Edit tour
Windows
Analysis Report
file.exe
Overview
General Information
| Sample name: | file.exe |
| Analysis ID: | 1509605 |
| MD5: | 984c885de9fea28a60a25b278f424f50 |
| SHA1: | 5971c05829104cb0dd47de9fb8806762c141f081 |
| SHA256: | 5fe11452c901b9eb15809a33ecc6bb94c9d1ec87553708eac94ad19969cbaa8c |
| Tags: | exeSocks5Systemz |
| Infos: |   |
 | |
Detection
Socks5Systemz
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected Socks5Systemz
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Contains functionality to infect the boot sector
Machine Learning detection for dropped file
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to launch a program with higher privileges
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to query network adapater information
Contains functionality to shutdown / reboot the system
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Detected potential crypto function
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evasive API chain (date check)
Found evasive API chain (may stop execution after checking a module file name)
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains executable resources (Code or Archives)
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries disk information (often used to detect virtual machines)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Classification
- System is w10x64
file.exe (PID: 3472 cmdline: "C:\Users\ user\Deskt op\file.ex e" MD5: 984C885DE9FEA28A60A25B278F424F50) - file.tmp (PID: 6548 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\is-1S2 OA.tmp\fil e.tmp" /SL 5="$10452, 3217664,56 832,C:\Use rs\user\De sktop\file .exe" MD5: F02C8C4B73C31FD56FD90DC77235363B) 
batchaviconverter32_64.exe (PID: 3220 cmdline: "C:\Users\ user\AppDa ta\Local\B atch AVI C onverter\b atchavicon verter32_6 4.exe" -i MD5: 91646D419442B59CE172BCBAE8A2A8C9)
svchost.exe (PID: 7152 cmdline: C:\Windows \System32\ svchost.ex e -k Local Service -p -s Licens eManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
- cleanup
{"C2 list": ["bwdroig.com"]}| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_Socks5Systemz | Yara detected Socks5Systemz | Joe Security | ||
| JoeSecurity_Socks5Systemz | Yara detected Socks5Systemz | Joe Security | ||
| JoeSecurity_Socks5Systemz | Yara detected Socks5Systemz | Joe Security |
| Source: | Author: vburov: | ||
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2024-09-11T21:05:56.592753+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49694 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:05:56.945730+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49694 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:05:57.759019+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49695 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:05:58.587230+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49696 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:05:59.436703+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49698 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:05:59.808909+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49698 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:00.173237+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49698 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:04.025367+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49699 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:04.856670+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49700 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:05.212808+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49700 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:06.172922+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49701 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:07.015813+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49705 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:07.862918+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49706 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:08.685168+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49708 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:09.037740+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49708 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:09.851395+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49710 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:11.069617+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49711 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:11.896319+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49712 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:12.773663+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49713 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:13.605918+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49714 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:14.458614+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49715 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:15.308093+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49716 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:15.657816+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49716 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:16.511272+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49717 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:16.890327+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49717 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:17.260660+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49717 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:18.082965+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49718 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:18.905971+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49719 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:19.748752+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49720 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:20.096601+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49720 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:20.936229+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49721 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:21.296599+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49721 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:22.198017+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49722 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:22.998760+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49723 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:23.356736+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49723 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:23.709679+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49723 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:24.545349+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49724 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:24.913525+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49724 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:25.760563+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49725 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:26.218181+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49725 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:26.568628+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49725 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:27.422938+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49726 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:27.778832+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49726 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:28.137634+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49726 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:28.493940+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49726 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:29.319896+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49727 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:30.164158+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49728 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:31.118017+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49729 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:31.961080+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49730 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:33.084848+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49731 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:33.902633+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49732 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:34.288980+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49732 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:35.098906+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49733 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:35.918371+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49734 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:36.274434+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49734 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:37.246858+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49735 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:37.594424+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49735 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:37.940100+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49735 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:38.788211+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49736 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:39.632773+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49737 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:40.485386+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49738 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:40.839571+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49738 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:41.199616+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49738 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:41.796373+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49738 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:42.152596+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49738 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:42.687249+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49738 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:43.040861+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49738 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:43.864891+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49739 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:44.711438+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49740 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:45.545838+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49741 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:45.897834+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49741 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:46.723627+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49742 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:47.539506+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49743 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:48.660925+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49744 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:49.481618+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49745 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:50.341493+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49746 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:50.706826+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49746 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:51.549357+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49747 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:52.389623+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49748 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:53.198866+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49749 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:53.551402+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49749 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:54.402867+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49750 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:54.765378+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49750 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:55.585127+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49751 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:56.428401+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49752 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:57.264250+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49753 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:58.076172+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49754 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:58.906526+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49755 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:59.848506+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49756 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:07:00.991707+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49757 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:07:01.839737+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49758 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:07:02.669331+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49759 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:07:03.550461+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49760 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:07:04.444123+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49761 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:07:05.339435+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49762 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:07:06.175896+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49763 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:07:07.004269+0200 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.5 | 49764 | 185.196.8.214 | 80 | TCP |
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | Malware Configuration Extractor: | ||
| Source: | ReversingLabs: | ||
| Source: | Integrated Neural Analysis Model: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Code function: | 1_2_0045D188 | |
| Source: | Code function: | 1_2_0045D254 | |
| Source: | Code function: | 1_2_0045D23C | |
| Source: | Code function: | 1_2_10001000 | |
| Source: | Code function: | 1_2_10001130 | |
Compliance | |
|---|
| Source: | Unpacked PE file: | ||
| Source: | Static PE information: | ||
| Source: | Registry value created: | Jump to behavior | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Code function: | 1_2_00452A60 | |
| Source: | Code function: | 1_2_00474F88 | |
| Source: | Code function: | 1_2_004980A4 | |
| Source: | Code function: | 1_2_00464158 | |
| Source: | Code function: | 1_2_00462750 | |
| Source: | Code function: | 1_2_00463CDC | |
Networking | |
|---|
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | URLs: | ||
| Source: | IP Address: | ||
| Source: | ASN Name: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | Code function: | 3_2_02D872A7 | |
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Code function: | 1_2_0042F520 | |
| Source: | Code function: | 1_2_00423B84 | |
| Source: | Code function: | 1_2_004125D8 | |
| Source: | Code function: | 1_2_00478AC0 | |
| Source: | Code function: | 1_2_00457594 | |
| Source: | Code function: | 1_2_0042E934 | |
| Source: | Code function: | 0_2_00409448 | |
| Source: | Code function: | 1_2_004555E4 | |
| Source: | Code function: | 0_2_0040840C | |
| Source: | Code function: | 1_2_004706A8 | |
| Source: | Code function: | 1_2_004809F7 | |
| Source: | Code function: | 1_2_004352C8 | |
| Source: | Code function: | 1_2_004673A4 | |
| Source: | Code function: | 1_2_0043035C | |
| Source: | Code function: | 1_2_004444C8 | |
| Source: | Code function: | 1_2_004345C4 | |
| Source: | Code function: | 1_2_00444A70 | |
| Source: | Code function: | 1_2_00486BD0 | |
| Source: | Code function: | 1_2_00430EE8 | |
| Source: | Code function: | 1_2_0045F0C4 | |
| Source: | Code function: | 1_2_00445168 | |
| Source: | Code function: | 1_2_0045B174 | |
| Source: | Code function: | 1_2_00469404 | |
| Source: | Code function: | 1_2_00445574 | |
| Source: | Code function: | 1_2_004519BC | |
| Source: | Code function: | 1_2_00487B30 | |
| Source: | Code function: | 1_2_0043DD50 | |
| Source: | Code function: | 1_2_0048DF54 | |
| Source: | Code function: | 1_2_02371260 | |
| Source: | Code function: | 1_2_02371D20 | |
| Source: | Code function: | 3_2_00401051 | |
| Source: | Code function: | 3_2_00401C26 | |
| Source: | Code function: | 3_2_02DC79DA | |
| Source: | Code function: | 3_2_02DBB8D7 | |
| Source: | Code function: | 3_2_02DA53A0 | |
| Source: | Code function: | 3_2_02D9E17D | |
| Source: | Code function: | 3_2_02D99E74 | |
| Source: | Code function: | 3_2_02DA4E29 | |
| Source: | Code function: | 3_2_02D8EFAC | |
| Source: | Code function: | 3_2_02D9DC89 | |
| Source: | Code function: | 3_2_02D98432 | |
| Source: | Code function: | 3_2_02D9AC2A | |
| Source: | Code function: | 3_2_02D9E595 | |
| Source: | Code function: | 3_2_02DA2DB4 | |
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Classification label: | ||
| Source: | Code function: | 3_2_02D908A8 | |
| Source: | Code function: | 0_2_00409448 | |
| Source: | Code function: | 1_2_004555E4 | |
| Source: | Code function: | 1_2_00455E0C | |
| Source: | Code function: | 3_2_0040273F | |
| Source: | Code function: | 1_2_0046E0E4 | |
| Source: | Code function: | 0_2_00409C34 | |
| Source: | Code function: | 3_2_0040B846 | |
| Source: | Code function: | 3_2_0040B846 | |
| Source: | Code function: | 3_2_0040223D | |
| Source: | Code function: | 3_2_0040B173 | |
| Source: | Code function: | 3_2_004021F8 | |
| Source: | Code function: | 3_2_004021F8 | |
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Key value created or modified: | Jump to behavior | ||
| Source: | File read: | Jump to behavior | ||
| Source: | File read: | Jump to behavior | ||
| Source: | ReversingLabs: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Key value queried: | Jump to behavior | ||
| Source: | Key value created or modified: | Jump to behavior | ||
| Source: | Window found: | Jump to behavior | ||
| Source: | Window detected: | ||
| Source: | Registry value created: | Jump to behavior | ||
| Source: | Static file information: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
Data Obfuscation | |
|---|
| Source: | Unpacked PE file: | ||
| Source: | Unpacked PE file: | ||
| Source: | Code function: | 1_2_004502C0 | |
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Code function: | 0_2_004065FD | |
| Source: | Code function: | 0_2_004040F1 | |
| Source: | Code function: | 0_2_00408109 | |
| Source: | Code function: | 0_2_00404389 | |
| Source: | Code function: | 0_2_00404389 | |
| Source: | Code function: | 0_2_0040C219 | |
| Source: | Code function: | 0_2_00404389 | |
| Source: | Code function: | 0_2_00404389 | |
| Source: | Code function: | 0_2_00408F63 | |
| Source: | Code function: | 1_2_00409981 | |
| Source: | Code function: | 1_2_0048408E | |
| Source: | Code function: | 1_2_004062B5 | |
| Source: | Code function: | 1_2_004104E5 | |
| Source: | Code function: | 1_2_00412983 | |
| Source: | Code function: | 1_2_00494CB1 | |
| Source: | Code function: | 1_2_0040CE3A | |
| Source: | Code function: | 1_2_0045930C | |
| Source: | Code function: | 1_2_0040F39A | |
| Source: | Code function: | 1_2_00443444 | |
| Source: | Code function: | 1_2_004054A9 | |
| Source: | Code function: | 1_2_00405741 | |
| Source: | Code function: | 1_2_00405741 | |
| Source: | Code function: | 1_2_0048567D | |
| Source: | Code function: | 1_2_00405741 | |
| Source: | Code function: | 1_2_00405741 | |
| Source: | Code function: | 1_2_00451823 | |
| Source: | Code function: | 1_2_004519C1 | |
| Source: | Code function: | 1_2_00477B09 | |
| Source: | Code function: | 1_2_00419C2D | |
| Source: | Code function: | 1_2_0045FD20 | |
| Source: | Code function: | 1_2_00499D3F | |
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
Persistence and Installation Behavior | |
|---|
| Source: | Code function: | 3_2_00401A4F | |
| Source: | Code function: | 3_2_02D8F7D5 | |
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
Boot Survival | |
|---|
| Source: | Code function: | 3_2_00401A4F | |
| Source: | Code function: | 3_2_02D8F7D5 | |
| Source: | Code function: | 3_2_0040B846 | |
| Source: | Code function: | 1_2_00423C0C | |
| Source: | Code function: | 1_2_00423C0C | |
| Source: | Code function: | 1_2_004241DC | |
| Source: | Code function: | 1_2_00424194 | |
| Source: | Code function: | 1_2_00418384 | |
| Source: | Code function: | 1_2_0042285C | |
| Source: | Code function: | 1_2_00417598 | |
| Source: | Code function: | 1_2_0048393C | |
| Source: | Code function: | 1_2_00417CCE | |
| Source: | Code function: | 1_2_00417CD0 | |
| Source: | Code function: | 1_2_0041F118 | |
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Code function: | 3_2_00401B4B | |
| Source: | Code function: | 3_2_02D8F8D9 | |
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Evasive API call chain: | graph_0-5972 | ||
| Source: | Evasive API call chain: | graph_3-18538 | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Code function: | 1_2_00452A60 | |
| Source: | Code function: | 1_2_00474F88 | |
| Source: | Code function: | 1_2_004980A4 | |
| Source: | Code function: | 1_2_00464158 | |
| Source: | Code function: | 1_2_00462750 | |
| Source: | Code function: | 1_2_00463CDC | |
| Source: | Code function: | 0_2_00409B78 | |
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | API call chain: | graph_0-6769 | ||
| Source: | API call chain: | graph_3-18539 | ||
| Source: | API call chain: | graph_3-19105 | ||
| Source: | Process information queried: | Jump to behavior | ||
| Source: | Code function: | 3_2_02DA00FE | |
| Source: | Code function: | 3_2_02DA00FE | |
| Source: | Code function: | 1_2_004502C0 | |
| Source: | Code function: | 3_2_02D86487 | |
| Source: | Code function: | 3_2_02D99458 | |
| Source: | Code function: | 1_2_00478504 | |
| Source: | Code function: | 1_2_0042E09C | |
| Source: | Code function: | 3_2_02D97F9D | |
| Source: | Code function: | 0_2_0040520C | |
| Source: | Code function: | 0_2_00405258 | |
| Source: | Code function: | 1_2_00408568 | |
| Source: | Code function: | 1_2_004085B4 | |
| Source: | Code function: | 1_2_004585C8 | |
| Source: | Code function: | 0_2_004026C4 | |
| Source: | Code function: | 1_2_0045559C | |
| Source: | Code function: | 0_2_00405CF4 | |
Stealing of Sensitive Information | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
Remote Access Functionality | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | 3 Native API | 1 DLL Side-Loading | 1 Exploitation for Privilege Escalation | 1 Deobfuscate/Decode Files or Information | OS Credential Dumping | 1 System Time Discovery | Remote Services | 1 Archive Collected Data | 2 Ingress Tool Transfer | Exfiltration Over Other Network Medium | 1 System Shutdown/Reboot |
| Credentials | Domains | Default Accounts | 2 Command and Scripting Interpreter | 5 Windows Service | 1 DLL Side-Loading | 3 Obfuscated Files or Information | LSASS Memory | 1 Account Discovery | Remote Desktop Protocol | Data from Removable Media | 2 Encrypted Channel | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | 2 Service Execution | 1 Bootkit | 1 Access Token Manipulation | 22 Software Packing | Security Account Manager | 2 File and Directory Discovery | SMB/Windows Admin Shares | Data from Network Shared Drive | 2 Non-Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | 5 Windows Service | 1 DLL Side-Loading | NTDS | 35 System Information Discovery | Distributed Component Object Model | Input Capture | 112 Application Layer Protocol | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | 2 Process Injection | 1 Masquerading | LSA Secrets | 41 Security Software Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
| Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | 21 Virtualization/Sandbox Evasion | Cached Domain Credentials | 1 Process Discovery | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
| DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | 1 Access Token Manipulation | DCSync | 21 Virtualization/Sandbox Evasion | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
| Network Trust Dependencies | Serverless | Drive-by Compromise | Container Orchestration Job | Scheduled Task/Job | Scheduled Task/Job | 2 Process Injection | Proc Filesystem | 11 Application Window Discovery | Cloud Services | Credential API Hooking | Application Layer Protocol | Exfiltration Over Alternative Protocol | Defacement |
| Network Topology | Malvertising | Exploit Public-Facing Application | Command and Scripting Interpreter | At | At | 1 Bootkit | /etc/passwd and /etc/shadow | 3 System Owner/User Discovery | Direct Cloud VM Connections | Data Staged | Web Protocols | Exfiltration Over Symmetric Encrypted Non-C2 Protocol | Internal Defacement |
| IP Addresses | Compromise Infrastructure | Supply Chain Compromise | PowerShell | Cron | Cron | Dynamic API Resolution | Network Sniffing | 1 Remote System Discovery | Shared Webroot | Local Data Staging | File Transfer Protocols | Exfiltration Over Asymmetric Encrypted Non-C2 Protocol | External Defacement |
| Network Security Appliances | Domains | Compromise Software Dependencies and Development Tools | AppleScript | Launchd | Launchd | Stripped Payloads | Input Capture | 1 System Network Configuration Discovery | Software Deployment Tools | Remote Data Staging | Mail Protocols | Exfiltration Over Unencrypted Non-C2 Protocol | Firmware Corruption |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 16% | ReversingLabs | Win32.Trojan.Munp |
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 100% | Joe Sandbox ML | |||
| 100% | Joe Sandbox ML | |||
| 0% | ReversingLabs | |||
| 0% | ReversingLabs | |||
| 0% | ReversingLabs | |||
| 0% | ReversingLabs | |||
| 0% | ReversingLabs | |||
| 0% | ReversingLabs | |||
| 0% | ReversingLabs | |||
| 0% | ReversingLabs | |||
| 0% | ReversingLabs | |||
| 0% | ReversingLabs | |||
| 0% | ReversingLabs | |||
| 0% | ReversingLabs | |||
| 0% | ReversingLabs | |||
| 0% | ReversingLabs | |||
| 0% | ReversingLabs | |||
| 0% | ReversingLabs |
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| bwdroig.com | 185.196.8.214 | true | true | unknown |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| true |
| unknown | |
| true |
| unknown |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 185.196.8.214 | bwdroig.com | Switzerland | 34888 | SIMPLECARRER2IT | true |
| Joe Sandbox version: | 40.0.0 Tourmaline |
| Analysis ID: | 1509605 |
| Start date and time: | 2024-09-11 21:04:05 +02:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 6m 4s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 7 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | file.exe |
| Detection: | MAL |
| Classification: | mal100.troj.evad.winEXE@6/27@1/1 |
| EGA Information: |
|
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
- Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com
- Report size getting too big, too many NtDeviceIoControlFile calls found.
