Edit tour
Windows
Analysis Report
getlab.exe
Overview
General Information
| Sample name: | getlab.exe |
| Analysis ID: | 1565505 |
| MD5: | 15bd54ed3324a464c1deb1a883e7649e |
| SHA1: | 7a6853de5875b347fe48afb232d249e44efeb879 |
| SHA256: | 7d728e3092520965203537354ccb0798292014885aecdefe1f22a988cb67661d |
| Tags: | exeSocks5Systemzuser-aachum |
| Infos: |  |
 | |
Detection
Socks5Systemz
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected Socks5Systemz
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Contains functionality to infect the boot sector
Found API chain indicative of debugger detection
Machine Learning detection for dropped file
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to launch a program with higher privileges
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to query network adapater information
Contains functionality to shutdown / reboot the system
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a DirectInput object (often for capturing keystrokes)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Entry point lies outside standard sections
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evasive API chain (date check)
Found evasive API chain (may stop execution after checking a module file name)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains executable resources (Code or Archives)
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries disk information (often used to detect virtual machines)
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Classification
- System is w10x64
getlab.exe (PID: 5904 cmdline: "C:\Users\ user\Deskt op\getlab. exe" MD5: 15BD54ED3324A464C1DEB1A883E7649E) - getlab.tmp (PID: 5816 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\is-BKG L7.tmp\get lab.tmp" / SL5="$1043 E,3351432, 54272,C:\U sers\user\ Desktop\ge tlab.exe" MD5: A0CFF52B882184452424B6E618FA061B) 
net.exe (PID: 2520 cmdline: "C:\Window s\system32 \net.exe" pause xl_g ear_11293 MD5: 31890A7DE89936F922D44D677F681A7F) 
conhost.exe (PID: 2256 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - net1.exe (PID: 5016 cmdline:
C:\Windows \system32\ net1 pause xl_gear_1 1293 MD5: 2EFE6ED4C294AB8A39EB59C80813FEC1) 
xlgear32.exe (PID: 3320 cmdline: "C:\Users\ user\AppDa ta\Local\X LGear 3.1. 3.157\xlge ar32.exe" -i MD5: 9DC53D054BB2482253850DA5D8DFF405)
- cleanup
{"C2 list": ["ayeyoji.ru"]}| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_DelphiSystemParamCount | Detected Delphi use of System.ParamCount() | Joe Security | ||
| JoeSecurity_DelphiSystemParamCount | Detected Delphi use of System.ParamCount() | Joe Security | ||
| JoeSecurity_DelphiSystemParamCount | Detected Delphi use of System.ParamCount() | Joe Security |
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_DelphiSystemParamCount | Detected Delphi use of System.ParamCount() | Joe Security | ||
| JoeSecurity_Socks5Systemz | Yara detected Socks5Systemz | Joe Security | ||
| JoeSecurity_Socks5Systemz | Yara detected Socks5Systemz | Joe Security | ||
| JoeSecurity_DelphiSystemParamCount | Detected Delphi use of System.ParamCount() | Joe Security | ||
| JoeSecurity_Socks5Systemz | Yara detected Socks5Systemz | Joe Security |
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_DelphiSystemParamCount | Detected Delphi use of System.ParamCount() | Joe Security |
⊘No Sigma rule has matched
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2024-11-30T02:33:53.594534+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49736 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:33:54.179795+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49736 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:33:58.262436+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49736 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:33:58.849545+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49736 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:00.572922+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49746 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:02.227166+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49752 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:03.917609+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49758 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:04.497598+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49758 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:05.066031+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49758 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:06.739788+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49764 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:08.320376+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49770 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:09.937602+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49771 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:11.556643+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49777 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:13.226956+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49783 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:14.944372+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49788 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:16.553933+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49790 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:18.166014+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49795 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:19.845585+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49800 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:21.511567+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49803 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:22.101381+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49803 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:23.884939+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49809 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:25.556492+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49814 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:27.189408+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49820 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:28.850327+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49825 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:30.470731+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49828 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:32.109688+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49833 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:32.691157+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49833 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:34.309929+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49839 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:35.944753+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49844 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:37.661938+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49849 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:39.304888+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49853 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:40.919549+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49858 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:41.503613+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49858 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:43.116466+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49864 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:44.735837+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49869 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:46.404795+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49873 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:48.037210+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49878 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:49.693432+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49883 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:51.306229+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49888 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:53.021656+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49891 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:54.635453+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49896 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:56.331578+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49901 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:57.905243+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49905 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:59.511137+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49910 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:35:01.180445+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49915 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:35:02.800433+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49920 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:35:04.465736+0100 | 2049467 | 1 | A Network Trojan was detected | 192.168.2.4 | 49923 | 185.208.158.202 | 80 | TCP |
