45:11.816426039 CEST | 443 | 49770 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:45:11.816426992 CEST | 443 | 49767 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:45:11.816462040 CEST | 443 | 49768 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:45:12.072276115 CEST | 443 | 49775 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:45:12.072316885 CEST | 443 | 49779 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:45:12.072315931 CEST | 443 | 49774 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:45:12.072315931 CEST | 443 | 49772 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:45:12.072339058 CEST | 443 | 49777 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:45:12.072348118 CEST | 443 | 49773 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:45:12.072365046 CEST | 443 | 49778 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:45:12.072393894 CEST | 443 | 49776 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:45:38.696408987 CEST | 443 | 49772 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:45:38.696408987 CEST | 443 | 49774 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:45:38.696408987 CEST | 443 | 49776 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:45:38.696408987 CEST | 443 | 49773 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:45:38.696434975 CEST | 443 | 49767 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:45:38.696441889 CEST | 443 | 49775 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:45:38.696446896 CEST | 443 | 49771 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:45:38.696463108 CEST | 443 | 49777 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:45:38.696475983 CEST | 443 | 49778 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:45:38.696476936 CEST | 443 | 49770 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:45:38.696507931 CEST | 443 | 49779 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:45:38.696537018 CEST | 443 | 49768 | 78.47.165.25 | 192.168.11.20 |
| Sep 3, 2024 14:45:38.696552992 CEST | 443 | 49769 | 78.47.165.25 | 192.168.11.20 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Sep 3, 2024 14:43:26.186781883 CEST | 55960 | 53 | 192.168.11.20 | 1.1.1.1 |
| Sep 3, 2024 14:43:26.306277990 CEST | 53 | 55960 | 1.1.1.1 | 192.168.11.20 |
| Sep 3, 2024 14:44:28.684020996 CEST | 53811 | 53 | 192.168.11.20 | 1.1.1.1 |
| Sep 3, 2024 14:44:28.804490089 CEST | 53 | 53811 | 1.1.1.1 | 192.168.11.20 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Sep 3, 2024 14:43:26.186781883 CEST | 192.168.11.20 | 1.1.1.1 | 0x3cc6 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Sep 3, 2024 14:44:28.684020996 CEST | 192.168.11.20 | 1.1.1.1 | 0x700c | Standard query (0) | A (IP address) | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Sep 3, 2024 14:43:26.306277990 CEST | 1.1.1.1 | 192.168.11.20 | 0x3cc6 | No error (0) | 51.89.95.37 | A (IP address) | IN (0x0001) | false | ||
| Sep 3, 2024 14:43:26.306277990 CEST | 1.1.1.1 | 192.168.11.20 | 0x3cc6 | No error (0) | 5.75.168.191 | A (IP address) | IN (0x0001) | false | ||
| Sep 3, 2024 14:43:26.306277990 CEST | 1.1.1.1 | 192.168.11.20 | 0x3cc6 | No error (0) | 78.47.165.25 | A (IP address) | IN (0x0001) | false | ||
| Sep 3, 2024 14:44:28.804490089 CEST | 1.1.1.1 | 192.168.11.20 | 0x700c | No error (0) | 78.47.165.25 | A (IP address) | IN (0x0001) | false | ||
| Sep 3, 2024 14:44:28.804490089 CEST | 1.1.1.1 | 192.168.11.20 | 0x700c | No error (0) | 5.75.168.191 | A (IP address) | IN (0x0001) | false | ||
| Sep 3, 2024 14:44:28.804490089 CEST | 1.1.1.1 | 192.168.11.20 | 0x700c | No error (0) | 51.89.95.37 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.11.20 | 49748 | 51.89.95.37 | 443 | 6380 | C:\Users\user\Desktop\getscreen-120727697-x86.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-09-03 12:43:26 UTC | 290 | OUT | |
| 2024-09-03 12:43:27 UTC | 265 | IN | |
| 2024-09-03 12:43:27 UTC | 12 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.11.20 | 49749 | 51.89.95.37 | 443 | 6380 | C:\Users\user\Desktop\getscreen-120727697-x86.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-09-03 12:43:39 UTC | 290 | OUT | |
| 2024-09-03 12:43:39 UTC | 265 | IN | |
| 2024-09-03 12:43:39 UTC | 12 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 2 | 192.168.11.20 | 49752 | 51.89.95.37 | 443 | 6380 | C:\Users\user\Desktop\getscreen-120727697-x86.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-09-03 12:43:58 UTC | 290 | OUT | |
| 2024-09-03 12:43:58 UTC | 265 | IN | |
| 2024-09-03 12:43:58 UTC | 12 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 3 | 192.168.11.20 | 49753 | 51.89.95.37 | 443 | 6380 | C:\Users\user\Desktop\getscreen-120727697-x86.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-09-03 12:44:05 UTC | 290 | OUT | |
| 2024-09-03 12:44:05 UTC | 266 | IN | |
| 2024-09-03 12:44:05 UTC | 12 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 4 | 192.168.11.20 | 49754 | 51.89.95.37 | 443 | 6380 | C:\Users\user\Desktop\getscreen-120727697-x86.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-09-03 12:44:15 UTC | 290 | OUT | |
| 2024-09-03 12:44:16 UTC | 265 | IN | |
| 2024-09-03 12:44:16 UTC | 12 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 5 | 192.168.11.20 | 49755 | 78.47.165.25 | 443 | 6380 | C:\Users\user\Desktop\getscreen-120727697-x86.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-09-03 12:44:29 UTC | 290 | OUT | |
| 2024-09-03 12:44:29 UTC | 265 | IN | |
| 2024-09-03 12:44:29 UTC | 12 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 6 | 192.168.11.20 | 49756 | 78.47.165.25 | 443 | 6380 | C:\Users\user\Desktop\getscreen-120727697-x86.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-09-03 12:44:31 UTC | 290 | OUT | |
| 2024-09-03 12:44:32 UTC | 265 | IN | |
| 2024-09-03 12:44:32 UTC | 12 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 7 | 192.168.11.20 | 49757 | 78.47.165.25 | 443 | 6380 | C:\Users\user\Desktop\getscreen-120727697-x86.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-09-03 12:44:36 UTC | 290 | OUT | |