- Report size getting too big, too many NtQueryValueKey calls found.
- VT rate limit hit for: file.exe
| Time | Type | Description |
|---|---|---|
| 15:05:36 | API Interceptor |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 185.196.8.214 | Get hash | malicious | LummaC, Clipboard Hijacker, Cryptbot, LummaC Stealer, PureLog Stealer, RedLine, Socks5Systemz | Browse | ||
| Get hash | malicious | Socks5Systemz | Browse | |||
| Get hash | malicious | Socks5Systemz | Browse | |||
| Get hash | malicious | Socks5Systemz | Browse | |||
| Get hash | malicious | Socks5Systemz | Browse | |||
| Get hash | malicious | Socks5Systemz | Browse | |||
| Get hash | malicious | Socks5Systemz | Browse | |||
| Get hash | malicious | Socks5Systemz | Browse | |||
| Get hash | malicious | Socks5Systemz | Browse | |||
| Get hash | malicious | LummaC, PureLog Stealer, RedLine, Socks5Systemz, Stealc, Vidar, Xmrig | Browse |
⊘No context
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| SIMPLECARRER2IT | Get hash | malicious | LummaC, Clipboard Hijacker, Cryptbot, LummaC Stealer, PureLog Stealer, RedLine, Socks5Systemz | Browse |
| |
| Get hash | malicious | Socks5Systemz | Browse |
| ||
| Get hash | malicious | Socks5Systemz | Browse |
| ||
| Get hash | malicious | Socks5Systemz | Browse |
| ||
| Get hash | malicious | Socks5Systemz | Browse |
| ||
| Get hash | malicious | Socks5Systemz | Browse |
| ||
| Get hash | malicious | Socks5Systemz | Browse |
| ||
| Get hash | malicious | Socks5Systemz | Browse |
| ||
| Get hash | malicious | Socks5Systemz | Browse |
| ||
| Get hash | malicious | LummaC, PureLog Stealer, RedLine, Socks5Systemz, Stealc, Vidar, Xmrig | Browse |
|
⊘No context
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| C:\Users\user\AppData\Local\Batch AVI Converter\Qt5OpenGL.dll (copy) | Get hash | malicious | LummaC, Clipboard Hijacker, Cryptbot, LummaC Stealer, PureLog Stealer, RedLine, Socks5Systemz | Browse | ||
| Get hash | malicious | Socks5Systemz | Browse | |||
| Get hash | malicious | Socks5Systemz | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| C:\Users\user\AppData\Local\Batch AVI Converter\is-0D2S5.tmp | Get hash | malicious | LummaC, Clipboard Hijacker, Cryptbot, LummaC Stealer, PureLog Stealer, RedLine, Socks5Systemz | Browse | ||
| Get hash | malicious | Socks5Systemz | Browse | |||
| Get hash | malicious | Socks5Systemz | Browse | |||
| Get hash | malicious | Socks5Systemz | Browse | |||
| Get hash | malicious | Socks5Systemz | Browse | |||
| Get hash | malicious | Socks5Systemz | Browse | |||
| Get hash | malicious | DanaBot | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse |
| Process: | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2644388 |
| Entropy (8bit): | 6.6214078319430225 |
| Encrypted: | false |
| SSDEEP: | 24576:vh2bAqsaRXVK6ktBdb4Rm8WceEuB0RHx3hryveaNHewUa7I1sJ4W/hYd4kD2t80k:5IAqsanks023dFn0RnWOINjzdABSaK |
| MD5: | 91646D419442B59CE172BCBAE8A2A8C9 |
| SHA1: | FE2949DBB51067D70E474C5D11A744DC6F165350 |
| SHA-256: | E1C41574C9889CB05922896464BF19298129F0401174DA3FA8F107B2AD0141B5 |
| SHA-512: | D535468FADD5BDE87A8DC3FCADF1A2699E72CE9E6F7C8C1C07EEBA05ADD140AA3AED2ACBD047D8F28B97EDF0423DC61A594D707DD4B8DF1951A0ABC69DBDC395 |
| Malicious: | true |
| Antivirus: |
|
| Reputation: | low |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 8 |
| Entropy (8bit): | 2.0 |
| Encrypted: | false |
| SSDEEP: | 3:k5tn:kzn |
| MD5: | DDB4D886C3CB7434AFE7EC02169EC004 |
| SHA1: | 4E4958973F443E40E46CE44332CB7C2AB15C481E |
| SHA-256: | 9C88584ADD662B6B6FBA9B1CAA26065FB506F60F95C29B3BECE999219700F77B |
| SHA-512: | 7858F09019D71BBAC5291F7D59C5C086726E5CE10E61441C179B372B8952528485B6ED2AA8EA9ED56EBF61362CB66F8CC7093AC2F5FBD8A98B4684DBAD4F20DB |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 4 |
| Entropy (8bit): | 0.8112781244591328 |
| Encrypted: | false |
| SSDEEP: | 3:3:3 |
| MD5: | E7C62CD2306A6B991402DB2098965CBC |
| SHA1: | 33B77B9463AB2010488CDCFC5CE920E05602EE50 |
| SHA-256: | 2BAAED212BEBC4EBEEB19752C47FF7C4420ADF7806F577722B487A08B605EE13 |
| SHA-512: | B3D72EE590E359259032335B4BBC2C7C400BAD09492D341C8FC9A20908FC4C96277861C561257399BF3A2C4C88E0E15634B8CB0DEAAFD8A8E21ADB72086A6825 |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 128 |
| Entropy (8bit): | 2.9545817380615236 |
| Encrypted: | false |
| SSDEEP: | 3:SmwW3Fde9UUDrjStGs/:Smze7DPStGM |
| MD5: | 98DDA7FC0B3E548B68DE836D333D1539 |
| SHA1: | D0CB784FA2BBD3BDE2BA4400211C3B613638F1C6 |
| SHA-256: | 870555CDCBA1F066D893554731AE99A21AE776D41BCB680CBD6510CB9F420E3D |
| SHA-512: | E79BD8C2E0426DBEBA8AC2350DA66DC0413F79860611A05210905506FEF8B80A60BB7E76546B0CE9C6E6BC9DDD4BC66FF4C438548F26187EAAF6278F769B3AC1 |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 128 |
| Entropy (8bit): | 1.2701231977328944 |
| Encrypted: | false |
| SSDEEP: | 3:WAmJuXDz8/:HHzc |
| MD5: | 0D6174E4525CFDED5DD1C9440B9DC1E7 |
| SHA1: | 173EF30A035CE666278904625EADCFAE09233A47 |
| SHA-256: | 458677CDF0E1A4E87D32AB67D6A5EEA9E67CB3545D79A21A0624E6BB5E1087E7 |
| SHA-512: | 86DA96385985A1BA3D67A8676A041CA563838F474DF33D82B6ECD90C101703B30747121A6B7281E025A3C11CE28ACCEDFC94DB4E8D38E391199458056C2CD27A |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-1S2OA.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 334848 |
| Entropy (8bit): | 6.5257884005400015 |
| Encrypted: | false |
| SSDEEP: | 6144:JmuFcP82IqE5RSbvQpYVgMW2i32blpDW2pmoZ1:JmuFc02IqE7SbLVgR1O |
| MD5: | C1D465E061D7D02895DAEB19BDB28AC9 |
| SHA1: | 5E729EE51DF080545C7031D771B85094A2B2D4E9 |
| SHA-256: | 777917D30F277A9E88D8FC04E69B955A2B0BD3F2BCF2E36F7F9CFFEF2583EE60 |
| SHA-512: | 438ADAA0AC3AD47621D288E3FF56493CC7DE4E2A89FC5420E246A6045DB79E7CB84A28D3F3420841340AB33BD632F12FDC3A4E9D8EF99601CA9F975B7F8309E1 |
| Malicious: | false |
| Antivirus: |
|
| Joe Sandbox View: | |
| Reputation: | low |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-1S2OA.tmp\file.tmp |
| File Type: | |
| Category: | modified |
| Size (bytes): | 2644388 |
| Entropy (8bit): | 6.6214078319430225 |
| Encrypted: | false |
| SSDEEP: | 24576:vh2bAqsaRXVK6ktBdb4Rm8WceEuB0RHx3hryveaNHewUa7I1sJ4W/hYd4kD2t80k:5IAqsanks023dFn0RnWOINjzdABSaK |
| MD5: | 91646D419442B59CE172BCBAE8A2A8C9 |
| SHA1: | FE2949DBB51067D70E474C5D11A744DC6F165350 |
| SHA-256: | E1C41574C9889CB05922896464BF19298129F0401174DA3FA8F107B2AD0141B5 |
| SHA-512: | D535468FADD5BDE87A8DC3FCADF1A2699E72CE9E6F7C8C1C07EEBA05ADD140AA3AED2ACBD047D8F28B97EDF0423DC61A594D707DD4B8DF1951A0ABC69DBDC395 |
| Malicious: | true |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-1S2OA.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 499712 |
| Entropy (8bit): | 6.414789978441117 |
| Encrypted: | false |
| SSDEEP: | 12288:fJzxYPVsBnxO/R7krZhUgiW6QR7t5k3Ooc8iHkC2eq:fZxvBnxOJ7ki3Ooc8iHkC2e |
| MD5: | 561FA2ABB31DFA8FAB762145F81667C2 |
| SHA1: | C8CCB04EEDAC821A13FAE314A2435192860C72B8 |
| SHA-256: | DF96156F6A548FD6FE5672918DE5AE4509D3C810A57BFFD2A91DE45A3ED5B23B |
| SHA-512: | 7D960AA8E3CCE22D63A6723D7F00C195DE7DE83B877ECA126E339E2D8CC9859E813E05C5C0A5671A75BB717243E9295FD13E5E17D8C6660EB59F5BAEE63A7C43 |
| Malicious: | false |
| Antivirus: |
|
| Joe Sandbox View: |
|
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-1S2OA.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2644388 |
| Entropy (8bit): | 6.621407877657935 |
| Encrypted: | false |
| SSDEEP: | 24576:4h2bAqsaRXVK6ktBdb4Rm8WceEuB0RHx3hryveaNHewUa7I1sJ4W/hYd4kD2t80k:UIAqsanks023dFn0RnWOINjzdABSaK |
| MD5: | 0DD5C324D490B0668ED4F13C33090DD9 |
| SHA1: | CBEED0B207CCD1E94D085D9D48B7C17007C29AC1 |
| SHA-256: | 16102665BB0AB5919913534901D43A8CC7F013FABB5D497E7AEF7DE10DEC231A |
| SHA-512: | 14FB27DD16FBF15C9734A280B393B73C533A085C261AD22C587EF07223A86FF35C59A630878B99E2671A2A29945982E5D62561F34C009E592B9958EABD7D8D1E |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-1S2OA.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 719720 |
| Entropy (8bit): | 6.620042925263483 |
| Encrypted: | false |
| SSDEEP: | 12288:ST+z0ucMr64M+yiwUqfWY/EThHzgOXfpwN9Cu66vLHL1e13XYFU8HtUDsMBPxtFe:FPAeKLL1e6kpqsookesEiU1xJycD4R1z |
| MD5: | 20B6B06BBD211A8ACFE51193653E4167 |
| SHA1: | 817D442B46DD6F35FD9641E0C7262C934ED76848 |
| SHA-256: | 7A16E6ED0C0A49AEB8EA4972600A7A1422C92550602A150634B1C221F79300B4 |
| SHA-512: | 0F0C31D46E7274F28F62AFBBB4A172CB088AF40F6C71A56297B08D83D16548C0A4FDA4CF5F4A29C1445EEDF15FE81FC405E2EB8680F92C744406D031A05A72C8 |
| Malicious: | true |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-1S2OA.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 717985 |
| Entropy (8bit): | 6.514913383862237 |
| Encrypted: | false |
| SSDEEP: | 12288:6TPcYn5c/rPx37/zHBA6a5UeYpthr1CERAgrNuR+aIq5MRxyFA:SPcYn5c/rPx37/zHBA6pFptZ1CELqMRJ |
| MD5: | B07AF47E786B74FA5BD4F50FB05090A4 |
| SHA1: | E14A663A6E0CCC6D0D767178053740CDAC1B5A84 |
| SHA-256: | 60481C96BCE7CBB54A8ACF839416CEE2718E4FA7A9720DFE70972E1B5ED12E9F |
| SHA-512: | 47E44D559485865EAE1E23BFCC9FE512DFA00D6278553C0AD3168B426A1DE9B400811A058E3DC23B349A16DD030410A4F530DECADF37352E12C43A3F20F37E2A |
| Malicious: | true |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-1S2OA.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 334848 |
| Entropy (8bit): | 6.5257884005400015 |
| Encrypted: | false |
| SSDEEP: | 6144:JmuFcP82IqE5RSbvQpYVgMW2i32blpDW2pmoZ1:JmuFc02IqE7SbLVgR1O |
| MD5: | C1D465E061D7D02895DAEB19BDB28AC9 |
| SHA1: | 5E729EE51DF080545C7031D771B85094A2B2D4E9 |
| SHA-256: | 777917D30F277A9E88D8FC04E69B955A2B0BD3F2BCF2E36F7F9CFFEF2583EE60 |
| SHA-512: | 438ADAA0AC3AD47621D288E3FF56493CC7DE4E2A89FC5420E246A6045DB79E7CB84A28D3F3420841340AB33BD632F12FDC3A4E9D8EF99601CA9F975B7F8309E1 |
| Malicious: | false |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-1S2OA.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 392048 |
| Entropy (8bit): | 6.542831007177094 |
| Encrypted: | false |
| SSDEEP: | 6144:1eIwnft+S34NVSTjMFR+oVbKQfbno1/1oz6i2EDSD4I+XdtQXGMiFcoOjAWcIhbl:1eIwnft+S34NVSTQD+oVbKQfrC/1ct25 |
| MD5: | EE856A00410ECED8CC609936D01F954E |
| SHA1: | 705D378626AEC86FECFDF04C86244006BC3AF431 |
| SHA-256: | B6192300D3C1476EF3C25A368D055AA401035E78F9F6DBE5F93C84D36EF1FA62 |
| SHA-512: | 666D731247DAEAE4B57925DFA8CAE845327FD34E0F6B9AAD1BCF471D1800D7E8AF5642A5FB6E0EC58BA3AC7DD98A6D3FE0B473F34C16FFB9985621C98C0463EF |
| Malicious: | true |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-1S2OA.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1471856 |
| Entropy (8bit): | 6.8308189184145665 |
| Encrypted: | false |
| SSDEEP: | 24576:6PQ+KpPa3kPjWWJy+0PX7PM6ZB9In8QmMMWwI6/I+no9R2aFVWKZxPo89/xc3lRc:brWW0jnMVpUBuwemQnGP8RqYr1mpbk3 |
| MD5: | A236287C42F921D109475D47E9DCAC2B |
| SHA1: | 6D7C177A0AC3076383669BCE46608EB4B6B787EC |
| SHA-256: | 63AA600A7C914C2D59280069169CC93E750E42C9A1146E238C9128E073D578FD |
| SHA-512: | C325B12235AD77937E3799F1406EB6AA3BC5479BFDFF0EA2F2178FE243E63689AC37BB539ADCBB326B0DE6C09B884771AD57F59184A5B69065682855382ADD8A |
| Malicious: | true |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-1S2OA.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 348160 |
| Entropy (8bit): | 6.542655141037356 |
| Encrypted: | false |
| SSDEEP: | 6144:OcV9z83OtqxnEYmt3NEnvfF+Tbmbw6An8FMciFMNrb3YgxxpbCAOxO2ElvlE:Ooz83OtIEzW+/m/AyF7bCrO/E |
| MD5: | 86F1895AE8C5E8B17D99ECE768A70732 |
| SHA1: | D5502A1D00787D68F548DDEEBBDE1ECA5E2B38CA |
| SHA-256: | 8094AF5EE310714CAEBCCAEEE7769FFB08048503BA478B879EDFEF5F1A24FEFE |
| SHA-512: | 3B7CE2B67056B6E005472B73447D2226677A8CADAE70428873F7EFA5ED11A3B3DBF6B1A42C5B05B1F2B1D8E06FF50DFC6532F043AF8452ED87687EEFBF1791DA |
| Malicious: | false |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-1S2OA.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1471856 |
| Entropy (8bit): | 6.8308189184145665 |
| Encrypted: | false |
| SSDEEP: | 24576:6PQ+KpPa3kPjWWJy+0PX7PM6ZB9In8QmMMWwI6/I+no9R2aFVWKZxPo89/xc3lRc:brWW0jnMVpUBuwemQnGP8RqYr1mpbk3 |
| MD5: | A236287C42F921D109475D47E9DCAC2B |
| SHA1: | 6D7C177A0AC3076383669BCE46608EB4B6B787EC |
| SHA-256: | 63AA600A7C914C2D59280069169CC93E750E42C9A1146E238C9128E073D578FD |
| SHA-512: | C325B12235AD77937E3799F1406EB6AA3BC5479BFDFF0EA2F2178FE243E63689AC37BB539ADCBB326B0DE6C09B884771AD57F59184A5B69065682855382ADD8A |
| Malicious: | true |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-1S2OA.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 719720 |
| Entropy (8bit): | 6.620042925263483 |
| Encrypted: | false |
| SSDEEP: | 12288:ST+z0ucMr64M+yiwUqfWY/EThHzgOXfpwN9Cu66vLHL1e13XYFU8HtUDsMBPxtFe:FPAeKLL1e6kpqsookesEiU1xJycD4R1z |
| MD5: | 20B6B06BBD211A8ACFE51193653E4167 |
| SHA1: | 817D442B46DD6F35FD9641E0C7262C934ED76848 |
| SHA-256: | 7A16E6ED0C0A49AEB8EA4972600A7A1422C92550602A150634B1C221F79300B4 |
| SHA-512: | 0F0C31D46E7274F28F62AFBBB4A172CB088AF40F6C71A56297B08D83D16548C0A4FDA4CF5F4A29C1445EEDF15FE81FC405E2EB8680F92C744406D031A05A72C8 |
| Malicious: | true |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-1S2OA.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 499712 |
| Entropy (8bit): | 6.414789978441117 |
| Encrypted: | false |
| SSDEEP: | 12288:fJzxYPVsBnxO/R7krZhUgiW6QR7t5k3Ooc8iHkC2eq:fZxvBnxOJ7ki3Ooc8iHkC2e |
| MD5: | 561FA2ABB31DFA8FAB762145F81667C2 |
| SHA1: | C8CCB04EEDAC821A13FAE314A2435192860C72B8 |
| SHA-256: | DF96156F6A548FD6FE5672918DE5AE4509D3C810A57BFFD2A91DE45A3ED5B23B |
| SHA-512: | 7D960AA8E3CCE22D63A6723D7F00C195DE7DE83B877ECA126E339E2D8CC9859E813E05C5C0A5671A75BB717243E9295FD13E5E17D8C6660EB59F5BAEE63A7C43 |
| Malicious: | false |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-1S2OA.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 348160 |
| Entropy (8bit): | 6.542655141037356 |
| Encrypted: | false |
| SSDEEP: | 6144:OcV9z83OtqxnEYmt3NEnvfF+Tbmbw6An8FMciFMNrb3YgxxpbCAOxO2ElvlE:Ooz83OtIEzW+/m/AyF7bCrO/E |
| MD5: | 86F1895AE8C5E8B17D99ECE768A70732 |
| SHA1: | D5502A1D00787D68F548DDEEBBDE1ECA5E2B38CA |
| SHA-256: | 8094AF5EE310714CAEBCCAEEE7769FFB08048503BA478B879EDFEF5F1A24FEFE |
| SHA-512: | 3B7CE2B67056B6E005472B73447D2226677A8CADAE70428873F7EFA5ED11A3B3DBF6B1A42C5B05B1F2B1D8E06FF50DFC6532F043AF8452ED87687EEFBF1791DA |
| Malicious: | false |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-1S2OA.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 392048 |
| Entropy (8bit): | 6.542831007177094 |
| Encrypted: | false |
| SSDEEP: | 6144:1eIwnft+S34NVSTjMFR+oVbKQfbno1/1oz6i2EDSD4I+XdtQXGMiFcoOjAWcIhbl:1eIwnft+S34NVSTQD+oVbKQfrC/1ct25 |
| MD5: | EE856A00410ECED8CC609936D01F954E |
| SHA1: | 705D378626AEC86FECFDF04C86244006BC3AF431 |
| SHA-256: | B6192300D3C1476EF3C25A368D055AA401035E78F9F6DBE5F93C84D36EF1FA62 |
| SHA-512: | 666D731247DAEAE4B57925DFA8CAE845327FD34E0F6B9AAD1BCF471D1800D7E8AF5642A5FB6E0EC58BA3AC7DD98A6D3FE0B473F34C16FFB9985621C98C0463EF |
| Malicious: | true |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-1S2OA.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 4489 |
| Entropy (8bit): | 4.630872219335591 |
| Encrypted: | false |
| SSDEEP: | 96:899zgNdWO38Dp0edSG9U+eOIhUEmD/QH4cVSQs0L+Q4u424V4S4M424cUIz:8998dWO3op0edRHIhUEmzQYcVSQ1+Qla |
| MD5: | E01145EE3B3B89226E6116EBC0C6B453 |
| SHA1: | F58A9967077BEC22F3275745ED4E639306065EE8 |
| SHA-256: | 557AACD4007C59F4975F0FD735F1E4B8938757EF5A0416F5E82291571871455A |
| SHA-512: | 99108BC1FACBDFE71A1505B499DD8F1D5BF2F8E329B972A4ACD6009954A76BBA48BAA9F764EEE631BCF3F145B67BC140DD4A1394DFB3716A07AEFE74D44EFEF4 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-1S2OA.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 717985 |
| Entropy (8bit): | 6.514913383862237 |
| Encrypted: | false |
| SSDEEP: | 12288:6TPcYn5c/rPx37/zHBA6a5UeYpthr1CERAgrNuR+aIq5MRxyFA:SPcYn5c/rPx37/zHBA6pFptZ1CELqMRJ |
| MD5: | B07AF47E786B74FA5BD4F50FB05090A4 |
| SHA1: | E14A663A6E0CCC6D0D767178053740CDAC1B5A84 |
| SHA-256: | 60481C96BCE7CBB54A8ACF839416CEE2718E4FA7A9720DFE70972E1B5ED12E9F |
| SHA-512: | 47E44D559485865EAE1E23BFCC9FE512DFA00D6278553C0AD3168B426A1DE9B400811A058E3DC23B349A16DD030410A4F530DECADF37352E12C43A3F20F37E2A |
| Malicious: | true |
| Preview: |
| Process: | C:\Users\user\Desktop\file.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 706560 |
| Entropy (8bit): | 6.5063706111129225 |
| Encrypted: | false |
| SSDEEP: | 12288:yTPcYn5c/rPx37/zHBA6a5UeYpthr1CERAgrNuR+aIq5MRxyF:6PcYn5c/rPx37/zHBA6pFptZ1CELqMRU |
| MD5: | F02C8C4B73C31FD56FD90DC77235363B |
| SHA1: | 8438360794AB53372730AFAFC976925B51D135AB |
| SHA-256: | 8A8EEBE5D778B9DA7C563719CDE8DAC42B9D0C534827A5F979A6C09E3834B351 |
| SHA-512: | 3A8238A412EBC9574F1C34EE8371F0C49DCBEC43AA674EAAA98DAE11280B1046C94F7545DAD5B87D7AE29B34BB78E18FDD17D982915D99F2FAE113AC96D30E66 |
| Malicious: | true |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-1S2OA.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2560 |
| Entropy (8bit): | 2.8818118453929262 |
| Encrypted: | false |
| SSDEEP: | 24:e1GSgDIX566lIB6SXvVmMPUjvhBrDsqZ:SgDKRlVImgUNBsG |
| MD5: | A69559718AB506675E907FE49DEB71E9 |
| SHA1: | BC8F404FFDB1960B50C12FF9413C893B56F2E36F |
| SHA-256: | 2F6294F9AA09F59A574B5DCD33BE54E16B39377984F3D5658CDA44950FA0F8FC |
| SHA-512: | E52E0AA7FE3F79E36330C455D944653D449BA05B2F9ABEE0914A0910C3452CFA679A40441F9AC696B3CCF9445CBB85095747E86153402FC362BB30AC08249A63 |
| Malicious: | true |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-1S2OA.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 13312 |
| Entropy (8bit): | 5.745960477552938 |
| Encrypted: | false |
| SSDEEP: | 384:BXvhMwoSitz/bjx7yxnbdn+EHvbsHoOODCg:BZ7FEAbd+EDsIO |
| MD5: | A813D18268AFFD4763DDE940246DC7E5 |
| SHA1: | C7366E1FD925C17CC6068001BD38EAEF5B42852F |
| SHA-256: | E19781AABE466DD8779CB9C8FA41BBB73375447066BB34E876CF388A6ED63C64 |
| SHA-512: | B310ED4CD2E94381C00A6A370FCB7CC867EBE425D705B69CAAAAFFDAFBAB91F72D357966916053E72E68ECF712F2AF7585500C58BB53EC3E1D539179FCB45FB4 |
| Malicious: | true |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-1S2OA.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 6144 |
| Entropy (8bit): | 4.289297026665552 |
| Encrypted: | false |
| SSDEEP: | 48:Sv1LfWvPcXegCPUo1vlZQrAxoONfHFZONfH3d1xCWMBFNL2pGSS4k+bkg6j0KHc:wfkcXegaJ/ZAYNzcld1xaX12pfSKvkc |
| MD5: | C8871EFD8AF2CF4D9D42D1FF8FADBF89 |
| SHA1: | D0EACD5322C036554D509C7566F0BCC7607209BD |
| SHA-256: | E4FC574A01B272C2D0AED0EC813F6D75212E2A15A5F5C417129DD65D69768F40 |
| SHA-512: | 2735BB610060F749E26ACD86F2DF2B8A05F2BDD3DCCF3E4B2946EBB21BA0805FB492C474B1EEB2C5B8BF1A421F7C1B8728245F649C644F4A9ECC5BD8770A16F6 |
| Malicious: | true |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-1S2OA.tmp\file.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 23312 |
| Entropy (8bit): | 4.596242908851566 |
| Encrypted: | false |
| SSDEEP: | 384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4 |
| MD5: | 92DC6EF532FBB4A5C3201469A5B5EB63 |
| SHA1: | 3E89FF837147C16B4E41C30D6C796374E0B8E62C |
| SHA-256: | 9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87 |
| SHA-512: | 9908E573921D5DBC3454A1C0A6C969AB8A81CC2E8B5385391D46B1A738FB06A76AA3282E0E58D0D2FFA6F27C85668CD5178E1500B8A39B1BBAE04366AE6A86D3 |
| Malicious: | false |
| Antivirus: |
|
| Preview: |
| File type: | |
| Entropy (8bit): | 7.997770334607748 |
| TrID: |
|
| File name: | file.exe |
| File size: | 3'488'773 bytes |
| MD5: | 984c885de9fea28a60a25b278f424f50 |
| SHA1: | 5971c05829104cb0dd47de9fb8806762c141f081 |
| SHA256: | 5fe11452c901b9eb15809a33ecc6bb94c9d1ec87553708eac94ad19969cbaa8c |
| SHA512: | 8a2df01a795ede330f7d05b97e79ca48bff366c2ea9d3dbc27dbda9d6435e5cf4208019f97f104a23138c5681a173245557daf8749697263e6966d98213db18b |
| SSDEEP: | 49152:C9e8wILoaKF9q/1t2GpCKqsA15dXEGGgXH9AJ1ukBb1DGdg1TK2l7fghCy:M5w17ou5GgXH9AXz1e2BIky |
| TLSH: | 80F5332026444F31E0B397BA2F19E62562273ED622B86822F7D4663DCF3F5598433776 |
| File Content Preview: | MZP.....................@...............................................!..L.!..This program must be run under Win32..$7....................................................................................................................................... |
 | |
| Icon Hash: | 2d2e3797b32b2b99 |
| Entrypoint: | 0x40a5f8 |
| Entrypoint Section: | CODE |
| Digitally signed: | false |
| Imagebase: | 0x400000 |
| Subsystem: | windows gui |
| Image File Characteristics: | RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI |
| DLL Characteristics: | TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 1 |
| OS Version Minor: | 0 |
| File Version Major: | 1 |
| File Version Minor: | 0 |
| Subsystem Version Major: | 1 |
| Subsystem Version Minor: | 0 |
| Import Hash: | 884310b1928934402ea6fec1dbd3cf5e |
| Instruction |
|---|
| push ebp |
| mov ebp, esp |
| add esp, FFFFFFC4h |
| push ebx |
| push esi |
| push edi |
| xor eax, eax |
| mov dword ptr [ebp-10h], eax |
| mov dword ptr [ebp-24h], eax |
| call 00007F749083F333h |
| call 00007F749084053Ah |
| call 00007F74908407C9h |
| call 00007F749084086Ch |
| call 00007F749084280Bh |
| call 00007F7490845176h |
| call 00007F74908452DDh |
| xor eax, eax |
| push ebp |
| push 0040ACC9h |
| push dword ptr fs:[eax] |
| mov dword ptr fs:[eax], esp |
| xor edx, edx |
| push ebp |
| push 0040AC92h |
| push dword ptr fs:[edx] |
| mov dword ptr fs:[edx], esp |
| mov eax, dword ptr [0040C014h] |
| call 00007F7490845D8Bh |
| call 00007F7490845976h |
| cmp byte ptr [0040B234h], 00000000h |
| je 00007F749084686Eh |
| call 00007F7490845E88h |
| xor eax, eax |
| call 00007F7490840029h |
| lea edx, dword ptr [ebp-10h] |
| xor eax, eax |
| call 00007F7490842E1Bh |
| mov edx, dword ptr [ebp-10h] |
| mov eax, 0040CE28h |
| call 00007F749083F3CAh |
| push 00000002h |
| push 00000000h |
| push 00000001h |
| mov ecx, dword ptr [0040CE28h] |
| mov dl, 01h |
| mov eax, 0040738Ch |
| call 00007F74908436AAh |
| mov dword ptr [0040CE2Ch], eax |
| xor edx, edx |
| push ebp |
| push 0040AC4Ah |
| push dword ptr fs:[edx] |
| mov dword ptr fs:[edx], esp |
| call 00007F7490845DE6h |
| mov dword ptr [0040CE34h], eax |
| mov eax, dword ptr [0040CE34h] |
| cmp dword ptr [eax+0Ch], 00000000h |
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0xd000 | 0x950 | .idata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x11000 | 0x2c00 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0xf000 | 0x18 | .rdata |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| CODE | 0x1000 | 0x9d30 | 0x9e00 | c3bd95c4b1a8e5199981e0d9b45fd18c | False | 0.6052709651898734 | data | 6.631765876950794 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| DATA | 0xb000 | 0x250 | 0x400 | 1ee71d84f1c77af85f1f5c278f880572 | False | 0.306640625 | data | 2.751820662285145 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| BSS | 0xc000 | 0xe8c | 0x0 | d41d8cd98f00b204e9800998ecf8427e | False | 0 | empty | 0.0 | IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .idata | 0xd000 | 0x950 | 0xa00 | bb5485bf968b970e5ea81292af2acdba | False | 0.414453125 | data | 4.430733069799036 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .tls | 0xe000 | 0x8 | 0x0 | d41d8cd98f00b204e9800998ecf8427e | False | 0 | empty | 0.0 | IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .rdata | 0xf000 | 0x18 | 0x200 | 9ba824905bf9c7922b6fc87a38b74366 | False | 0.052734375 | data | 0.2044881574398449 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ |
| .reloc | 0x10000 | 0x8c4 | 0x0 | d41d8cd98f00b204e9800998ecf8427e | False | 0 | empty | 0.0 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ |
| .rsrc | 0x11000 | 0x2c00 | 0x2c00 | c7a535967b01f9cfbd01353f9d5b9d89 | False | 0.32563920454545453 | data | 4.49363155636498 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| RT_ICON | 0x11354 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 192 | Dutch | Netherlands | 0.5675675675675675 |
| RT_ICON | 0x1147c | 0x568 | Device independent bitmap graphic, 16 x 32 x 8, image size 320 | Dutch | Netherlands | 0.4486994219653179 |
| RT_ICON | 0x119e4 | 0x2e8 | Device independent bitmap graphic, 32 x 64 x 4, image size 640 | Dutch | Netherlands | 0.4637096774193548 |
| RT_ICON | 0x11ccc | 0x8a8 | Device independent bitmap graphic, 32 x 64 x 8, image size 1152 | Dutch | Netherlands | 0.3935018050541516 |
| RT_STRING | 0x12574 | 0x2f2 | data | 0.35543766578249336 | ||
| RT_STRING | 0x12868 | 0x30c | data | 0.3871794871794872 | ||
| RT_STRING | 0x12b74 | 0x2ce | data | 0.42618384401114207 | ||
| RT_STRING | 0x12e44 | 0x68 | data | 0.75 | ||
| RT_STRING | 0x12eac | 0xb4 | data | 0.6277777777777778 | ||
| RT_STRING | 0x12f60 | 0xae | data | 0.5344827586206896 | ||
| RT_RCDATA | 0x13010 | 0x2c | data | 1.1818181818181819 | ||
| RT_GROUP_ICON | 0x1303c | 0x3e | data | English | United States | 0.8387096774193549 |
| RT_VERSION | 0x1307c | 0x4f4 | data | English | United States | 0.2618296529968454 |
| RT_MANIFEST | 0x13570 | 0x5a4 | XML 1.0 document, ASCII text, with CRLF line terminators | English | United States | 0.42590027700831024 |
| DLL | Import |
|---|---|
| kernel32.dll | DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, WideCharToMultiByte, TlsSetValue, TlsGetValue, MultiByteToWideChar, GetModuleHandleA, GetLastError, GetCommandLineA, WriteFile, SetFilePointer, SetEndOfFile, RtlUnwind, ReadFile, RaiseException, GetStdHandle, GetFileSize, GetSystemTime, GetFileType, ExitProcess, CreateFileA, CloseHandle |
| user32.dll | MessageBoxA |
| oleaut32.dll | VariantChangeTypeEx, VariantCopyInd, VariantClear, SysStringLen, SysAllocStringLen |
| advapi32.dll | RegQueryValueExA, RegOpenKeyExA, RegCloseKey, OpenProcessToken, LookupPrivilegeValueA |
| kernel32.dll | WriteFile, VirtualQuery, VirtualProtect, VirtualFree, VirtualAlloc, Sleep, SizeofResource, SetLastError, SetFilePointer, SetErrorMode, SetEndOfFile, RemoveDirectoryA, ReadFile, LockResource, LoadResource, LoadLibraryA, IsDBCSLeadByte, GetWindowsDirectoryA, GetVersionExA, GetUserDefaultLangID, GetSystemInfo, GetSystemDefaultLCID, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLastError, GetFullPathNameA, GetFileSize, GetFileAttributesA, GetExitCodeProcess, GetEnvironmentVariableA, GetCurrentProcess, GetCommandLineA, GetACP, InterlockedExchange, FormatMessageA, FindResourceA, DeleteFileA, CreateProcessA, CreateFileA, CreateDirectoryA, CloseHandle |
| user32.dll | TranslateMessage, SetWindowLongA, PeekMessageA, MsgWaitForMultipleObjects, MessageBoxA, LoadStringA, ExitWindowsEx, DispatchMessageA, DestroyWindow, CreateWindowExA, CallWindowProcA, CharPrevA |
| comctl32.dll | InitCommonControls |
| advapi32.dll | AdjustTokenPrivileges |
| Language of compilation system | Country where language is spoken | Map |
|---|---|---|
| Dutch | Netherlands |  |
| English | United States |  |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | SID | Signature | Severity | Source IP | Source Port | Dest IP | Dest Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2024-09-11T21:05:56.592753+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49694 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:05:56.945730+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49694 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:05:57.759019+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49695 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:05:58.587230+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49696 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:05:59.436703+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49698 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:05:59.808909+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49698 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:00.173237+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49698 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:04.025367+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49699 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:04.856670+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49700 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:05.212808+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49700 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:06.172922+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49701 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:07.015813+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49705 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:07.862918+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49706 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:08.685168+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49708 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:09.037740+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49708 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:09.851395+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49710 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:11.069617+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49711 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:11.896319+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49712 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:12.773663+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49713 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:13.605918+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49714 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:14.458614+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49715 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:15.308093+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49716 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:15.657816+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49716 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:16.511272+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49717 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:16.890327+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49717 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:17.260660+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49717 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:18.082965+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49718 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:18.905971+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49719 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:19.748752+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49720 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:20.096601+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49720 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:20.936229+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49721 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:21.296599+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49721 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:22.198017+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49722 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:22.998760+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49723 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:23.356736+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49723 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:23.709679+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49723 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:24.545349+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49724 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:24.913525+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49724 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:25.760563+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49725 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:26.218181+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49725 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:26.568628+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49725 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:27.422938+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49726 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:27.778832+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49726 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:28.137634+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49726 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:28.493940+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49726 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:29.319896+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49727 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:30.164158+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49728 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:31.118017+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49729 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:31.961080+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49730 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:33.084848+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49731 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:33.902633+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49732 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:34.288980+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49732 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:35.098906+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49733 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:35.918371+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49734 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:36.274434+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49734 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:37.246858+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49735 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:37.594424+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49735 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:37.940100+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49735 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:38.788211+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49736 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:39.632773+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49737 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:40.485386+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49738 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:40.839571+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49738 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:41.199616+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49738 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:41.796373+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49738 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:42.152596+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49738 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:42.687249+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49738 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:43.040861+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49738 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:43.864891+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49739 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:44.711438+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49740 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:45.545838+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49741 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:45.897834+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49741 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:46.723627+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49742 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:47.539506+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49743 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:48.660925+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49744 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:49.481618+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49745 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:50.341493+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49746 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:50.706826+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49746 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:51.549357+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49747 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:52.389623+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49748 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:53.198866+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49749 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:53.551402+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49749 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:54.402867+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49750 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:54.765378+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49750 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:55.585127+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49751 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:56.428401+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49752 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:57.264250+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49753 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:58.076172+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49754 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:58.906526+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49755 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:06:59.848506+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49756 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:07:00.991707+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49757 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:07:01.839737+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49758 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:07:02.669331+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49759 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:07:03.550461+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49760 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:07:04.444123+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49761 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:07:05.339435+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49762 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:07:06.175896+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49763 | 185.196.8.214 | 80 | TCP |
| 2024-09-11T21:07:07.004269+0200 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.5 | 49764 | 185.196.8.214 | 80 | TCP |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Sep 11, 2024 21:05:55.892261028 CEST | 49694 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:05:55.897249937 CEST | 80 | 49694 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:05:55.897490978 CEST | 49694 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:05:55.897671938 CEST | 49694 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:05:55.902595043 CEST | 80 | 49694 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:05:56.592645884 CEST | 80 | 49694 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:05:56.592752934 CEST | 49694 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:05:56.702069044 CEST | 49694 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:05:56.707371950 CEST | 80 | 49694 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:05:56.945528984 CEST | 80 | 49694 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:05:56.945729971 CEST | 49694 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:05:57.061623096 CEST | 49694 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:05:57.062094927 CEST | 49695 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:05:57.067312002 CEST | 80 | 49694 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:05:57.067435026 CEST | 80 | 49695 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:05:57.067451000 CEST | 49694 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:05:57.067595005 CEST | 49695 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:05:57.067815065 CEST | 49695 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:05:57.072933912 CEST | 80 | 49695 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:05:57.758820057 CEST | 80 | 49695 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:05:57.759018898 CEST | 49695 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:05:57.874769926 CEST | 49695 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:05:57.875134945 CEST | 49696 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:05:57.880140066 CEST | 80 | 49695 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:05:57.880186081 CEST | 80 | 49696 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:05:57.880237103 CEST | 49695 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:05:57.880286932 CEST | 49696 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:05:57.880429029 CEST | 49696 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:05:57.885328054 CEST | 80 | 49696 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:05:58.587096930 CEST | 80 | 49696 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:05:58.587229967 CEST | 49696 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:05:58.701725006 CEST | 49696 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:05:58.701984882 CEST | 49698 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:05:58.707294941 CEST | 80 | 49696 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:05:58.707333088 CEST | 80 | 49698 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:05:58.707374096 CEST | 49696 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:05:58.707407951 CEST | 49698 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:05:58.707561016 CEST | 49698 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:05:58.712817907 CEST | 80 | 49698 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:05:59.436620951 CEST | 80 | 49698 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:05:59.436702967 CEST | 49698 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:05:59.545393944 CEST | 49698 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:05:59.550410986 CEST | 80 | 49698 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:05:59.808842897 CEST | 80 | 49698 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:05:59.808908939 CEST | 49698 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:05:59.920454025 CEST | 49698 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:05:59.925488949 CEST | 80 | 49698 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:00.172555923 CEST | 80 | 49698 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:00.173237085 CEST | 49698 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:00.295784950 CEST | 49698 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:00.296066046 CEST | 49699 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:00.301093102 CEST | 80 | 49699 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:00.301256895 CEST | 49699 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:00.301341057 CEST | 49699 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:00.301780939 CEST | 80 | 49698 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:00.301845074 CEST | 49698 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:00.306479931 CEST | 80 | 49699 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:04.025146961 CEST | 80 | 49699 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:04.025367022 CEST | 49699 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:04.139446974 CEST | 49699 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:04.139848948 CEST | 49700 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:04.145023108 CEST | 80 | 49699 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:04.145050049 CEST | 80 | 49700 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:04.145097017 CEST | 49699 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:04.145143986 CEST | 49700 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:04.145266056 CEST | 49700 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:04.150393963 CEST | 80 | 49700 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:04.856555939 CEST | 80 | 49700 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:04.856669903 CEST | 49700 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:04.967935085 CEST | 49700 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:04.972755909 CEST | 80 | 49700 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:05.212599993 CEST | 80 | 49700 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:05.212807894 CEST | 49700 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:05.327626944 CEST | 49700 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:05.328061104 CEST | 49701 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:05.332868099 CEST | 80 | 49700 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:05.332940102 CEST | 80 | 49701 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:05.332962990 CEST | 49700 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:05.333039045 CEST | 49701 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:05.333175898 CEST | 49701 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:05.338212013 CEST | 80 | 49701 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:06.172828913 CEST | 80 | 49701 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:06.172921896 CEST | 49701 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:06.295403004 CEST | 49701 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:06.295757055 CEST | 49705 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:06.300642014 CEST | 80 | 49705 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:06.300733089 CEST | 49705 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:06.300848007 CEST | 49705 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:06.301052094 