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2024-11-30T02:33:53.594534+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49736 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:33:54.179795+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49736 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:33:58.262436+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49736 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:33:58.849545+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49736 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:00.572922+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49746 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:02.227166+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49752 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:03.917609+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49758 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:04.497598+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49758 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:05.066031+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49758 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:06.739788+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49764 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:08.320376+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49770 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:09.937602+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49771 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:11.556643+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49777 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:13.226956+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49783 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:14.944372+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49788 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:16.553933+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49790 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:18.166014+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49795 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:19.845585+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49800 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:21.511567+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49803 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:22.101381+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49803 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:23.884939+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49809 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:25.556492+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49814 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:27.189408+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49820 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:28.850327+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49825 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:30.470731+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49828 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:32.109688+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49833 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:32.691157+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49833 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:34.309929+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49839 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:35.944753+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49844 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:37.661938+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49849 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:39.304888+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49853 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:40.919549+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49858 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:41.503613+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49858 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:43.116466+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49864 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:44.735837+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49869 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:46.404795+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49873 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:48.037210+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49878 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:49.693432+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49883 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:51.306229+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49888 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:53.021656+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49891 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:54.635453+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49896 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:56.331578+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49901 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:57.905243+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49905 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:59.511137+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49910 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:35:01.180445+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49915 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:35:02.800433+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49920 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:35:04.465736+0100 | 2050112 | 1 | A Network Trojan was detected | 192.168.2.4 | 49923 | 185.208.158.202 | 80 | TCP |
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | Malware Configuration Extractor: | ||
| Source: | ReversingLabs: | |||
| Source: | Virustotal: | Perma Link | ||
| Source: | Integrated Neural Analysis Model: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Code function: | 1_2_0045CFA8 | |
| Source: | Code function: | 1_2_0045D05C | |
| Source: | Code function: | 1_2_0045D074 | |
| Source: | Code function: | 1_2_10001000 | |
| Source: | Code function: | 1_2_10001130 | |
Compliance | |
|---|
| Source: | Unpacked PE file: | ||
| Source: | Static PE information: | ||
| Source: | Registry value created: | Jump to behavior | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Code function: | 1_2_00452A34 | |
| Source: | Code function: | 1_2_00474D70 | |
| Source: | Code function: | 1_2_00462578 | |
| Source: | Code function: | 1_2_004975B0 | |
| Source: | Code function: | 1_2_00463B04 | |
| Source: | Code function: | 1_2_00463F80 | |
Networking | |
|---|
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | URLs: | ||
| Source: | TCP traffic: | ||
| Source: | IP Address: | ||
| Source: | IP Address: | ||
| Source: | ASN Name: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | Code function: | 4_2_02D972AB | |
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Binary or memory string: | memstr_d094a741-8 | |