| 2024-09-03 12:44:36 UTC | 265 | IN | |
| 2024-09-03 12:44:36 UTC | 12 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 8 | 192.168.11.20 | 49758 | 78.47.165.25 | 443 | 6380 | C:\Users\user\Desktop\getscreen-120727697-x86.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-09-03 12:44:40 UTC | 290 | OUT | |
| 2024-09-03 12:44:41 UTC | 265 | IN | |
| 2024-09-03 12:44:41 UTC | 12 | IN |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
| Target ID: | 1 |
| Start time: | 08:43:22 |
| Start date: | 03/09/2024 |
| Path: | C:\Users\user\Desktop\getscreen-120727697-x86.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x680000 |
| File size: | 3'654'440 bytes |
| MD5 hash: | 9C765958B4D463D04C41DEF1103AA1F2 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | low |
| Has exited: | false |
| Target ID: | 3 |
| Start time: | 08:43:22 |
| Start date: | 03/09/2024 |
| Path: | C:\Users\user\Desktop\getscreen-120727697-x86.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x680000 |
| File size: | 3'654'440 bytes |
| MD5 hash: | 9C765958B4D463D04C41DEF1103AA1F2 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | low |
| Has exited: | false |
| Target ID: | 5 |
| Start time: | 08:43:23 |
| Start date: | 03/09/2024 |
| Path: | C:\ProgramData\Getscreen.me\rzrcqgspmqryvpnwupffnbzpjfygzjn-elevate.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x180000 |
| File size: | 3'654'440 bytes |
| MD5 hash: | 9C765958B4D463D04C41DEF1103AA1F2 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Antivirus matches: |
|
| Reputation: | low |
| Has exited: | true |
| Target ID: | 6 |
| Start time: | 08:43:25 |
| Start date: | 03/09/2024 |
| Path: | C:\Windows\System32\svchost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff61ee50000 |
| File size: | 57'360 bytes |
| MD5 hash: | F586835082F632DC8D9404D83BC16316 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | moderate |
| Has exited: | false |
| Target ID: | 7 |
| Start time: | 08:43:25 |
| Start date: | 03/09/2024 |
| Path: | C:\Users\user\Desktop\getscreen-120727697-x86.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x680000 |
| File size: | 3'654'440 bytes |
| MD5 hash: | 9C765958B4D463D04C41DEF1103AA1F2 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | low |
| Has exited: | true |
Execution Graph
| Execution Coverage: | 0.5% |
| Dynamic/Decrypted Code Coverage: | 0% |
| Signature Coverage: | 9.1% |
| Total number of Nodes: | 77 |
| Total number of Limit Nodes: | 6 |
Graph
Function 018D29E0 Relevance: 7.7, APIs: 5, Instructions: 212librarymemoryloaderCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0084B6E0 Relevance: 6.1, APIs: 4, Instructions: 66threadCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0084B62B Relevance: 3.0, APIs: 2, Instructions: 38threadCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007F7449 Relevance: 224.3, APIs: 64, Strings: 64, Instructions: 269libraryloaderCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007AE4DD Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 138registrythreadCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00795E14 Relevance: 6.0, APIs: 4, Instructions: 28COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0083FCA9 Relevance: 6.0, APIs: 4, Instructions: 12COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001F89A0 Relevance: 5.1, Strings: 4, Instructions: 137COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00795B39 Relevance: 4.6, APIs: 3, Instructions: 67COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007A3F1C Relevance: 3.1, APIs: 2, Instructions: 85COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007FEE20 Relevance: 1.5, APIs: 1, Instructions: 28COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00795782 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00795ABB Relevance: 1.3, Strings: 1, Instructions: 38COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007A7B3F Relevance: .1, Instructions: 113COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001CB080 Relevance: .1, Instructions: 111COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001EA30D Relevance: .1, Instructions: 59COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00872165 Relevance: .0, Instructions: 48COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0079590A Relevance: .0, Instructions: 38COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00795732 Relevance: .0, Instructions: 28COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00872620 Relevance: .0, Instructions: 23COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00797321 Relevance: .0, Instructions: 22COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00795ED1 Relevance: .0, Instructions: 22COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00795DA5 Relevance: .0, Instructions: 18COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0079612F Relevance: .0, Instructions: 17COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00795D58 Relevance: .0, Instructions: 17COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00796105 Relevance: .0, Instructions: 14COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0079584E Relevance: .0, Instructions: 13COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00795831 Relevance: .0, Instructions: 11COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007A7B24 Relevance: .0, Instructions: 11COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00795D82 Relevance: .0, Instructions: 10COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00795966 Relevance: .0, Instructions: 9COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00795A65 Relevance: .0, Instructions: 9COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00795B24 Relevance: .0, Instructions: 6COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00795D97 Relevance: .0, Instructions: 4COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00795A61 Relevance: .0, Instructions: 3COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007E14E3 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 194sleepCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00873B76 Relevance: 15.1, APIs: 10, Instructions: 134COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007F4B0C Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 37libraryloaderCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007A42E5 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 181fileCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007853FD Relevance: 12.1, APIs: 8, Instructions: 80COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0078CB5F Relevance: 12.1, APIs: 8, Instructions: 65COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007AEFD0 Relevance: 10.7, APIs: 7, Instructions: 160COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001E8EE0 Relevance: 10.6, APIs: 7, Instructions: 87COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007FF61C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 73networkCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0080001B Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 40libraryloaderCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0078CB11 Relevance: 10.5, APIs: 7, Instructions: 26COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007CDFDE Relevance: 9.2, APIs: 6, Instructions: 160COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007A1D8F Relevance: 9.1, APIs: 6, Instructions: 75COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007C9EF7 Relevance: 7.6, APIs: 5, Instructions: 143COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 001E8E40 Relevance: 7.6, APIs: 5, Instructions: 54memoryCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0087632D Relevance: 6.2, APIs: 4, Instructions: 174COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007CC297 Relevance: 6.1, APIs: 4, Instructions: 88COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007F5C02 Relevance: 6.1, APIs: 4, Instructions: 74COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007C9BBD Relevance: 6.1, APIs: 4, Instructions: 61COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007E1F3D Relevance: 6.1, APIs: 4, Instructions: 60COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 007F7310 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21libraryloaderCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0085F42C Relevance: 5.2, APIs: 4, Instructions: 154COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Execution Graph
| Execution Coverage: | 0.5% |
| Dynamic/Decrypted Code Coverage: | 0% |
| Signature Coverage: | 0% |
| Total number of Nodes: | 77 |
| Total number of Limit Nodes: | 6 |
Graph
Function 01DD29E0 Relevance: 7.7, APIs: 5, Instructions: 212librarymemoryloaderCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00D4B6E0 Relevance: 6.1, APIs: 4, Instructions: 66threadCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00D4B62B Relevance: 3.0, APIs: 2, Instructions: 38threadCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00C95E14 Relevance: 6.0, APIs: 4, Instructions: 28COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00D3FCA9 Relevance: 6.0, APIs: 4, Instructions: 12COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00CF7449 Relevance: 224.3, APIs: 64, Strings: 64, Instructions: 269libraryloaderCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00CE14E3 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 194sleepCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00D73B76 Relevance: 15.1, APIs: 10, Instructions: 134COMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00CAE4DD Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 138registrythreadCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00CF4B0C Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 37libraryloaderCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00CA42E5 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 181fileCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00C853FD Relevance: 12.1, APIs: 8, Instructions: 80COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00C8CB5F Relevance: 12.1, APIs: 8, Instructions: 65COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00CAEFD0 Relevance: 10.7, APIs: 7, Instructions: 160COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 006E8EE0 Relevance: 10.6, APIs: 7, Instructions: 87COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00CFF61C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 73networkCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00D0001B Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 40libraryloaderCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00C8CB11 Relevance: 10.5, APIs: 7, Instructions: 26COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00CCDFDE Relevance: 9.2, APIs: 6, Instructions: 160COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00CA1D8F Relevance: 9.1, APIs: 6, Instructions: 75COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00CC9EF7 Relevance: 7.6, APIs: 5, Instructions: 143COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 006E8E40 Relevance: 7.6, APIs: 5, Instructions: 54memoryCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00D7632D Relevance: 6.2, APIs: 4, Instructions: 174COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00CCC297 Relevance: 6.1, APIs: 4, Instructions: 88COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00CF5C02 Relevance: 6.1, APIs: 4, Instructions: 74COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00CC9BBD Relevance: 6.1, APIs: 4, Instructions: 61COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00CE1F3D Relevance: 6.1, APIs: 4, Instructions: 60COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00CF7310 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21libraryloaderCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00D5F42C Relevance: 5.2, APIs: 4, Instructions: 154COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|