CEST | 80 | 49701 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:06.301110983 CEST | 49701 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:06.305634975 CEST | 80 | 49705 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:07.015593052 CEST | 80 | 49705 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:07.015813112 CEST | 49705 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:07.139375925 CEST | 49705 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:07.139594078 CEST | 49706 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:07.145122051 CEST | 80 | 49706 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:07.145170927 CEST | 80 | 49705 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:07.145343065 CEST | 49705 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:07.145343065 CEST | 49706 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:07.145529032 CEST | 49706 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:07.155440092 CEST | 80 | 49706 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:07.862838984 CEST | 80 | 49706 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:07.862917900 CEST | 49706 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:07.983031034 CEST | 49706 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:07.983377934 CEST | 49708 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:07.992414951 CEST | 80 | 49708 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:07.992510080 CEST | 80 | 49706 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:07.992608070 CEST | 49706 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:07.992744923 CEST | 49708 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:07.992779016 CEST | 49708 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:07.998164892 CEST | 80 | 49708 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:08.685074091 CEST | 80 | 49708 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:08.685168028 CEST | 49708 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:08.796487093 CEST | 49708 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:08.801714897 CEST | 80 | 49708 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:09.037638903 CEST | 80 | 49708 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:09.037739992 CEST | 49708 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:09.156369925 CEST | 49708 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:09.156631947 CEST | 49710 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:09.161539078 CEST | 80 | 49710 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:09.161611080 CEST | 49710 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:09.161645889 CEST | 80 | 49708 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:09.161700010 CEST | 49708 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:09.161799908 CEST | 49710 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:09.166553974 CEST | 80 | 49710 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:09.851246119 CEST | 80 | 49710 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:09.851394892 CEST | 49710 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:09.971961975 CEST | 49710 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:09.972471952 CEST | 49711 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:09.977562904 CEST | 80 | 49710 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:09.977607965 CEST | 80 | 49711 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:09.977767944 CEST | 49710 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:09.977768898 CEST | 49711 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:09.978030920 CEST | 49711 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:09.983011961 CEST | 80 | 49711 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:11.069535017 CEST | 80 | 49711 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:11.069617033 CEST | 49711 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:11.188045979 CEST | 49711 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:11.188544989 CEST | 49712 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:11.198738098 CEST | 80 | 49711 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:11.198774099 CEST | 80 | 49712 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:11.198820114 CEST | 49711 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:11.198934078 CEST | 49712 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:11.199140072 CEST | 49712 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:11.209758997 CEST | 80 | 49712 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:11.896188974 CEST | 80 | 49712 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:11.896318913 CEST | 49712 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:12.022677898 CEST | 49712 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:12.023061991 CEST | 49713 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:12.029306889 CEST | 80 | 49712 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:12.029392004 CEST | 49712 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:12.030095100 CEST | 80 | 49713 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:12.030174017 CEST | 49713 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:12.030303955 CEST | 49713 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:12.042583942 CEST | 80 | 49713 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:12.773536921 CEST | 80 | 49713 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:12.773663044 CEST | 49713 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:12.889739990 CEST | 49713 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:12.890106916 CEST | 49714 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:12.895132065 CEST | 80 | 49713 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:12.895210981 CEST | 49713 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:12.895466089 CEST | 80 | 49714 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:12.895555019 CEST | 49714 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:12.895684004 CEST | 49714 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:12.901684046 CEST | 80 | 49714 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:13.605597019 CEST | 80 | 49714 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:13.605917931 CEST | 49714 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:13.751866102 CEST | 49714 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:13.752177000 CEST | 49715 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:13.757175922 CEST | 80 | 49715 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:13.757246017 CEST | 80 | 49714 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:13.757297039 CEST | 49715 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:13.757327080 CEST | 49714 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:13.757467031 CEST | 49715 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:13.762242079 CEST | 80 | 49715 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:14.458170891 CEST | 80 | 49715 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:14.458614111 CEST | 49715 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:14.576709986 CEST | 49715 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:14.577063084 CEST | 49716 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:14.583539963 CEST | 80 | 49715 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:14.583926916 CEST | 80 | 49716 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:14.584012032 CEST | 49715 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:14.584041119 CEST | 49716 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:14.584191084 CEST | 49716 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:14.590053082 CEST | 80 | 49716 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:15.308001995 CEST | 80 | 49716 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:15.308093071 CEST | 49716 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:15.422348976 CEST | 49716 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:15.427268982 CEST | 80 | 49716 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:15.657740116 CEST | 80 | 49716 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:15.657815933 CEST | 49716 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:15.792859077 CEST | 49716 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:15.793287039 CEST | 49717 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:15.798336029 CEST | 80 | 49717 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:15.798439026 CEST | 49717 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:15.798504114 CEST | 80 | 49716 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:15.798561096 CEST | 49716 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:15.808743954 CEST | 49717 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:15.813657999 CEST | 80 | 49717 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:16.511200905 CEST | 80 | 49717 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:16.511271954 CEST | 49717 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:16.623903990 CEST | 49717 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:16.628885031 CEST | 80 | 49717 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:16.890240908 CEST | 80 | 49717 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:16.890326977 CEST | 49717 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:16.998512030 CEST | 49717 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:17.004192114 CEST | 80 | 49717 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:17.260364056 CEST | 80 | 49717 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:17.260659933 CEST | 49717 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:17.375322104 CEST | 49717 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:17.375688076 CEST | 49718 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:17.381087065 CEST | 80 | 49717 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:17.381411076 CEST | 49717 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:17.381441116 CEST | 80 | 49718 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:17.381618023 CEST | 49718 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:17.381763935 CEST | 49718 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:17.387100935 CEST | 80 | 49718 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:18.082767963 CEST | 80 | 49718 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:18.082964897 CEST | 49718 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:18.207492113 CEST | 49718 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:18.208230019 CEST | 49719 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:18.212845087 CEST | 80 | 49718 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:18.213074923 CEST | 49718 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:18.213324070 CEST | 80 | 49719 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:18.213505030 CEST | 49719 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:18.215065002 CEST | 49719 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:18.220073938 CEST | 80 | 49719 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:18.905867100 CEST | 80 | 49719 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:18.905971050 CEST | 49719 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:19.030522108 CEST | 49719 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:19.030852079 CEST | 49720 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:19.036042929 CEST | 80 | 49720 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:19.036088943 CEST | 80 | 49719 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:19.036135912 CEST | 49720 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:19.036175966 CEST | 49719 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:19.036345959 CEST | 49720 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:19.041302919 CEST | 80 | 49720 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:19.748555899 CEST | 80 | 49720 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:19.748752117 CEST | 49720 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:19.858717918 CEST | 49720 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:19.864413023 CEST | 80 | 49720 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:20.096484900 CEST | 80 | 49720 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:20.096601009 CEST | 49720 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:20.220736027 CEST | 49720 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:20.221061945 CEST | 49721 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:20.225981951 CEST | 80 | 49721 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:20.226098061 CEST | 49721 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:20.226166010 CEST | 80 | 49720 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:20.226229906 CEST | 49720 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:20.226300955 CEST | 49721 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:20.231163979 CEST | 80 | 49721 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:20.935949087 CEST | 80 | 49721 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:20.936228991 CEST | 49721 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:21.045954943 CEST | 49721 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:21.051141024 CEST | 80 | 49721 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:21.296415091 CEST | 80 | 49721 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:21.296598911 CEST | 49721 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:21.421264887 CEST | 49721 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:21.421597958 CEST | 49722 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:21.429747105 CEST | 80 | 49721 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:21.429836988 CEST | 49721 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:21.430279016 CEST | 80 | 49722 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:21.430361986 CEST | 49722 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:21.430515051 CEST | 49722 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:21.438193083 CEST | 80 | 49722 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:22.197506905 CEST | 80 | 49722 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:22.198016882 CEST | 49722 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:22.311017990 CEST | 49722 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:22.311158895 CEST | 49723 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:22.316282988 CEST | 80 | 49723 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:22.316412926 CEST | 49723 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:22.316538095 CEST | 49723 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:22.316628933 CEST | 80 | 49722 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:22.316696882 CEST | 49722 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:22.321696043 CEST | 80 | 49723 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:22.998537064 CEST | 80 | 49723 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:22.998759985 CEST | 49723 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:23.109916925 CEST | 49723 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:23.115343094 CEST | 80 | 49723 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:23.356381893 CEST | 80 | 49723 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:23.356735945 CEST | 49723 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:23.469322920 CEST | 49723 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:23.476036072 CEST | 80 | 49723 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:23.709589958 CEST | 80 | 49723 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:23.709678888 CEST | 49723 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:23.846827030 CEST | 49723 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:23.847405910 CEST | 49724 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:23.852168083 CEST | 80 | 49723 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:23.852277994 CEST | 49723 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:23.852375984 CEST | 80 | 49724 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:23.852746964 CEST | 49724 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:23.859535933 CEST | 49724 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:23.864532948 CEST | 80 | 49724 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:24.545241117 CEST | 80 | 49724 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:24.545348883 CEST | 49724 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:24.655040979 CEST | 49724 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:24.660018921 CEST | 80 | 49724 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:24.913373947 CEST | 80 | 49724 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:24.913525105 CEST | 49724 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:25.032943964 CEST | 49724 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:25.033282042 CEST | 49725 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:25.038394928 CEST | 80 | 49725 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:25.038443089 CEST | 80 | 49724 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:25.038481951 CEST | 49725 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:25.038508892 CEST | 49724 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:25.038696051 CEST | 49725 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:25.043939114 CEST | 80 | 49725 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:25.760459900 CEST | 80 | 49725 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:25.760562897 CEST | 49725 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:25.875525951 CEST | 49725 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:25.881180048 CEST | 80 | 49725 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:26.218106985 CEST | 80 | 49725 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:26.218180895 CEST | 49725 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:26.328850031 CEST | 49725 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:26.334028959 CEST | 80 | 49725 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:26.568453074 CEST | 80 | 49725 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:26.568628073 CEST | 49725 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:26.688152075 CEST | 49725 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:26.688572884 CEST | 49726 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:26.697981119 CEST | 80 | 49725 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:26.698025942 CEST | 80 | 49726 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:26.698261023 CEST | 49725 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:26.698261976 CEST | 49726 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:26.698498011 CEST | 49726 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:26.704950094 CEST | 80 | 49726 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:27.422672987 CEST | 80 | 49726 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:27.422938108 CEST | 49726 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:27.533900023 CEST | 49726 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:27.539446115 CEST | 80 | 49726 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:27.778727055 CEST | 80 | 49726 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:27.778831959 CEST | 49726 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:27.889357090 CEST | 49726 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:27.894432068 CEST | 80 | 49726 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:28.137547016 CEST | 80 | 49726 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:28.137634039 CEST | 49726 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:28.250528097 CEST | 49726 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:28.255537987 CEST | 80 | 49726 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:28.493657112 CEST | 80 | 49726 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:28.493940115 CEST | 49726 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:28.608582020 CEST | 49726 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:28.609061956 CEST | 49727 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:28.615183115 CEST | 80 | 49726 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:28.615259886 CEST | 49726 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:28.615366936 CEST | 80 | 49727 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:28.615447044 CEST | 49727 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:28.615607023 CEST | 49727 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:28.621747971 CEST | 80 | 49727 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:29.319762945 CEST | 80 | 49727 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:29.319895983 CEST | 49727 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:29.436232090 CEST | 49727 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:29.436534882 CEST | 49728 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:29.441450119 CEST | 80 | 49728 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:29.441513062 CEST | 80 | 49727 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:29.441564083 CEST | 49728 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:29.441644907 CEST | 49728 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:29.441668034 CEST | 49727 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:29.446465015 CEST | 80 | 49728 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:30.164091110 CEST | 80 | 49728 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:30.164158106 CEST | 49728 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:30.281743050 CEST | 49728 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:30.282151937 CEST | 49729 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:30.287026882 CEST | 80 | 49728 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:30.287074089 CEST | 80 | 49729 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:30.287101030 CEST | 49728 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:30.287153006 CEST | 49729 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:30.287338972 CEST | 49729 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:30.292889118 CEST | 80 | 49729 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:31.117788076 CEST | 80 | 49729 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:31.118016958 CEST | 49729 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:31.235138893 CEST | 49729 