| Source: | Code function: | 1_2_0042F518 | |
| Source: | Code function: | 1_2_00423B7C | |
| Source: | Code function: | 1_2_00478554 | |
| Source: | Code function: | 1_2_004125D0 | |
| Source: | Code function: | 1_2_004573B4 | |
| Source: | Code function: | 1_2_0042E92C | |
| Source: | Code function: | 0_2_00409448 | |
| Source: | Code function: | 1_2_004555B8 | |
| Source: | Code function: | 0_2_0040840C | |
| Source: | Code function: | 1_2_00480002 | |
| Source: | Code function: | 1_2_004704C8 | |
| Source: | Code function: | 1_2_004671CC | |
| Source: | Code function: | 1_2_004352C0 | |
| Source: | Code function: | 1_2_00486140 | |
| Source: | Code function: | 1_2_00430354 | |
| Source: | Code function: | 1_2_004444C0 | |
| Source: | Code function: | 1_2_004345BC | |
| Source: | Code function: | 1_2_00444A68 | |
| Source: | Code function: | 1_2_00430EE0 | |
| Source: | Code function: | 1_2_0045EEEC | |
| Source: | Code function: | 1_2_0045AF94 | |
| Source: | Code function: | 1_2_004870A0 | |
| Source: | Code function: | 1_2_00445160 | |
| Source: | Code function: | 1_2_0046922C | |
| Source: | Code function: | 1_2_0048D400 | |
| Source: | Code function: | 1_2_0044556C | |
| Source: | Code function: | 1_2_00451990 | |
| Source: | Code function: | 1_2_0043DD48 | |
| Source: | Code function: | 4_2_00401051 | |
| Source: | Code function: | 4_2_00401C26 | |
| Source: | Code function: | 4_2_004070A7 | |
| Source: | Code function: | 4_2_609660FA | |
| Source: | Code function: | 4_2_6092114F | |
| Source: | Code function: | 4_2_6091F2C9 | |
| Source: | Code function: | 4_2_6096923E | |
| Source: | Code function: | 4_2_6093323D | |
| Source: | Code function: | 4_2_6095C314 | |
| Source: | Code function: | 4_2_60950312 | |
| Source: | Code function: | 4_2_6094D33B | |
| Source: | Code function: | 4_2_6093B368 | |
| Source: | Code function: | 4_2_6096748C | |
| Source: | Code function: | 4_2_6093F42E | |
| Source: | Code function: | 4_2_60954470 | |
| Source: | Code function: | 4_2_609615FA | |
| Source: | Code function: | 4_2_6096A5EE | |
| Source: | Code function: | 4_2_6096D6A4 | |
| Source: | Code function: | 4_2_609606A8 | |
| Source: | Code function: | 4_2_60932654 | |
| Source: | Code function: | 4_2_60955665 | |
| Source: | Code function: | 4_2_6094B7DB | |
| Source: | Code function: | 4_2_6092F74D | |
| Source: | Code function: | 4_2_60964807 | |
| Source: | Code function: | 4_2_6094E9BC | |
| Source: | Code function: | 4_2_60937929 | |
| Source: | Code function: | 4_2_6093FAD6 | |
| Source: | Code function: | 4_2_6096DAE8 | |
| Source: | Code function: | 4_2_6094DA3A | |
| Source: | Code function: | 4_2_60936B27 | |
| Source: | Code function: | 4_2_60954CF6 | |
| Source: | Code function: | 4_2_60950C6B | |
| Source: | Code function: | 4_2_60966DF1 | |
| Source: | Code function: | 4_2_60963D35 | |
| Source: | Code function: | 4_2_60909E9C | |
| Source: | Code function: | 4_2_60951E86 | |
| Source: | Code function: | 4_2_60912E0B | |
| Source: | Code function: | 4_2_60954FF8 | |
| Source: | Code function: | 4_2_02DCBF80 | |
| Source: | Code function: | 4_2_02DCBF31 | |
| Source: | Code function: | 4_2_02DCB4E5 | |
| Source: | Code function: | 4_2_02DAE24D | |
| Source: | Code function: | 4_2_02D9F07A | |
| Source: | Code function: | 4_2_02DB4EE9 | |
| Source: | Code function: | 4_2_02DB2E74 | |
| Source: | Code function: | 4_2_02DAE665 | |
| Source: | Code function: | 4_2_02DA9F44 | |
| Source: | Code function: | 4_2_02DAACFA | |
| Source: | Code function: | 4_2_02DADD59 | |
| Source: | Code function: | 4_2_02DA8503 | |
| Source: | Dropped File: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Static PE information: | ||
| Source: | Classification label: | ||
| Source: | Code function: | 4_2_02DA08C0 | |
| Source: | Code function: | 0_2_00409448 | |
| Source: | Code function: | 1_2_004555B8 | |
| Source: | Code function: | 1_2_00455DE0 | |
| Source: | Code function: | 4_2_00402259 | |
| Source: | Code function: | 4_2_00402259 | |
| Source: | Code function: | 1_2_0046DF04 | |
| Source: | Code function: | 0_2_00409BEC | |
| Source: | Code function: | 4_2_00402253 | |
| Source: | Code function: | 4_2_00402253 | |
| Source: | File created: | Jump to behavior | ||
| Source: | Mutant created: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Key value created or modified: | Jump to behavior | ||
| Source: | File read: | Jump to behavior | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | ReversingLabs: | ||
| Source: | Virustotal: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Key value queried: | Jump to behavior | ||
| Source: | Key value created or modified: | Jump to behavior | ||
| Source: | Window found: | Jump to behavior | ||
| Source: | Window detected: | ||
| Source: | Registry value created: | Jump to behavior | ||
| Source: | Static file information: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
Data Obfuscation | |
|---|
| Source: | Unpacked PE file: | ||
| Source: | Unpacked PE file: | ||
| Source: | Code function: | 1_2_00450294 | |
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Code function: | 0_2_004065ED | |
| Source: | Code function: | 0_2_004040F1 | |
| Source: | Code function: | 0_2_00408109 | |
| Source: | Code function: | 0_2_00404389 | |
| Source: | Code function: | 0_2_00404389 | |
| Source: | Code function: | 0_2_0040C219 | |
| Source: | Code function: | 0_2_00404389 | |
| Source: | Code function: | 0_2_00404389 | |
| Source: | Code function: | 0_2_00408F63 | |
| Source: | Code function: | 1_2_00409971 | |
| Source: | Code function: | 1_2_0040A038 | |
| Source: | Code function: | 1_2_004941BD | |
| Source: | Code function: | 1_2_004062B5 | |
| Source: | Code function: | 1_2_004106CD | |
| Source: | Code function: | 1_2_0041297B | |
| Source: | Code function: | 1_2_00484BED | |
| Source: | Code function: | 1_2_0040D022 | |
| Source: | Code function: | 1_2_0045912C | |
| Source: | Code function: | 1_2_004054A9 | |
| Source: | Code function: | 1_2_0044343C | |
| Source: | Code function: | 1_2_0048362B | |
| Source: | Code function: | 1_2_00405741 | |
| Source: | Code function: | 1_2_0040F582 | |
| Source: | Code function: | 1_2_0047759D | |
| Source: | Code function: | 1_2_00405741 | |
| Source: | Code function: | 1_2_00405741 | |
| Source: | Code function: | 1_2_00405741 | |
| Source: | Code function: | 1_2_004517F7 | |
| Source: | Code function: | 1_2_00451995 | |
| Source: | Code function: | 1_2_0045FB48 | |
| Source: | Code function: | 1_2_00419C25 | |
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
Persistence and Installation Behavior | |
|---|
| Source: | Code function: | 4_2_00401A4F | |
| Source: | Code function: | 4_2_02D9F8A3 | |
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
Boot Survival | |
|---|
| Source: | Code function: | 4_2_00401A4F | |
| Source: | Code function: | 4_2_02D9F8A3 | |
| Source: | Code function: | 4_2_00402253 | |
| Source: | Code function: | 1_2_00423C04 | |
| Source: | Code function: | 1_2_00423C04 | |
| Source: | Code function: | 1_2_004241D4 | |
| Source: | Code function: | 1_2_0042418C | |
| Source: | Code function: | 1_2_0041837C | |
| Source: | Code function: | 1_2_00422854 | |
| Source: | Code function: | 1_2_00482EF8 | |
| Source: | Code function: | 1_2_00417590 | |
| Source: | Code function: | 1_2_00417CC6 | |
| Source: | Code function: | 1_2_00417CC8 | |
| Source: | Code function: | 1_2_0041F110 | |
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Code function: | 4_2_60920C91 | |
| Source: | Code function: | 4_2_00401B4B | |
| Source: | Code function: | 4_2_02D9F9A7 | |
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Evasive API call chain: | graph_0-5687 | ||
| Source: | Evasive API call chain: | graph_4-60994 | ||
| Source: | API coverage: | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Last function: | ||
| Source: | Code function: | 1_2_00452A34 | |
| Source: | Code function: | 1_2_00474D70 | |
| Source: | Code function: | 1_2_00462578 | |
| Source: | Code function: | 1_2_004975B0 | |
| Source: | Code function: | 1_2_00463B04 | |
| Source: | Code function: | 1_2_00463F80 | |
| Source: | Code function: | 0_2_00409B30 | |
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | API call chain: | graph_0-6727 | ||
| Source: | API call chain: | graph_4-60761 | ||
| Source: | Process information queried: | Jump to behavior | ||
Anti Debugging | |
|---|
| Source: | Debugger detection routine: | graph_4-60889 | ||
| Source: | Code function: | 4_2_60920C91 | |
| Source: | Code function: | 4_2_02DB01BE | |
| Source: | Code function: | 4_2_02DB01BE | |
| Source: | Code function: | 1_2_00450294 | |
| Source: | Code function: | 4_2_02D9648B | |
| Source: | Code function: | 4_2_02DA9528 | |
| Source: | Code function: | 1_2_00477F98 | |
| Source: | Process created: | Jump to behavior | ||
| Source: | Code function: | 1_2_0042E094 | |
| Source: | Code function: | 4_2_02D9F85B | |
| Source: | Code function: | 0_2_004051FC | |
| Source: | Code function: | 0_2_00405248 | |
| Source: | Code function: | 1_2_00408558 | |
| Source: | Code function: | 1_2_004085A4 | |
| Source: | Code function: | 1_2_004583E8 | |
| Source: | Code function: | 0_2_004026C4 | |
| Source: | Code function: | 1_2_00455570 | |
| Source: | Code function: | 0_2_00405CE4 | |
Stealing of Sensitive Information | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
Remote Access Functionality | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | Code function: | 4_2_609660FA | |
| Source: | Code function: | 4_2_6090C1D6 | |
| Source: | Code function: | 4_2_60963143 | |
| Source: | Code function: | 4_2_6096A2BD | |
| Source: | Code function: | 4_2_6096923E | |
| Source: | Code function: | 4_2_6096A38C | |
| Source: | Code function: | 4_2_6096748C | |
| Source: | Code function: | 4_2_609254B1 | |
| Source: | Code function: | 4_2_6094B407 | |
| Source: | Code function: | 4_2_6090F435 | |
| Source: | Code function: | 4_2_609255D4 | |
| Source: | Code function: | 4_2_609255FF | |
| Source: | Code function: | 4_2_6096A5EE | |
| Source: | Code function: | 4_2_6094B54C | |
| Source: | Code function: | 4_2_60925686 | |
| Source: | Code function: | 4_2_6094A6C5 | |
| Source: | Code function: | 4_2_609256E5 | |
| Source: | Code function: | 4_2_6094B6ED | |
| Source: | Code function: | 4_2_6092562A | |
| Source: | Code function: | 4_2_60925655 | |
| Source: | Code function: | 4_2_6094C64A | |
| Source: | Code function: | 4_2_609687A7 | |
| Source: | Code function: | 4_2_6095F7F7 | |
| Source: | Code function: | 4_2_6092570B | |
| Source: | Code function: | 4_2_6095F772 | |
| Source: | Code function: | 4_2_60925778 | |
| Source: | Code function: | 4_2_6090577D | |
| Source: | Code function: | 4_2_6094B764 | |
| Source: | Code function: | 4_2_6090576B | |
| Source: | Code function: | 4_2_6094A894 | |
| Source: | Code function: | 4_2_6095F883 | |
| Source: | Code function: | 4_2_6094C8C2 | |
| Source: | Code function: | 4_2_6096281E | |
| Source: | Code function: | 4_2_6096583A | |
| Source: | Code function: | 4_2_6095F9AD | |
| Source: | Code function: | 4_2_6094A92B | |
| Source: | Code function: | 4_2_6090EAE5 | |
| Source: | Code function: | 4_2_6095FB98 | |
| Source: | Code function: | 4_2_6095ECA6 | |
| Source: | Code function: | 4_2_6095FCCE | |
| Source: | Code function: | 4_2_6095FDAE | |
| Source: | Code function: | 4_2_60966DF1 | |
| Source: | Code function: | 4_2_60969D75 | |
| Source: | Code function: | 4_2_6095FFB2 | |
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | 3 Native API | 1 DLL Side-Loading | 1 Exploitation for Privilege Escalation | 1 Deobfuscate/Decode Files or Information | 1 Input Capture | 1 System Time Discovery | Remote Services | 1 Archive Collected Data | 2 Ingress Tool Transfer | Exfiltration Over Other Network Medium | 1 System Shutdown/Reboot |
| Credentials | Domains | Default Accounts | 2 Service Execution | 5 Windows Service | 1 DLL Side-Loading | 3 Obfuscated Files or Information | LSASS Memory | 1 Account Discovery | Remote Desktop Protocol | 1 Input Capture | 2 Encrypted Channel | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | 1 Bootkit | 1 Access Token Manipulation | 21 Software Packing | Security Account Manager | 2 File and Directory Discovery | SMB/Windows Admin Shares | Data from Network Shared Drive | 1 Non-Standard Port | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | 5 Windows Service | 1 DLL Side-Loading | NTDS | 35 System Information Discovery | Distributed Component Object Model | Input Capture | 2 Non-Application Layer Protocol | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | 12 Process Injection | 1 Masquerading | LSA Secrets | 151 Security Software Discovery | SSH | Keylogging | 112 Application Layer Protocol | Scheduled Transfer | Data Encrypted for Impact |
| Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | 121 Virtualization/Sandbox Evasion | Cached Domain Credentials | 1 Process Discovery | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
| DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | 1 Access Token Manipulation | DCSync | 121 Virtualization/Sandbox Evasion | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
| Network Trust Dependencies | Serverless | Drive-by Compromise | Container Orchestration Job | Scheduled Task/Job | Scheduled Task/Job | 12 Process Injection | Proc Filesystem | 11 Application Window Discovery | Cloud Services | Credential API Hooking | Application Layer Protocol | Exfiltration Over Alternative Protocol | Defacement |
| Network Topology | Malvertising | Exploit Public-Facing Application | Command and Scripting Interpreter | At | At | 1 Bootkit | /etc/passwd and /etc/shadow | 3 System Owner/User Discovery | Direct Cloud VM Connections | Data Staged | Web Protocols | Exfiltration Over Symmetric Encrypted Non-C2 Protocol | Internal Defacement |
| IP Addresses | Compromise Infrastructure | Supply Chain Compromise | PowerShell | Cron | Cron | Dynamic API Resolution | Network Sniffing | 1 Remote System Discovery | Shared Webroot | Local Data Staging | File Transfer Protocols | Exfiltration Over Asymmetric Encrypted Non-C2 Protocol | External Defacement |
| Network Security Appliances | Domains | Compromise Software Dependencies and Development Tools | AppleScript | Launchd | Launchd | Stripped Payloads | Input Capture | 1 System Network Configuration Discovery | Software Deployment Tools | Remote Data Staging | Mail Protocols | Exfiltration Over Unencrypted Non-C2 Protocol | Firmware Corruption |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 18% | ReversingLabs | Win32.Trojan.Munp | ||
| 37% | Virustotal | Browse |
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 100% | Joe Sandbox ML | |||
| 100% | Joe Sandbox ML | |||
| 0% | ReversingLabs | |||
| 0% | ReversingLabs | |||
| 0% | ReversingLabs | |||
| 0% | ReversingLabs | |||
| 0% | ReversingLabs | |||
| 0% | ReversingLabs | |||
| 0% | ReversingLabs | |||
| 0% | ReversingLabs | |||
| 0% | ReversingLabs | |||
| 0% | ReversingLabs | |||
| 0% | ReversingLabs | |||
| 0% | ReversingLabs | |||
| 0% | ReversingLabs | |||
| 0% | ReversingLabs | |||
| 0% | ReversingLabs | |||
| 0% | ReversingLabs | |||
| 0% | ReversingLabs | |||
| 0% | ReversingLabs |
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| ayeyoji.ru | 185.208.158.202 | true | true | unknown |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| true |
| unknown | |
| true |
| unknown | |
| true |
| unknown |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false |
| unknown |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 185.208.158.202 | ayeyoji.ru | Switzerland | 34888 | SIMPLECARRER2IT | true | |
| 89.105.201.183 | unknown | Netherlands | 24875 | NOVOSERVE-ASNL | false |
| Joe Sandbox version: | 41.0.0 Charoite |
| Analysis ID: | 1565505 |
| Start date and time: | 2024-11-30 02:32:05 +01:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 6m 4s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 10 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | getlab.exe |
| Detection: | MAL |
| Classification: | mal100.troj.evad.winEXE@10/31@1/2 |
| EGA Information: |
|
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
- Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
- Not all processes where analyzed, report is missing behavior information
- Report size exceeded maximum capacity and may have missing disassembly code.