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:31.235428095 CEST | 49730 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:31.240381002 CEST | 80 | 49730 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:31.240489960 CEST | 49730 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:31.240520000 CEST | 80 | 49729 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:31.240585089 CEST | 49729 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:31.240688086 CEST | 49730 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:31.245515108 CEST | 80 | 49730 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:31.960966110 CEST | 80 | 49730 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:31.961080074 CEST | 49730 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:32.077366114 CEST | 49730 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:32.077711105 CEST | 49731 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:32.082712889 CEST | 80 | 49730 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:32.082756042 CEST | 80 | 49731 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:32.082771063 CEST | 49730 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:32.082834005 CEST | 49731 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:32.082981110 CEST | 49731 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:32.087938070 CEST | 80 | 49731 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:33.084676027 CEST | 80 | 49731 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:33.084847927 CEST | 49731 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:33.201875925 CEST | 49731 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:33.202157974 CEST | 49732 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:33.207494020 CEST | 80 | 49732 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:33.207624912 CEST | 80 | 49731 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:33.207740068 CEST | 49732 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:33.207740068 CEST | 49732 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:33.207827091 CEST | 49731 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:33.213126898 CEST | 80 | 49732 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:33.902400017 CEST | 80 | 49732 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:33.902632952 CEST | 49732 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:34.016259909 CEST | 49732 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:34.021431923 CEST | 80 | 49732 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:34.288535118 CEST | 80 | 49732 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:34.288980007 CEST | 49732 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:34.405518055 CEST | 49732 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:34.405853033 CEST | 49733 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:34.410912991 CEST | 80 | 49732 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:34.410932064 CEST | 80 | 49733 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:34.410978079 CEST | 49732 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:34.411029100 CEST | 49733 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:34.411134005 CEST | 49733 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:34.416026115 CEST | 80 | 49733 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:35.098615885 CEST | 80 | 49733 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:35.098906040 CEST | 49733 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:35.217842102 CEST | 49733 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:35.218234062 CEST | 49734 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:35.223196983 CEST | 80 | 49734 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:35.223355055 CEST | 80 | 49733 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:35.223404884 CEST | 49734 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:35.223437071 CEST | 49733 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:35.223618984 CEST | 49734 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:35.228619099 CEST | 80 | 49734 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:35.918203115 CEST | 80 | 49734 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:35.918370962 CEST | 49734 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:36.030136108 CEST | 49734 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:36.034966946 CEST | 80 | 49734 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:36.274380922 CEST | 80 | 49734 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:36.274434090 CEST | 49734 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:36.389424086 CEST | 49734 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:36.389766932 CEST | 49735 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:36.394597054 CEST | 80 | 49734 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:36.394615889 CEST | 80 | 49735 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:36.394664049 CEST | 49734 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:36.394727945 CEST | 49735 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:36.394933939 CEST | 49735 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:36.399758101 CEST | 80 | 49735 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:37.246777058 CEST | 80 | 49735 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:37.246857882 CEST | 49735 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:37.358622074 CEST | 49735 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:37.363662958 CEST | 80 | 49735 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:37.594295979 CEST | 80 | 49735 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:37.594424009 CEST | 49735 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:37.702301025 CEST | 49735 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:37.709265947 CEST | 80 | 49735 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:37.939866066 CEST | 80 | 49735 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:37.940099955 CEST | 49735 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:38.062432051 CEST | 49735 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:38.062854052 CEST | 49736 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:38.068231106 CEST | 80 | 49736 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:38.068332911 CEST | 49736 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:38.068643093 CEST | 49736 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:38.068687916 CEST | 80 | 49735 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:38.068758965 CEST | 49735 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:38.073887110 CEST | 80 | 49736 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:38.788089991 CEST | 80 | 49736 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:38.788211107 CEST | 49736 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:38.906649113 CEST | 49736 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:38.907000065 CEST | 49737 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:38.912220955 CEST | 80 | 49737 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:38.912307978 CEST | 49737 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:38.912429094 CEST | 49737 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:38.912611008 CEST | 80 | 49736 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:38.912668943 CEST | 49736 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:38.917350054 CEST | 80 | 49737 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:39.632658958 CEST | 80 | 49737 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:39.632772923 CEST | 49737 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:39.752324104 CEST | 49737 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:39.752690077 CEST | 49738 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:39.757550001 CEST | 80 | 49737 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:39.757647991 CEST | 49737 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:39.757675886 CEST | 80 | 49738 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:39.757774115 CEST | 49738 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:39.757965088 CEST | 49738 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:39.762772083 CEST | 80 | 49738 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:40.485228062 CEST | 80 | 49738 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:40.485385895 CEST | 49738 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:40.594259024 CEST | 49738 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:40.599510908 CEST | 80 | 49738 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:40.839402914 CEST | 80 | 49738 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:40.839570999 CEST | 49738 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:40.952760935 CEST | 49738 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:40.957842112 CEST | 80 | 49738 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:41.199531078 CEST | 80 | 49738 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:41.199615955 CEST | 49738 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:41.313968897 CEST | 49738 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:41.564178944 CEST | 80 | 49738 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:41.796288013 CEST | 80 | 49738 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:41.796372890 CEST | 49738 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:41.907008886 CEST | 49738 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:41.913625002 CEST | 80 | 49738 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:42.152395964 CEST | 80 | 49738 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:42.152595997 CEST | 49738 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:42.268094063 CEST | 49738 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:42.448137045 CEST | 80 | 49738 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:42.687093019 CEST | 80 | 49738 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:42.687248945 CEST | 49738 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:42.796204090 CEST | 49738 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:42.802287102 CEST | 80 | 49738 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:43.040795088 CEST | 80 | 49738 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:43.040860891 CEST | 49738 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:43.155622959 CEST | 49738 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:43.156105995 CEST | 49739 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:43.161279917 CEST | 80 | 49738 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:43.161323071 CEST | 80 | 49739 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:43.161362886 CEST | 49738 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:43.161444902 CEST | 49739 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:43.161571980 CEST | 49739 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:43.166443110 CEST | 80 | 49739 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:43.864748001 CEST | 80 | 49739 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:43.864891052 CEST | 49739 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:43.984441996 CEST | 49739 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:43.984725952 CEST | 49740 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:43.989810944 CEST | 80 | 49739 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:43.989911079 CEST | 49739 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:43.990122080 CEST | 80 | 49740 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:43.990200996 CEST | 49740 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:43.990395069 CEST | 49740 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:43.995438099 CEST | 80 | 49740 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:44.711309910 CEST | 80 | 49740 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:44.711437941 CEST | 49740 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:44.828315973 CEST | 49740 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:44.828757048 CEST | 49741 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:44.834088087 CEST | 80 | 49741 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:44.834157944 CEST | 49741 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:44.834280968 CEST | 49741 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:44.837750912 CEST | 80 | 49740 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:44.837805986 CEST | 49740 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:44.839131117 CEST | 80 | 49741 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:45.545675993 CEST | 80 | 49741 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:45.545838118 CEST | 49741 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:45.657083035 CEST | 49741 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:45.661912918 CEST | 80 | 49741 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:45.897728920 CEST | 80 | 49741 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:45.897834063 CEST | 49741 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:46.019316912 CEST | 49741 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:46.020529032 CEST | 49742 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:46.024825096 CEST | 80 | 49741 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:46.025054932 CEST | 49741 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:46.025676012 CEST | 80 | 49742 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:46.025763988 CEST | 49742 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:46.034827948 CEST | 49742 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:46.039854050 CEST | 80 | 49742 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:46.723483086 CEST | 80 | 49742 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:46.723627090 CEST | 49742 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:46.844187021 CEST | 49742 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:46.844523907 CEST | 49743 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:46.849389076 CEST | 80 | 49743 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:46.849489927 CEST | 49743 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:46.849680901 CEST | 49743 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:46.849697113 CEST | 80 | 49742 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:46.849773884 CEST | 49742 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:46.854476929 CEST | 80 | 49743 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:47.537904024 CEST | 80 | 49743 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:47.539505959 CEST | 49743 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:47.657783985 CEST | 49743 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:47.658262968 CEST | 49744 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:47.663450003 CEST | 80 | 49743 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:47.663464069 CEST | 80 | 49744 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:47.663520098 CEST | 49743 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:47.663577080 CEST | 49744 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:47.663727045 CEST | 49744 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:47.668557882 CEST | 80 | 49744 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:48.660645008 CEST | 80 | 49744 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:48.660924911 CEST | 49744 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:48.780031919 CEST | 49744 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:48.780348063 CEST | 49745 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:48.785319090 CEST | 80 | 49744 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:48.785331011 CEST | 80 | 49745 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:48.785433054 CEST | 49744 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:48.785479069 CEST | 49745 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:48.786490917 CEST | 49745 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:48.791455030 CEST | 80 | 49745 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:49.481365919 CEST | 80 | 49745 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:49.481617928 CEST | 49745 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:49.602663040 CEST | 49745 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:49.603102922 CEST | 49746 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:49.607990980 CEST | 80 | 49746 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:49.608073950 CEST | 80 | 49745 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:49.608408928 CEST | 49745 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:49.608408928 CEST | 49746 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:49.608409882 CEST | 49746 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:49.613245010 CEST | 80 | 49746 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:50.341321945 CEST | 80 | 49746 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:50.341492891 CEST | 49746 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:50.453423977 CEST | 49746 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:50.458376884 CEST | 80 | 49746 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:50.706715107 CEST | 80 | 49746 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:50.706825972 CEST | 49746 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:50.826780081 CEST | 49746 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:50.827199936 CEST | 49747 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:50.832149982 CEST | 80 | 49747 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:50.832230091 CEST | 49747 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:50.832351923 CEST | 49747 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:50.837445021 CEST | 80 | 49747 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:50.839484930 CEST | 80 | 49746 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:50.839606047 CEST | 49746 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:51.549276114 CEST | 80 | 49747 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:51.549356937 CEST | 49747 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:51.672558069 CEST | 49747 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:51.672955990 CEST | 49748 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:51.678004026 CEST | 80 | 49748 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:51.678111076 CEST | 49748 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:51.678214073 CEST | 80 | 49747 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:51.678250074 CEST | 49748 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:51.678284883 CEST | 49747 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:51.683343887 CEST | 80 | 49748 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:52.389520884 CEST | 80 | 49748 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:52.389622927 CEST | 49748 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:52.500276089 CEST | 49748 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:52.500590086 CEST | 49749 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:52.506561995 CEST | 80 | 49749 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:52.506768942 CEST | 49749 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:52.506906033 CEST | 80 | 49748 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:52.506973028 CEST | 49748 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:52.507091045 CEST | 49749 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:52.513401985 CEST | 80 | 49749 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:53.198771000 CEST | 80 | 49749 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:53.198865891 CEST | 49749 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:53.313535929 CEST | 49749 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:53.320374012 CEST | 80 | 49749 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:53.551271915 CEST | 80 | 49749 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:53.551402092 CEST | 49749 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:53.672430038 CEST | 49749 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:53.672684908 CEST | 49750 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:53.679513931 CEST | 80 | 49750 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:53.679630995 CEST | 49750 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:53.679774046 CEST | 80 | 49749 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:53.679820061 CEST | 49750 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:53.679852962 CEST | 49749 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:53.687700033 CEST | 80 | 49750 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:54.402709961 CEST | 80 | 49750 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:54.402867079 CEST | 49750 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:54.516405106 CEST | 49750 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:54.522037983 CEST | 80 | 49750 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:54.763495922 CEST | 80 | 49750 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:54.765377998 CEST | 49750 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:54.875363111 CEST | 49750 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:54.875706911 CEST | 49751 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:54.881906986 CEST | 80 | 49751 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:54.883115053 CEST | 80 | 49750 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:54.883241892 CEST | 49751 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:54.883244038 CEST | 49750 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:54.883301020 CEST | 49751 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:54.888654947 CEST | 80 | 49751 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:55.585000038 CEST | 80 | 49751 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:55.585127115 CEST | 49751 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:55.703573942 CEST | 49751 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:55.703955889 CEST | 49752 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:55.708825111 CEST | 80 | 49751 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:55.708928108 CEST | 49751 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:55.708945990 CEST | 80 | 49752 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:55.709098101 CEST | 49752 