- Report size getting too big, too many NtQueryValueKey calls found.
| Time | Type | Description |
|---|---|---|
| 20:33:32 | API Interceptor |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 185.208.158.202 | Get hash | malicious | Nymaim, Socks5Systemz | Browse | ||
| Get hash | malicious | Socks5Systemz | Browse | |||
| Get hash | malicious | LummaC, Amadey, LummaC Stealer, Stealc, Vidar | Browse | |||
| Get hash | malicious | Socks5Systemz | Browse | |||
| Get hash | malicious | Socks5Systemz | Browse | |||
| Get hash | malicious | Socks5Systemz | Browse | |||
| Get hash | malicious | Socks5Systemz | Browse | |||
| Get hash | malicious | Socks5Systemz | Browse | |||
| Get hash | malicious | Socks5Systemz | Browse | |||
| Get hash | malicious | LummaC, Amadey, Cryptbot, LummaC Stealer, Socks5Systemz, Stealc, Vidar | Browse | |||
| 89.105.201.183 | Get hash | malicious | Socks5Systemz | Browse |
| |
| Get hash | malicious | Socks5Systemz | Browse |
| ||
| Get hash | malicious | Socks5Systemz | Browse |
|
⊘No context
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| SIMPLECARRER2IT | Get hash | malicious | RHADAMANTHYS | Browse |
| |
| Get hash | malicious | RHADAMANTHYS | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Nymaim, Socks5Systemz | Browse |
| ||
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | RHADAMANTHYS | Browse |
| ||
| Get hash | malicious | Socks5Systemz | Browse |
| ||
| Get hash | malicious | LummaC, Amadey, LummaC Stealer, Stealc, Vidar | Browse |
| ||
| NOVOSERVE-ASNL | Get hash | malicious | Nymaim, Socks5Systemz | Browse |
| |
| Get hash | malicious | Socks5Systemz | Browse |
| ||
| Get hash | malicious | LummaC, Amadey, LummaC Stealer, Stealc, Vidar | Browse |
| ||
| Get hash | malicious | Socks5Systemz | Browse |
| ||
| Get hash | malicious | Socks5Systemz | Browse |
| ||
| Get hash | malicious | Socks5Systemz | Browse |
| ||
| Get hash | malicious | Socks5Systemz | Browse |
| ||
| Get hash | malicious | Socks5Systemz | Browse |
| ||
| Get hash | malicious | Socks5Systemz | Browse |
| ||
| Get hash | malicious | LummaC, Amadey, Cryptbot, LummaC Stealer, Socks5Systemz, Stealc, Vidar | Browse |
|
⊘No context
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| C:\ProgramData\BridgeGamer\sqlite3.dll | Get hash | malicious | Nymaim, Socks5Systemz | Browse | ||
| Get hash | malicious | LummaC, Amadey, LummaC Stealer, Stealc, Vidar | Browse | |||
| Get hash | malicious | Socks5Systemz | Browse | |||
| Get hash | malicious | Socks5Systemz | Browse | |||
| Get hash | malicious | Neshta, Oski Stealer, StormKitty, SugarDump, Vidar, XWorm | Browse | |||
| Get hash | malicious | Mars Stealer, Vidar | Browse | |||
| Get hash | malicious | Mars Stealer, Vidar | Browse | |||
| Get hash | malicious | Mars Stealer, Vidar | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Oski Stealer, Vidar | Browse |
| Process: | C:\Users\user\AppData\Local\XLGear 3.1.3.157\xlgear32.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 3397185 |
| Entropy (8bit): | 6.501949315581084 |
| Encrypted: | false |
| SSDEEP: | 49152:jcpp64wB/nwOGSXpzopPdJTp19zxJwBv1g58fR:jSp61nRx5zopPdJTT9zxmw58fR |
| MD5: | 9DC53D054BB2482253850DA5D8DFF405 |
| SHA1: | F6E82BED4CA68946DC87B172D9E9AB51AB38084A |
| SHA-256: | 07D66DC4FF91DA57222F880EFEF718EDE491777EA387EE09D3E26B2CAAB7DDB2 |
| SHA-512: | 249A4782254286B6A0D999720FB62DCCA616AC21BD5267377514940C22FB5D1F20F12FA9E00577258DDD5EF7B782D945716A1C118BB56320309C9C7A75E77441 |
| Malicious: | true |
| Yara Hits: |
|
| Antivirus: |
|
| Reputation: | low |
| Preview: |
| Process: | C:\Users\user\AppData\Local\XLGear 3.1.3.157\xlgear32.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 645592 |
| Entropy (8bit): | 6.50414583238337 |
| Encrypted: | false |
| SSDEEP: | 12288:i0zrcH2F3OfwjtWvuFEmhx0Cj37670jwX+E7tFKm0qTYh:iJUOfwh8u9hx0D70NE7tFTYh |
| MD5: | E477A96C8F2B18D6B5C27BDE49C990BF |
| SHA1: | E980C9BF41330D1E5BD04556DB4646A0210F7409 |
| SHA-256: | 16574F51785B0E2FC29C2C61477EB47BB39F714829999511DC8952B43AB17660 |
| SHA-512: | 335A86268E7C0E568B1C30981EC644E6CD332E66F96D2551B58A82515316693C1859D87B4F4B7310CF1AC386CEE671580FDD999C3BCB23ACF2C2282C01C8798C |
| Malicious: | true |
| Antivirus: |
|
| Joe Sandbox View: |
|
| Reputation: | high, very likely benign file |
| Preview: |
| Process: | C:\Users\user\AppData\Local\XLGear 3.1.3.157\xlgear32.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 8 |
| Entropy (8bit): | 2.0 |
| Encrypted: | false |
| SSDEEP: | 3:8C/ll:8CX |
| MD5: | 0D0A6EA34B267869C1DD64F9AD4584C2 |
| SHA1: | F7A99108740EEA61E2F3C46B989E18648C038E14 |
| SHA-256: | AA7D7191AA5A80BA1BE7EE4BA60FF2EC593B8C5EF1EC0E88E5E546DF7BDD19F0 |
| SHA-512: | 7B093076A3F26D79AC8245F76A0955C621F2BDBFB35B77CAD8FA774D723C6FD4A4243321D1F2B0E71A8D5C14B4B5AB8BA1D0FEC869E180EF923C308AAA3FC2D0 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Users\user\AppData\Local\XLGear 3.1.3.157\xlgear32.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 4 |
| Entropy (8bit): | 0.8112781244591328 |
| Encrypted: | false |
| SSDEEP: | 3:xln:j |
| MD5: | B15762FC4C227BBDB97385765FB475F4 |
| SHA1: | 3B5022C8251B22D81FB9EC294C5197E0BDDD9BD4 |
| SHA-256: | 32434DC5B0F72C9B863C24DAA5D4E79B9C43BD73B38C469FB65FD13D996B7B32 |
| SHA-512: | 3F335DDBB7830D09C4504ED9000CC9E3BA8CC14E8252446698147C9B9F52C245C744ED5C7882A78E73D002C682CF98B9BF77D87990D392833618DBDCB20C838A |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Users\user\AppData\Local\XLGear 3.1.3.157\xlgear32.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 128 |
| Entropy (8bit): | 2.9545817380615236 |
| Encrypted: | false |
| SSDEEP: | 3:SmwW3Fde9UUDrjStGs/:Smze7DPStGM |
| MD5: | 98DDA7FC0B3E548B68DE836D333D1539 |
| SHA1: | D0CB784FA2BBD3BDE2BA4400211C3B613638F1C6 |
| SHA-256: | 870555CDCBA1F066D893554731AE99A21AE776D41BCB680CBD6510CB9F420E3D |
| SHA-512: | E79BD8C2E0426DBEBA8AC2350DA66DC0413F79860611A05210905506FEF8B80A60BB7E76546B0CE9C6E6BC9DDD4BC66FF4C438548F26187EAAF6278F769B3AC1 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\AppData\Local\XLGear 3.1.3.157\xlgear32.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 128 |
| Entropy (8bit): | 1.7095628900165245 |
| Encrypted: | false |
| SSDEEP: | 3:LDXdQSWBdMUE/:LLdQSGd |
| MD5: | 4FFFD4D2A32CBF8FB78D521B4CC06680 |
| SHA1: | 3FA6EFA82F738740179A9388D8046619C7EBDF54 |
| SHA-256: | EC52F73A17E6AFCF78F3FD8DFC7177024FEB52F5AC2B602886788E4348D5FB68 |
| SHA-512: | 130A074E6AD38EEE2FB088BED2FCB939BF316B0FCBB4F5455AB49C2685BEEDCB5011107A22A153E56BF5E54A45CA4801C56936E71899C99BA9A4F694A1D4CC6D |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-BKGL7.tmp\getlab.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2560 |
| Entropy (8bit): | 2.8818118453929262 |
| Encrypted: | false |
| SSDEEP: | 24:e1GSgDIX566lIB6SXvVmMPUjvhBrDsqZ:SgDKRlVImgUNBsG |
| MD5: | A69559718AB506675E907FE49DEB71E9 |
| SHA1: | BC8F404FFDB1960B50C12FF9413C893B56F2E36F |
| SHA-256: | 2F6294F9AA09F59A574B5DCD33BE54E16B39377984F3D5658CDA44950FA0F8FC |
| SHA-512: | E52E0AA7FE3F79E36330C455D944653D449BA05B2F9ABEE0914A0910C3452CFA679A40441F9AC696B3CCF9445CBB85095747E86153402FC362BB30AC08249A63 |
| Malicious: | true |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-BKGL7.tmp\getlab.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 6144 |
| Entropy (8bit): | 4.215994423157539 |
| Encrypted: | false |
| SSDEEP: | 96:sfkcXegaJ/ZAYNzcld1xaX12pS5SKvkc:sfJEVYlvxaX12EF |
| MD5: | 4FF75F505FDDCC6A9AE62216446205D9 |
| SHA1: | EFE32D504CE72F32E92DCF01AA2752B04D81A342 |
| SHA-256: | A4C86FC4836AC728D7BD96E7915090FD59521A9E74F1D06EF8E5A47C8695FD81 |
| SHA-512: | BA0469851438212D19906D6DA8C4AE95FF1C0711A095D9F21F13530A6B8B21C3ACBB0FF55EDB8A35B41C1A9A342F5D3421C00BA395BC13BB1EF5902B979CE824 |
| Malicious: | true |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-BKGL7.tmp\getlab.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 23312 |
| Entropy (8bit): | 4.596242908851566 |
| Encrypted: | false |
| SSDEEP: | 384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4 |
| MD5: | 92DC6EF532FBB4A5C3201469A5B5EB63 |
| SHA1: | 3E89FF837147C16B4E41C30D6C796374E0B8E62C |
| SHA-256: | 9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87 |
| SHA-512: | 9908E573921D5DBC3454A1C0A6C969AB8A81CC2E8B5385391D46B1A738FB06A76AA3282E0E58D0D2FFA6F27C85668CD5178E1500B8A39B1BBAE04366AE6A86D3 |
| Malicious: | false |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\Desktop\getlab.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 704000 |
| Entropy (8bit): | 6.506120067282535 |
| Encrypted: | false |
| SSDEEP: | 12288:5/kqO+1G7DMvrP537dzHsA6BllcOuGbnH3ERNIg9rNlQyRMh1K8xyF:dkqZ1G7DMvrP537dzHsA6hcHGbH3Euhs |
| MD5: | A0CFF52B882184452424B6E618FA061B |
| SHA1: | C3985E364276F258B06A7B0DC1B87215B8FCDD80 |