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:55.709333897 CEST | 49752 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:55.715092897 CEST | 80 | 49752 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:56.428320885 CEST | 80 | 49752 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:56.428400993 CEST | 49752 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:56.546107054 CEST | 49752 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:56.546531916 CEST | 49753 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:56.551608086 CEST | 80 | 49753 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:56.551640987 CEST | 80 | 49752 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:56.551721096 CEST | 49753 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:56.551776886 CEST | 49752 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:56.551981926 CEST | 49753 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:56.556827068 CEST | 80 | 49753 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:57.264182091 CEST | 80 | 49753 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:57.264250040 CEST | 49753 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:57.374233961 CEST | 49753 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:57.374561071 CEST | 49754 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:57.380995989 CEST | 80 | 49753 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:57.381103992 CEST | 49753 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:57.381206989 CEST | 80 | 49754 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:57.381304026 CEST | 49754 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:57.381532907 CEST | 49754 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:57.387672901 CEST | 80 | 49754 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:58.076077938 CEST | 80 | 49754 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:58.076172113 CEST | 49754 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:58.201898098 CEST | 49754 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:58.202302933 CEST | 49755 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:58.207300901 CEST | 80 | 49755 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:58.207381964 CEST | 49755 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:58.207561970 CEST | 49755 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:58.207698107 CEST | 80 | 49754 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:58.207758904 CEST | 49754 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:58.213093996 CEST | 80 | 49755 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:58.906440973 CEST | 80 | 49755 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:58.906526089 CEST | 49755 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:59.032954931 CEST | 49755 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:59.033211946 CEST | 49756 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:59.038235903 CEST | 80 | 49755 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:59.038310051 CEST | 49755 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:59.038404942 CEST | 80 | 49756 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:59.038475990 CEST | 49756 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:59.039778948 CEST | 49756 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:59.044691086 CEST | 80 | 49756 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:59.848431110 CEST | 80 | 49756 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:59.848505974 CEST | 49756 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:59.970154047 CEST | 49756 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:59.970546961 CEST | 49757 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:59.976022959 CEST | 80 | 49756 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:59.976098061 CEST | 49756 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:59.976975918 CEST | 80 | 49757 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:06:59.977058887 CEST | 49757 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:59.977205992 CEST | 49757 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:06:59.984276056 CEST | 80 | 49757 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:07:00.991636038 CEST | 80 | 49757 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:07:00.991707087 CEST | 49757 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:07:01.110663891 CEST | 49757 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:07:01.110976934 CEST | 49758 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:07:01.115948915 CEST | 80 | 49758 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:07:01.116035938 CEST | 49758 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:07:01.116122961 CEST | 80 | 49757 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:07:01.116132975 CEST | 49758 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:07:01.119431019 CEST | 49757 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:07:01.121829033 CEST | 80 | 49758 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:07:01.839601040 CEST | 80 | 49758 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:07:01.839736938 CEST | 49758 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:07:01.969942093 CEST | 49758 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:07:01.970593929 CEST | 49759 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:07:01.975440979 CEST | 80 | 49758 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:07:01.975526094 CEST | 80 | 49759 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:07:01.975536108 CEST | 49758 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:07:01.975600958 CEST | 49759 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:07:01.975826025 CEST | 49759 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:07:01.980670929 CEST | 80 | 49759 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:07:02.669235945 CEST | 80 | 49759 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:07:02.669331074 CEST | 49759 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:07:02.782531977 CEST | 49759 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:07:02.785303116 CEST | 49760 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:07:02.789170980 CEST | 80 | 49759 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:07:02.789259911 CEST | 49759 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:07:02.790237904 CEST | 80 | 49760 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:07:02.790374994 CEST | 49760 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:07:02.790514946 CEST | 49760 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:07:02.795607090 CEST | 80 | 49760 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:07:03.550364971 CEST | 80 | 49760 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:07:03.550461054 CEST | 49760 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:07:03.672693014 CEST | 49761 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:07:03.672703981 CEST | 49760 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:07:03.677751064 CEST | 80 | 49761 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:07:03.677982092 CEST | 80 | 49760 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:07:03.678131104 CEST | 49761 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:07:03.678138018 CEST | 49760 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:07:03.678267002 CEST | 49761 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:07:03.683125019 CEST | 80 | 49761 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:07:04.444044113 CEST | 80 | 49761 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:07:04.444123030 CEST | 49761 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:07:04.567822933 CEST | 49761 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:07:04.568221092 CEST | 49762 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:07:04.574045897 CEST | 80 | 49762 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:07:04.574114084 CEST | 49762 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:07:04.574444056 CEST | 80 | 49761 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:07:04.574506044 CEST | 49761 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:07:04.598109961 CEST | 49762 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:07:04.603146076 CEST | 80 | 49762 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:07:05.338042974 CEST | 80 | 49762 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:07:05.339435101 CEST | 49762 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:07:05.454503059 CEST | 49763 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:07:05.454509020 CEST | 49762 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:07:05.459683895 CEST | 80 | 49763 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:07:05.459789991 CEST | 49763 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:07:05.459860086 CEST | 80 | 49762 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:07:05.459992886 CEST | 49763 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:07:05.460181952 CEST | 49762 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:07:05.465070009 CEST | 80 | 49763 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:07:06.175821066 CEST | 80 | 49763 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:07:06.175895929 CEST | 49763 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:07:06.297672987 CEST | 49763 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:07:06.298034906 CEST | 49764 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:07:06.303905010 CEST | 80 | 49763 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:07:06.303927898 CEST | 80 | 49764 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:07:06.304008007 CEST | 49764 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:07:06.304009914 CEST | 49763 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:07:06.304177999 CEST | 49764 | 80 | 192.168.2.5 | 185.196.8.214 |
| Sep 11, 2024 21:07:06.309101105 CEST | 80 | 49764 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:07:07.003262997 CEST | 80 | 49764 | 185.196.8.214 | 192.168.2.5 |
| Sep 11, 2024 21:07:07.004268885 CEST | 49764 | 80 | 192.168.2.5 | 185.196.8.214 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Sep 11, 2024 21:05:21.409257889 CEST | 53 | 51590 | 1.1.1.1 | 192.168.2.5 |
| Sep 11, 2024 21:05:55.585160017 CEST | 61370 | 53 | 192.168.2.5 | 141.98.234.31 |
| Sep 11, 2024 21:05:55.823065996 CEST | 53 | 61370 | 141.98.234.31 | 192.168.2.5 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Sep 11, 2024 21:05:55.585160017 CEST | 192.168.2.5 | 141.98.234.31 | 0xef2 | Standard query (0) | A (IP address) | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Sep 11, 2024 21:05:55.823065996 CEST | 141.98.234.31 | 192.168.2.5 | 0xef2 | No error (0) | 185.196.8.214 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.5 | 49694 | 185.196.8.214 | 80 | 3220 | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:05:55.897671938 CEST | 318 | OUT | |
| Sep 11, 2024 21:05:56.592645884 CEST | 220 | IN | |
| Sep 11, 2024 21:05:56.702069044 CEST | 318 | OUT | |
| Sep 11, 2024 21:05:56.945528984 CEST | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.5 | 49695 | 185.196.8.214 | 80 | 3220 | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:05:57.067815065 CEST | 318 | OUT | |
| Sep 11, 2024 21:05:57.758820057 CEST | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 2 | 192.168.2.5 | 49696 | 185.196.8.214 | 80 | 3220 | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:05:57.880429029 CEST | 318 | OUT | |
| Sep 11, 2024 21:05:58.587096930 CEST | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 3 | 192.168.2.5 | 49698 | 185.196.8.214 | 80 | 3220 | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:05:58.707561016 CEST | 318 | OUT | |
| Sep 11, 2024 21:05:59.436620951 CEST | 220 | IN | |
| Sep 11, 2024 21:05:59.545393944 CEST | 318 | OUT | |
| Sep 11, 2024 21:05:59.808842897 CEST | 220 | IN | |
| Sep 11, 2024 21:05:59.920454025 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:00.172555923 CEST | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 4 | 192.168.2.5 | 49699 | 185.196.8.214 | 80 | 3220 | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:06:00.301341057 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:04.025146961 CEST | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 5 | 192.168.2.5 | 49700 | 185.196.8.214 | 80 | 3220 | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:06:04.145266056 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:04.856555939 CEST | 220 | IN | |
| Sep 11, 2024 21:06:04.967935085 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:05.212599993 CEST | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 6 | 192.168.2.5 | 49701 | 185.196.8.214 | 80 | 3220 | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:06:05.333175898 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:06.172828913 CEST | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 7 | 192.168.2.5 | 49705 | 185.196.8.214 | 80 |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:06:06.300848007 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:07.015593052 CEST | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 8 | 192.168.2.5 | 49706 | 185.196.8.214 | 80 |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:06:07.145529032 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:07.862838984 CEST | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 9 | 192.168.2.5 | 49708 | 185.196.8.214 | 80 |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:06:07.992779016 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:08.685074091 CEST | 220 | IN | |
| Sep 11, 2024 21:06:08.796487093 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:09.037638903 CEST | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 10 | 192.168.2.5 | 49710 | 185.196.8.214 | 80 | 3220 | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:06:09.161799908 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:09.851246119 CEST | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 11 | 192.168.2.5 | 49711 | 185.196.8.214 | 80 | 3220 | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:06:09.978030920 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:11.069535017 CEST | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 12 | 192.168.2.5 | 49712 | 185.196.8.214 | 80 | 3220 | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:06:11.199140072 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:11.896188974 CEST | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 13 | 192.168.2.5 | 49713 | 185.196.8.214 | 80 | 3220 | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:06:12.030303955 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:12.773536921 CEST | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 14 | 192.168.2.5 | 49714 | 185.196.8.214 | 80 | 3220 | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:06:12.895684004 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:13.605597019 CEST | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 15 | 192.168.2.5 | 49715 | 185.196.8.214 | 80 | 3220 | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:06:13.757467031 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:14.458170891 CEST | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 16 | 192.168.2.5 | 49716 | 185.196.8.214 | 80 | 3220 | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:06:14.584191084 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:15.308001995 CEST | 220 | IN | |
| Sep 11, 2024 21:06:15.422348976 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:15.657740116 CEST | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 17 | 192.168.2.5 | 49717 | 185.196.8.214 | 80 | 3220 | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:06:15.808743954 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:16.511200905 CEST | 220 | IN | |
| Sep 11, 2024 21:06:16.623903990 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:16.890240908 CEST | 220 | IN | |
| Sep 11, 2024 21:06:16.998512030 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:17.260364056 CEST | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 18 | 192.168.2.5 | 49718 | 185.196.8.214 | 80 | 3220 | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:06:17.381763935 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:18.082767963 CEST | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 19 | 192.168.2.5 | 49719 | 185.196.8.214 | 80 | 3220 | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:06:18.215065002 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:18.905867100 CEST | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 20 | 192.168.2.5 | 49720 | 185.196.8.214 | 80 | 3220 | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:06:19.036345959 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:19.748555899 CEST | 220 | IN | |
| Sep 11, 2024 21:06:19.858717918 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:20.096484900 CEST | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 21 | 192.168.2.5 | 49721 | 185.196.8.214 | 80 | 3220 | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:06:20.226300955 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:20.935949087 CEST | 220 | IN | |
| Sep 11, 2024 21:06:21.045954943 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:21.296415091 CEST | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 22 | 192.168.2.5 | 49722 | 185.196.8.214 | 80 | 3220 | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:06:21.430515051 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:22.197506905 CEST | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 23 | 192.168.2.5 | 49723 | 185.196.8.214 | 80 | 3220 | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:06:22.316538095 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:22.998537064 CEST | 220 | IN | |
| Sep 11, 2024 21:06:23.109916925 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:23.356381893 CEST | 220 | IN | |
| Sep 11, 2024 21:06:23.469322920 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:23.709589958 CEST | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 24 | 192.168.2.5 | 49724 | 185.196.8.214 | 80 | 3220 | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:06:23.859535933 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:24.545241117 CEST | 220 | IN | |
| Sep 11, 2024 21:06:24.655040979 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:24.913373947 CEST | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 25 | 192.168.2.5 | 49725 | 185.196.8.214 | 80 | 3220 | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:06:25.038696051 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:25.760459900 CEST | 220 | IN | |
| Sep 11, 2024 21:06:25.875525951 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:26.218106985 CEST | 220 | IN | |
| Sep 11, 2024 21:06:26.328850031 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:26.568453074 CEST | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 26 | 192.168.2.5 | 49726 | 185.196.8.214 | 80 | 3220 | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:06:26.698498011 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:27.422672987 CEST | 220 | IN | |
| Sep 11, 2024 21:06:27.533900023 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:27.778727055 CEST | 220 | IN | |
| Sep 11, 2024 21:06:27.889357090 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:28.137547016 CEST | 220 | IN | |
| Sep 11, 2024 21:06:28.250528097 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:28.493657112 CEST | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 27 | 192.168.2.5 | 49727 | 185.196.8.214 | 80 | 3220 | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:06:28.615607023 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:29.319762945 CEST | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 28 | 192.168.2.5 | 49728 | 185.196.8.214 | 80 | 3220 | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:06:29.441644907 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:30.164091110 CEST | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 29 | 192.168.2.5 | 49729 | 185.196.8.214 | 80 | 3220 | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:06:30.287338972 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:31.117788076 CEST | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 30 | 192.168.2.5 | 49730 | 185.196.8.214 | 80 | 3220 | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:06:31.240688086 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:31.960966110 CEST | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 31 | 192.168.2.5 | 49731 | 185.196.8.214 | 80 | 3220 | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:06:32.082981110 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:33.084676027 CEST | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 32 | 192.168.2.5 | 49732 | 185.196.8.214 | 80 | 3220 | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:06:33.207740068 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:33.902400017 CEST | 220 | IN | |
| Sep 11, 2024 21:06:34.016259909 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:34.288535118 CEST | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 33 | 192.168.2.5 | 49733 | 185.196.8.214 | 80 | 3220 | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:06:34.411134005 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:35.098615885 CEST | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 34 | 192.168.2.5 | 49734 | 185.196.8.214 | 80 | 3220 | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:06:35.223618984 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:35.918203115 CEST | 220 | IN | |
| Sep 11, 2024 21:06:36.030136108 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:36.274380922 CEST | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 35 | 192.168.2.5 | 49735 | 185.196.8.214 | 80 | 3220 | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:06:36.394933939 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:37.246777058 CEST | 220 | IN | |
| Sep 11, 2024 21:06:37.358622074 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:37.594295979 CEST | 220 | IN | |
| Sep 11, 2024 21:06:37.702301025 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:37.939866066 CEST | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 36 | 192.168.2.5 | 49736 | 185.196.8.214 | 80 | 3220 | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:06:38.068643093 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:38.788089991 CEST | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 37 | 192.168.2.5 | 49737 | 185.196.8.214 | 80 | 3220 | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:06:38.912429094 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:39.632658958 CEST | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 38 | 192.168.2.5 | 49738 | 185.196.8.214 | 80 | 3220 | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:06:39.757965088 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:40.485228062 CEST | 220 | IN | |
| Sep 11, 2024 21:06:40.594259024 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:40.839402914 CEST | 220 | IN | |
| Sep 11, 2024 21:06:40.952760935 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:41.199531078 CEST | 220 | IN | |
| Sep 11, 2024 21:06:41.313968897 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:41.796288013 CEST | 220 | IN | |
| Sep 11, 2024 21:06:41.907008886 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:42.152395964 CEST | 220 | IN | |
| Sep 11, 2024 21:06:42.268094063 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:42.687093019 CEST | 220 | IN | |
| Sep 11, 2024 21:06:42.796204090 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:43.040795088 CEST | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 39 | 192.168.2.5 | 49739 | 185.196.8.214 | 80 | 3220 | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:06:43.161571980 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:43.864748001 CEST | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 40 | 192.168.2.5 | 49740 | 185.196.8.214 | 80 | 3220 | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:06:43.990395069 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:44.711309910 CEST | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 41 | 192.168.2.5 | 49741 | 185.196.8.214 | 80 | 3220 | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:06:44.834280968 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:45.545675993 CEST | 220 | IN | |
| Sep 11, 2024 21:06:45.657083035 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:45.897728920 CEST | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 42 | 192.168.2.5 | 49742 | 185.196.8.214 | 80 | 3220 | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:06:46.034827948 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:46.723483086 CEST | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 43 | 192.168.2.5 | 49743 | 185.196.8.214 | 80 | 3220 | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:06:46.849680901 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:47.537904024 CEST | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 44 | 192.168.2.5 | 49744 | 185.196.8.214 | 80 | 3220 | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:06:47.663727045 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:48.660645008 CEST | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 45 | 192.168.2.5 | 49745 | 185.196.8.214 | 80 | 3220 | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:06:48.786490917 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:49.481365919 CEST | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 46 | 192.168.2.5 | 49746 | 185.196.8.214 | 80 | 3220 | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:06:49.608409882 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:50.341321945 CEST | 220 | IN | |
| Sep 11, 2024 21:06:50.453423977 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:50.706715107 CEST | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 47 | 192.168.2.5 | 49747 | 185.196.8.214 | 80 | 3220 | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:06:50.832351923 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:51.549276114 CEST | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 48 | 192.168.2.5 | 49748 | 185.196.8.214 | 80 | 3220 | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:06:51.678250074 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:52.389520884 CEST | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 49 | 192.168.2.5 | 49749 | 185.196.8.214 | 80 | 3220 | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:06:52.507091045 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:53.198771000 CEST | 220 | IN | |
| Sep 11, 2024 21:06:53.313535929 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:53.551271915 CEST | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 50 | 192.168.2.5 | 49750 | 185.196.8.214 | 80 | 3220 | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:06:53.679820061 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:54.402709961 CEST | 220 | IN | |
| Sep 11, 2024 21:06:54.516405106 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:54.763495922 CEST | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 51 | 192.168.2.5 | 49751 | 185.196.8.214 | 80 | 3220 | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:06:54.883301020 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:55.585000038 CEST | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 52 | 192.168.2.5 | 49752 | 185.196.8.214 | 80 | 3220 | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:06:55.709333897 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:56.428320885 CEST | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 53 | 192.168.2.5 | 49753 | 185.196.8.214 | 80 | 3220 | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:06:56.551981926 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:57.264182091 CEST | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 54 | 192.168.2.5 | 49754 | 185.196.8.214 | 80 | 3220 | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:06:57.381532907 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:58.076077938 CEST | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 55 | 192.168.2.5 | 49755 | 185.196.8.214 | 80 | 3220 | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:06:58.207561970 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:58.906440973 CEST | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 56 | 192.168.2.5 | 49756 | 185.196.8.214 | 80 | 3220 | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:06:59.039778948 CEST | 318 | OUT | |
| Sep 11, 2024 21:06:59.848431110 CEST | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 57 | 192.168.2.5 | 49757 | 185.196.8.214 | 80 | 3220 | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:06:59.977205992 CEST | 318 | OUT | |
| Sep 11, 2024 21:07:00.991636038 CEST | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 58 | 192.168.2.5 | 49758 | 185.196.8.214 | 80 | 3220 | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:07:01.116132975 CEST | 318 | OUT | |
| Sep 11, 2024 21:07:01.839601040 CEST | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 59 | 192.168.2.5 | 49759 | 185.196.8.214 | 80 | 3220 | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:07:01.975826025 CEST | 318 | OUT | |
| Sep 11, 2024 21:07:02.669235945 CEST | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 60 | 192.168.2.5 | 49760 | 185.196.8.214 | 80 | 3220 | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:07:02.790514946 CEST | 318 | OUT | |
| Sep 11, 2024 21:07:03.550364971 CEST | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 61 | 192.168.2.5 | 49761 | 185.196.8.214 | 80 | 3220 | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:07:03.678267002 CEST | 318 | OUT | |
| Sep 11, 2024 21:07:04.444044113 CEST | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 62 | 192.168.2.5 | 49762 | 185.196.8.214 | 80 | 3220 | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:07:04.598109961 CEST | 318 | OUT | |
| Sep 11, 2024 21:07:05.338042974 CEST | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 63 | 192.168.2.5 | 49763 | 185.196.8.214 | 80 | 3220 | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:07:05.459992886 CEST | 318 | OUT | |
| Sep 11, 2024 21:07:06.175821066 CEST | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 64 | 192.168.2.5 | 49764 | 185.196.8.214 | 80 | 3220 | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Sep 11, 2024 21:07:06.304177999 CEST | 318 | OUT | |
| Sep 11, 2024 21:07:07.003262997 CEST | 220 | IN |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
| Target ID: | 0 |
| Start time: | 15:05:00 |
| Start date: | 11/09/2024 |
| Path: | C:\Users\user\Desktop\file.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x400000 |
| File size: | 3'488'773 bytes |
| MD5 hash: | 984C885DE9FEA28A60A25B278F424F50 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | low |
| Has exited: | false |
| Target ID: | 1 |
| Start time: | 15:05:00 |
| Start date: | 11/09/2024 |
| Path: | C:\Users\user\AppData\Local\Temp\is-1S2OA.tmp\file.tmp |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x400000 |
| File size: | 706'560 bytes |
| MD5 hash: | F02C8C4B73C31FD56FD90DC77235363B |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | low |
| Has exited: | false |
| Target ID: | 3 |
| Start time: | 15:05:01 |
| Start date: | 11/09/2024 |
| Path: | C:\Users\user\AppData\Local\Batch AVI Converter\batchaviconverter32_64.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x400000 |
| File size: | 2'644'388 bytes |
| MD5 hash: | 91646D419442B59CE172BCBAE8A2A8C9 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Antivirus matches: |
|
| Reputation: | low |
| Has exited: | false |
| Target ID: | 6 |
| Start time: | 15:05:45 |
| Start date: | 11/09/2024 |
| Path: | C:\Windows\System32\svchost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff7e52b0000 |
| File size: | 55'320 bytes |
| MD5 hash: | B7F884C1B74A263F746EE12A5F7C9F6A |
| Has elevated privileges: | true |
| Has administrator privileges: | false |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | false |
Execution Graph
| Execution Coverage: | 21.4% |
| Dynamic/Decrypted Code Coverage: | 0% |
| Signature Coverage: | 2.4% |
| Total number of Nodes: | 1521 |
| Total number of Limit Nodes: | 22 |
Graph
Function 00409B78 Relevance: 7.6, APIs: 5, Instructions: 78memoryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040520C Relevance: 1.5, APIs: 1, Instructions: 29COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040457C Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 27libraryloaderCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004090A4 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 46libraryloaderCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004099EC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 77processCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401918 Relevance: 6.0, APIs: 4, Instructions: 48memoryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040A814 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 117windowCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040A82F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113windowCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00407749 Relevance: 3.3, APIs: 2, Instructions: 284fileCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401FD4 Relevance: 3.1, APIs: 2, Instructions: 122COMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00406FA0 Relevance: 3.0, APIs: 2, Instructions: 33libraryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040766C Relevance: 3.0, APIs: 2, Instructions: 30COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040762C Relevance: 3.0, APIs: 2, Instructions: 30fileCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004075C4 Relevance: 3.0, APIs: 2, Instructions: 24COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401430 Relevance: 2.5, APIs: 2, Instructions: 37memoryCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405280 Relevance: 1.6, APIs: 1, Instructions: 99COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00407576 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00407578 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004069DC Relevance: 1.5, APIs: 1, Instructions: 29COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004076C8 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00407284 Relevance: 1.5, APIs: 1, Instructions: 28windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004076AC Relevance: 1.5, APIs: 1, Instructions: 11fileCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00406FFB Relevance: 1.5, APIs: 1, Instructions: 10COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00407017 Relevance: 1.5, APIs: 1, Instructions: 5COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00406970 Relevance: 1.5, APIs: 1, Instructions: 4COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00407F10 Relevance: 1.3, APIs: 1, Instructions: 62memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401658 Relevance: 1.3, APIs: 1, Instructions: 48COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00407548 Relevance: 1.3, APIs: 1, Instructions: 20COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00407EB8 Relevance: 1.3, APIs: 1, Instructions: 15COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00409448 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 41shutdownCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00409C34 Relevance: 6.0, APIs: 4, Instructions: 31COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405258 Relevance: 1.5, APIs: 1, Instructions: 23COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004026C4 Relevance: 1.5, APIs: 1, Instructions: 20timeCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405CF4 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040840C Relevance: .5, Instructions: 545COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00407024 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 86registrylibraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00403A97 Relevance: 15.1, APIs: 10, Instructions: 122fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004019DC Relevance: 9.1, APIs: 6, Instructions: 59COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00403D02 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 72windowCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004036B8 Relevance: 7.6, APIs: 5, Instructions: 55memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00406E10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 113registryCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00409C88 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004094D8 Relevance: 5.0, APIs: 4, Instructions: 45sleepCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Execution Graph
| Execution Coverage: | 15.6% |
| Dynamic/Decrypted Code Coverage: | 0% |
| Signature Coverage: | 4.6% |
| Total number of Nodes: | 2000 |
| Total number of Limit Nodes: | 87 |
Graph
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0042E09C Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 178memorylibraryloaderCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004502C0 Relevance: 26.3, APIs: 8, Strings: 7, Instructions: 45libraryloaderCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00423C0C Relevance: 21.4, APIs: 14, Instructions: 395COMMON
Download Yara Rule
Control-flow Graph
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004673A4 Relevance: 15.6, APIs: 4, Strings: 4, Instructions: 1649windowCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00452A60 Relevance: 3.0, APIs: 2, Instructions: 45fileCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0046E0E4 Relevance: 3.0, APIs: 2, Instructions: 28comCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00408568 Relevance: 1.5, APIs: 1, Instructions: 29COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00423B84 Relevance: 1.5, APIs: 1, Instructions: 24nativeCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0045559C Relevance: 1.5, APIs: 1, Instructions: 20COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0042F520 Relevance: 1.5, APIs: 1, Instructions: 17nativeCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0046F058 Relevance: 72.2, APIs: 1, Strings: 40, Instructions: 500registryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00492848 Relevance: 56.4, APIs: 16, Strings: 16, Instructions: 431sleepCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00483A7C Relevance: 26.3, APIs: 9, Strings: 6, Instructions: 68libraryloaderCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00468D88 Relevance: 24.7, APIs: 1, Strings: 13, Instructions: 155registryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00423874 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 98windowregistryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0047CE78 Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 95libraryloaderCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040631C Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 27libraryloaderCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00467180 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 141windowCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0042F560 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 90windowregistryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004531F0 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 46libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00430940 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 23registryclipboardthreadCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0042368C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 96windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00418F38 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55threadCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0041363C Relevance: 9.1, APIs: 6, Instructions: 60COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004556D8 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 142registryCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0042DE44 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 32registrylibraryloaderCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00454DD4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 102libraryloaderCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0042ED38 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 55libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00455A10 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 41registryCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00472154 Relevance: 6.3, APIs: 4, Instructions: 272fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0047FCF8 Relevance: 6.1, APIs: 4, Instructions: 147fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00421274 Relevance: 6.1, APIs: 4, Instructions: 127windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00416B42 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004230C8 Relevance: 6.1, APIs: 4, Instructions: 54COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0042DC00 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 113registryCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00483F88 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0047C5D8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36registryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0042DE1C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18registryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004570B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 11libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0046CDF0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 8libraryloaderCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00481C7C Relevance: 4.6, APIs: 3, Instructions: 98windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004243FC Relevance: 4.6, APIs: 3, Instructions: 59windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00416644 Relevance: 4.5, APIs: 3, Instructions: 39COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0041EE54 Relevance: 4.5, APIs: 3, Instructions: 27windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0047C4F4 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39registryCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0046EE44 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34registryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0046EEB4 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24registryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0047E474 Relevance: 3.2, APIs: 2, Instructions: 160windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004527E8 Relevance: 3.1, APIs: 2, Instructions: 60processCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040ADD8 Relevance: 3.1, APIs: 2, Instructions: 51COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0041EEA4 Relevance: 3.0, APIs: 2, Instructions: 49threadCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00452C80 Relevance: 3.0, APIs: 2, Instructions: 48fileCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00452770 Relevance: 3.0, APIs: 2, Instructions: 43COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0042323C Relevance: 3.0, APIs: 2, Instructions: 35COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0042E394 Relevance: 3.0, APIs: 2, Instructions: 33libraryCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0047C88B Relevance: 3.0, APIs: 2, Instructions: 26COMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004508F8 Relevance: 3.0, APIs: 2, Instructions: 22COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040625C Relevance: 3.0, APIs: 2, Instructions: 6memoryCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004014E4 Relevance: 2.5, APIs: 2, Instructions: 37memoryCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004085DC Relevance: 1.6, APIs: 1, Instructions: 99COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0041FB9C Relevance: 1.6, APIs: 1, Instructions: 65COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0046C450 Relevance: 1.5, APIs: 1, Instructions: 37COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00441394 Relevance: 1.5, APIs: 1, Instructions: 36fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00416550 Relevance: 1.5, APIs: 1, Instructions: 32COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004149B4 Relevance: 1.5, APIs: 1, Instructions: 31COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004507C4 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0042CCCC Relevance: 1.5, APIs: 1, Instructions: 29COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0042E8C8 Relevance: 1.5, APIs: 1, Instructions: 28windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0041AF70 Relevance: 1.5, APIs: 1, Instructions: 28COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004062E8 Relevance: 1.5, APIs: 1, Instructions: 27COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00454BF8 Relevance: 1.5, APIs: 1, Instructions: 25COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0041467C Relevance: 1.5, APIs: 1, Instructions: 23COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00406F10 Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0042364C Relevance: 1.5, APIs: 1, Instructions: 22COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004242C4 Relevance: 1.5, APIs: 1, Instructions: 21COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00466B40 Relevance: 1.5, APIs: 1, Instructions: 16COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0042CD24 Relevance: 1.5, APIs: 1, Instructions: 16COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00406EC0 