| SHA-256: | F1EF7FD69A948204ED5F004B7621E7DE57320319A5F358ADC89FC30F0F06A953 |
| SHA-512: | 722871F86BFECD794A9E0246B87CCF5CF0F62787D50F383F6F71B565D9AA10687703A267A665C395958C44BF9975C0CF6BD8A1FC1A2D7B8F5584DD2D7D078871 |
| Malicious: | true |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-BKGL7.tmp\getlab.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 265728 |
| Entropy (8bit): | 6.4472652154517345 |
| Encrypted: | false |
| SSDEEP: | 6144:Fs7u3JL96d15Y2BmKh678IuYAhN3YCjlgiZioXyLWvCe93rZ5WZOlUmpNJ5mlbb/:e7WJL96d15Y2BmKh678IuYAhN3YCjlgw |
| MD5: | 752CA72DE243F44AF2ED3FF023EF826E |
| SHA1: | 7B508F6B72BD270A861B368EC9FE4BF55D8D472F |
| SHA-256: | F8196F03F8CBED87A92BA5C1207A9063D4EEBB0C22CA88A279F1AE1B1F1B8196 |
| SHA-512: | 4E5A7242C25D4BBF9087F813D4BF057432271A0F08580DA8C894B7C290DE9E0CF640F6F616B0B6C6CAD14DC0AFDD2697D2855BA4070270824540BAE835FE8C4A |
| Malicious: | true |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-BKGL7.tmp\getlab.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 176128 |
| Entropy (8bit): | 6.204917493416147 |
| Encrypted: | false |
| SSDEEP: | 3072:l9iEoC1+7N9UQV2Mi8NTUU3/EO3h3E9y6GeoPRtsoWhi75MUbvSHQ:l+ssU62Mi8x9P/UVGeQRthMUbvS |
| MD5: | FEC4FF0C2967A05543747E8D552CF9DF |
| SHA1: | B4449DC0DF8C0AFCC9F32776384A6F5B5CEDE20C |
| SHA-256: | 5374148EBCF4B456F8711516A58C9A007A393CA88F3D9759041F691E4343C7D6 |
| SHA-512: | 93E3F48CD393314178CBC86F6142D577D5EAAE52B47C4D947DBA4DFB706860B150FF5B0E546CB83114CA44666E9DF6021964D79D064B775A58698DAA9550EF13 |
| Malicious: | true |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-BKGL7.tmp\getlab.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1645320 |
| Entropy (8bit): | 6.787752063353702 |
| Encrypted: | false |
| SSDEEP: | 24576:Fk18V2mHkfIE3Ip9vkWEgDecZV3W9kpOuRw8RhWd5Ixwzr6lOboU7j97S9D+z98v:FZNkf+uW3D1ZVG9kVw8I5Rv6lwH9+X |
| MD5: | 871C903A90C45CA08A9D42803916C3F7 |
| SHA1: | D962A12BC15BFB4C505BB63F603CA211588958DB |
| SHA-256: | F1DA32183B3DA19F75FA4EF0974A64895266B16D119BBB1DA9FE63867DBA0645 |
| SHA-512: | 985B0B8B5E3D96ACFD0514676D9F0C5D2D8F11E31F01ACFA0F7DA9AF3568E12343CA77F541F55EDDA6A0E5C14FE733BDA5DC1C10BB170D40D15B7A60AD000145 |
| Malicious: | false |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-BKGL7.tmp\getlab.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1645320 |
| Entropy (8bit): | 6.787752063353702 |
| Encrypted: | false |
| SSDEEP: | 24576:Fk18V2mHkfIE3Ip9vkWEgDecZV3W9kpOuRw8RhWd5Ixwzr6lOboU7j97S9D+z98v:FZNkf+uW3D1ZVG9kVw8I5Rv6lwH9+X |
| MD5: | 871C903A90C45CA08A9D42803916C3F7 |
| SHA1: | D962A12BC15BFB4C505BB63F603CA211588958DB |
| SHA-256: | F1DA32183B3DA19F75FA4EF0974A64895266B16D119BBB1DA9FE63867DBA0645 |
| SHA-512: | 985B0B8B5E3D96ACFD0514676D9F0C5D2D8F11E31F01ACFA0F7DA9AF3568E12343CA77F541F55EDDA6A0E5C14FE733BDA5DC1C10BB170D40D15B7A60AD000145 |
| Malicious: | false |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-BKGL7.tmp\getlab.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 265728 |
| Entropy (8bit): | 6.4472652154517345 |
| Encrypted: | false |
| SSDEEP: | 6144:Fs7u3JL96d15Y2BmKh678IuYAhN3YCjlgiZioXyLWvCe93rZ5WZOlUmpNJ5mlbb/:e7WJL96d15Y2BmKh678IuYAhN3YCjlgw |
| MD5: | 752CA72DE243F44AF2ED3FF023EF826E |
| SHA1: | 7B508F6B72BD270A861B368EC9FE4BF55D8D472F |
| SHA-256: | F8196F03F8CBED87A92BA5C1207A9063D4EEBB0C22CA88A279F1AE1B1F1B8196 |
| SHA-512: | 4E5A7242C25D4BBF9087F813D4BF057432271A0F08580DA8C894B7C290DE9E0CF640F6F616B0B6C6CAD14DC0AFDD2697D2855BA4070270824540BAE835FE8C4A |
| Malicious: | true |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-BKGL7.tmp\getlab.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 645592 |
| Entropy (8bit): | 6.50414583238337 |
| Encrypted: | false |
| SSDEEP: | 12288:i0zrcH2F3OfwjtWvuFEmhx0Cj37670jwX+E7tFKm0qTYh:iJUOfwh8u9hx0D70NE7tFTYh |
| MD5: | E477A96C8F2B18D6B5C27BDE49C990BF |
| SHA1: | E980C9BF41330D1E5BD04556DB4646A0210F7409 |
| SHA-256: | 16574F51785B0E2FC29C2C61477EB47BB39F714829999511DC8952B43AB17660 |
| SHA-512: | 335A86268E7C0E568B1C30981EC644E6CD332E66F96D2551B58A82515316693C1859D87B4F4B7310CF1AC386CEE671580FDD999C3BCB23ACF2C2282C01C8798C |
| Malicious: | true |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-BKGL7.tmp\getlab.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 499712 |
| Entropy (8bit): | 6.414789978441117 |
| Encrypted: | false |
| SSDEEP: | 12288:fJzxYPVsBnxO/R7krZhUgiW6QR7t5k3Ooc8iHkC2eq:fZxvBnxOJ7ki3Ooc8iHkC2e |