Relevance: 1.5, APIs: 1, Instructions: 14fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0045092C Relevance: 1.5, APIs: 1, Instructions: 11fileCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004072A8 Relevance: 1.5, APIs: 1, Instructions: 11COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0042E3EF Relevance: 1.5, APIs: 1, Instructions: 10COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004165EC Relevance: 1.5, APIs: 1, Instructions: 4COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00448728 Relevance: 1.4, APIs: 1, Instructions: 158COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0041F3C4 Relevance: 1.3, APIs: 1, Instructions: 52memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00452FC4 Relevance: 1.3, APIs: 1, Instructions: 48COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040170C Relevance: 1.3, APIs: 1, Instructions: 48COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401340 Relevance: 1.3, APIs: 1, Instructions: 34memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00406F48 Relevance: 1.3, APIs: 1, Instructions: 3COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0041F118 Relevance: 45.6, APIs: 15, Strings: 11, Instructions: 87libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004585C8 Relevance: 40.4, APIs: 11, Strings: 12, Instructions: 186pipeprocessfileCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00418384 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 58windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004555E4 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 41shutdownCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0045D188 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 34libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004980A4 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 90fileCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00457594 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 241windownativeCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00455E0C Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 112libraryloaderCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00417CD0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76windowCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00464158 Relevance: 7.6, APIs: 5, Instructions: 129fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00463CDC Relevance: 7.6, APIs: 5, Instructions: 129fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0042E934 Relevance: 7.6, APIs: 5, Instructions: 50fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0048393C Relevance: 6.0, APIs: 4, Instructions: 47windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00462750 Relevance: 4.6, APIs: 3, Instructions: 67fileCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004241DC Relevance: 4.5, APIs: 3, Instructions: 32windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00417CCE Relevance: 3.0, APIs: 2, Instructions: 49windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00417598 Relevance: 3.0, APIs: 2, Instructions: 44windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00424194 Relevance: 3.0, APIs: 2, Instructions: 22windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004125D8 Relevance: 1.7, APIs: 1, Instructions: 188nativeCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00478AC0 Relevance: 1.6, APIs: 1, Instructions: 107nativeCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0045D23C Relevance: 1.5, APIs: 1, Instructions: 12COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0045D254 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 10001130 Relevance: .1, Instructions: 55COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 10001000 Relevance: .0, Instructions: 2COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0044B658 Relevance: 166.5, APIs: 48, Strings: 47, Instructions: 252libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00456638 Relevance: 26.6, APIs: 4, Strings: 11, Instructions: 310comCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004983D0 Relevance: 23.0, APIs: 7, Strings: 6, Instructions: 251synchronizationCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0045CBC0 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 182libraryloadermemoryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00454874 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 244registryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00459458 Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 165registryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00458A44 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 70sleepsynchronizationCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00454528 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 228registryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00496C50 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 141fileCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0042E418 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 86registrylibraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004629F0 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 82libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0042F188 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 82libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00458C1C Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 127pipeCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00456D20 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 99libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404ABF Relevance: 15.1, APIs: 10, Instructions: 122fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00481854 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 175windowCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0045D2B4 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 41libraryloaderCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0044D178 Relevance: 13.6, APIs: 9, Instructions: 90COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0041B66C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 144windowCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0041B93C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 142windowCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004964F4 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 90sleepsynchronizationthreadCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004701FC Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 89registrywindowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00462E30 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 75windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00478370 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 66libraryfileloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00429480 Relevance: 12.1, APIs: 8, Instructions: 62COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0041DE24 Relevance: 12.1, APIs: 8, Instructions: 60windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00476C50 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 200windowCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004116F4 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 158windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004572DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0046B420 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 99sleepCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00477C6C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 92windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00459784 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 86libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0041C148 Relevance: 10.6, APIs: 7, Instructions: 70windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00418C54 Relevance: 10.6, APIs: 7, Instructions: 67COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00483C6C Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 61registryCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0041B462 Relevance: 10.6, APIs: 7, Instructions: 57windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0049532C Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 47libraryloaderCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0045D688 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 33libraryloaderCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0042EA1C Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 30libraryloaderwindowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0044C7DC Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 28libraryloaderCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00478C20 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 14libraryloaderCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0041B508 Relevance: 9.1, APIs: 6, Instructions: 113windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0041BD8C Relevance: 9.1, APIs: 6, Instructions: 71COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401A90 Relevance: 9.1, APIs: 6, Instructions: 59COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0047E758 Relevance: 9.1, APIs: 6, Instructions: 57COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0041B270 Relevance: 9.0, APIs: 6, Instructions: 43COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004538BC Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 100fileCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0042EAA8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49libraryloaderCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0042E9AC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00477B94 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderthreadCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00416C2C Relevance: 7.6, APIs: 5, Instructions: 104COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00414800 Relevance: 7.6, APIs: 5, Instructions: 102COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004297CC Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0041BBB8 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00403CA4 Relevance: 7.6, APIs: 5, Instructions: 55memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004143E0 Relevance: 7.6, APIs: 5, Instructions: 51windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00406FA4 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 156shareCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00416410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89registryCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404D2A Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72windowCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00456BFC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65registryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00457154 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60windowCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004786EC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55windowkeyboardCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00459364 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39registryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00483BC4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39registryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0042D8F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 27libraryloaderCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0042EB54 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 23libraryloaderCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0044F744 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00498968 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004645F4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 8libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0047D67C Relevance: 6.2, APIs: 4, Instructions: 195fileCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00413CF8 Relevance: 6.1, APIs: 4, Instructions: 107COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00408A54 Relevance: 6.1, APIs: 4, Instructions: 95windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0044E8C4 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00495924 Relevance: 6.1, APIs: 4, Instructions: 81COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00417218 Relevance: 6.1, APIs: 4, Instructions: 72COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004955DC Relevance: 6.1, APIs: 4, Instructions: 59COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00454F7C Relevance: 6.1, APIs: 4, Instructions: 54COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040D010 Relevance: 6.1, APIs: 4, Instructions: 51COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004019CC Relevance: 6.0, APIs: 4, Instructions: 48memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0047CD48 Relevance: 6.0, APIs: 4, Instructions: 35sleepCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00478204 Relevance: 6.0, APIs: 4, Instructions: 31COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00424240 Relevance: 6.0, APIs: 4, Instructions: 26windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040626C Relevance: 6.0, APIs: 4, Instructions: 11memoryCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0047A218 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 210registryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004763AC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 105timeCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00478E98 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 86registryCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00450168 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 78windowCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004963A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59processCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0042DD64 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56registryCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00455674 Relevance: 5.0, APIs: 4, Instructions: 45sleepCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Execution Graph
| Execution Coverage: | 4.1% |
| Dynamic/Decrypted Code Coverage: | 83.5% |
| Signature Coverage: | 3.5% |
| Total number of Nodes: | 2000 |
| Total number of Limit Nodes: | 37 |
Graph
Function 02D872A7 Relevance: 95.2, APIs: 41, Strings: 13, Instructions: 659networksleepfileCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D86487 Relevance: 82.5, APIs: 42, Strings: 5, Instructions: 228memorysleeplibraryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0040223D Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 117librarystringCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401B4B Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 74libraryloaderCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02D8F8D9 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 87libraryloaderCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D8F7D5 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 100fileCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Control-flow Graph
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02DC79DA Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 102fileCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040B846 Relevance: 3.0, APIs: 2, Instructions: 16stringCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02D87BA0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 91sleepCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040B2B6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25registryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02D81AA9 Relevance: 4.5, APIs: 3, Instructions: 18networkCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00402343 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22registryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00402227 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17registryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02DBFA2F Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 139sleepCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040B2DA Relevance: 3.0, APIs: 2, Instructions: 49COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004039F0 Relevance: 3.0, APIs: 2, Instructions: 30memoryCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004021EA Relevance: 3.0, APIs: 2, Instructions: 6registryCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02E1E864 Relevance: 1.6, APIs: 1, Instructions: 56fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004022BC Relevance: 1.5, APIs: 1, Instructions: 30libraryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02DBEB47 Relevance: 1.5, APIs: 1, Instructions: 8fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040B2CD Relevance: 1.5, APIs: 1, Instructions: 6COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040B2D3 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02DBF4B6 Relevance: 1.5, APIs: 1, Instructions: 5fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040B902 Relevance: 1.5, APIs: 1, Instructions: 3registryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02DBFA3A Relevance: 1.5, APIs: 1, Instructions: 2fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040264C Relevance: 1.3, APIs: 1, Instructions: 18memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040275D Relevance: 1.3, APIs: 1, Instructions: 5sleepCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040B44F Relevance: 1.3, APIs: 1, Instructions: 3sleepCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040273F Relevance: 6.0, APIs: 4, Instructions: 21serviceCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02D908A8 Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 004021F8 Relevance: 1.5, APIs: 1, Instructions: 11COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040B173 Relevance: 1.5, APIs: 1, Instructions: 8COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040235E Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 93registrysynchronizationthreadCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02D81CF8 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 105synchronizationCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D824E1 Relevance: 21.2, APIs: 14, Instructions: 173COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D84D86 Relevance: 16.8, APIs: 11, Instructions: 256COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02D83423 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 94libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00405408 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 50libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00403C59 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 100fileCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004058D5 Relevance: 13.7, APIs: 9, Instructions: 177COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02D91540 Relevance: 10.6, APIs: 7, Instructions: 132COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D82081 Relevance: 10.6, APIs: 7, Instructions: 116timeCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D91652 Relevance: 10.6, APIs: 7, Instructions: 107synchronizationCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00404618 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 102memoryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02D826DB Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 92timeCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D95CC4 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D933F1 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D934C6 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00405B24 Relevance: 9.1, APIs: 6, Instructions: 117COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02D81C91 Relevance: 9.0, APIs: 6, Instructions: 39synchronizationthreadinjectionCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D907F0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 179windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D82B95 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 132networkCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02D91860 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 66COMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D84030 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 26memoryCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 004036D0 Relevance: 7.6, APIs: 5, Instructions: 143COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D8E02A Relevance: 7.6, APIs: 5, Instructions: 92COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D829EE Relevance: 7.6, APIs: 5, Instructions: 79networkCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D81BA7 Relevance: 7.6, APIs: 5, Instructions: 75COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D821D5 Relevance: 7.6, APIs: 5, Instructions: 60COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D82298 Relevance: 7.6, APIs: 5, Instructions: 56COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D82420 Relevance: 7.5, APIs: 5, Instructions: 38COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D81EC7 Relevance: 7.5, APIs: 5, Instructions: 35COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D830AE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 97networkCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D93A7C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00403E3A Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 265memoryCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D936DD Relevance: 6.1, APIs: 4, Instructions: 136COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02D83D7E Relevance: 6.1, APIs: 4, Instructions: 57networkCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D8239D Relevance: 6.1, APIs: 4, Instructions: 52COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D82EDD Relevance: 6.0, APIs: 4, Instructions: 49networkCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D8247D Relevance: 6.0, APIs: 4, Instructions: 38COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D82004 Relevance: 6.0, APIs: 4, Instructions: 35COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D81E26 Relevance: 6.0, APIs: 4, Instructions: 30COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0040475C Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 27memoryCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02D82DB5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100networkCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D8959B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 78networkCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D82AC7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72networkCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D819C2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21memoryCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0040446C Relevance: 5.1, APIs: 4, Instructions: 53memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|