| MD5: | 561FA2ABB31DFA8FAB762145F81667C2 |
| SHA1: | C8CCB04EEDAC821A13FAE314A2435192860C72B8 |
| SHA-256: | DF96156F6A548FD6FE5672918DE5AE4509D3C810A57BFFD2A91DE45A3ED5B23B |
| SHA-512: | 7D960AA8E3CCE22D63A6723D7F00C195DE7DE83B877ECA126E339E2D8CC9859E813E05C5C0A5671A75BB717243E9295FD13E5E17D8C6660EB59F5BAEE63A7C43 |
| Malicious: | false |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-BKGL7.tmp\getlab.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 176128 |
| Entropy (8bit): | 6.204917493416147 |
| Encrypted: | false |
| SSDEEP: | 3072:l9iEoC1+7N9UQV2Mi8NTUU3/EO3h3E9y6GeoPRtsoWhi75MUbvSHQ:l+ssU62Mi8x9P/UVGeQRthMUbvS |
| MD5: | FEC4FF0C2967A05543747E8D552CF9DF |
| SHA1: | B4449DC0DF8C0AFCC9F32776384A6F5B5CEDE20C |
| SHA-256: | 5374148EBCF4B456F8711516A58C9A007A393CA88F3D9759041F691E4343C7D6 |
| SHA-512: | 93E3F48CD393314178CBC86F6142D577D5EAAE52B47C4D947DBA4DFB706860B150FF5B0E546CB83114CA44666E9DF6021964D79D064B775A58698DAA9550EF13 |
| Malicious: | true |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-BKGL7.tmp\getlab.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 78183 |
| Entropy (8bit): | 7.692742945771669 |
| Encrypted: | false |
| SSDEEP: | 1536:Bkt2SjEQ3r94YqwyadpL1X6Dtn4afF1VowWb8ZmmUQNk3gNqCLbMsFxJse8hbpmn:mR/CYj9dp5XIyI2b/mY3gNjLbMsOaP |
| MD5: | B1B9E6D43319F6D4E52ED858C5726A97 |
| SHA1: | 5033047A30CCCF57783C600FD76A6D220021B19D |
| SHA-256: | 8003A4A0F9F5DFB62BEFBF81F8C05894B0C1F987ACFC8654A6C6CE02B6213910 |
| SHA-512: | E56D6EC9170DEBAC28BB514942F794F73D4C194D04C54EFF9227B6EE3C74BA4FCF239FFF0BB6556DC8B847FA89D382AF206A2C481C41A3510936B0A74192D2C2 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-BKGL7.tmp\getlab.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 348160 |
| Entropy (8bit): | 6.542655141037356 |
| Encrypted: | false |
| SSDEEP: | 6144:OcV9z83OtqxnEYmt3NEnvfF+Tbmbw6An8FMciFMNrb3YgxxpbCAOxO2ElvlE:Ooz83OtIEzW+/m/AyF7bCrO/E |
| MD5: | 86F1895AE8C5E8B17D99ECE768A70732 |
| SHA1: | D5502A1D00787D68F548DDEEBBDE1ECA5E2B38CA |
| SHA-256: | 8094AF5EE310714CAEBCCAEEE7769FFB08048503BA478B879EDFEF5F1A24FEFE |
| SHA-512: | 3B7CE2B67056B6E005472B73447D2226677A8CADAE70428873F7EFA5ED11A3B3DBF6B1A42C5B05B1F2B1D8E06FF50DFC6532F043AF8452ED87687EEFBF1791DA |
| Malicious: | false |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-BKGL7.tmp\getlab.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 3397185 |
| Entropy (8bit): | 6.501948936593034 |
| Encrypted: | false |
| SSDEEP: | 49152:Icpp64wB/nwOGSXpzopPdJTp19zxJwBv1g58fR:ISp61nRx5zopPdJTT9zxmw58fR |
| MD5: | 861098E5924051934AC2F9B85677EFD9 |
| SHA1: | B5EFBD2812ADE331443837A8365395132400108C |
| SHA-256: | 6A6CA4E72479D68BBD99618DD2C15608C5F6257CE3D5E67F577D2021B6769A91 |
| SHA-512: | 41E58A9CF7AE965296DF22FCEF9C14D08691A382AFA050694F8EE499F8D2E3DA170F164E0F23587F8FB88C055570E43E626DA0870C01A626722E0B8E70828475 |
| Malicious: | false |
| Yara Hits: |
|
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-BKGL7.tmp\getlab.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 445440 |
| Entropy (8bit): | 6.439135831549689 |
| Encrypted: | false |
| SSDEEP: | 12288:sosmML3+OytpWFkCU1wayvT33iiDNmAE27R9sY9kP0O+:soslvJ3RaY9wU |
| MD5: | CAC7E17311797C5471733638C0DC1F01 |
| SHA1: | 58E0BD1B63525A2955439CB9BE3431CEA7FF1121 |
| SHA-256: | 19248357ED7CFF72DEAD18B5743BF66C61438D68374BDA59E3B9D444C6F8F505 |
| SHA-512: | A677319AC8A2096D95FFC69F22810BD4F083F6BF55B8A77F20D8FB8EE01F2FEE619CE318D1F55C392A8F3A4D635D9285712E2C572E62997014641C36EDC060A2 |
| Malicious: | true |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-BKGL7.tmp\getlab.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 445440 |
| Entropy (8bit): | 6.439135831549689 |
| Encrypted: | false |
| SSDEEP: | 12288:sosmML3+OytpWFkCU1wayvT33iiDNmAE27R9sY9kP0O+:soslvJ3RaY9wU |
| MD5: | CAC7E17311797C5471733638C0DC1F01 |
| SHA1: | 58E0BD1B63525A2955439CB9BE3431CEA7FF1121 |
| SHA-256: | 19248357ED7CFF72DEAD18B5743BF66C61438D68374BDA59E3B9D444C6F8F505 |
| SHA-512: | A677319AC8A2096D95FFC69F22810BD4F083F6BF55B8A77F20D8FB8EE01F2FEE619CE318D1F55C392A8F3A4D635D9285712E2C572E62997014641C36EDC060A2 |
| Malicious: | true |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-BKGL7.tmp\getlab.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 499712 |
| Entropy (8bit): | 6.414789978441117 |
| Encrypted: | false |
| SSDEEP: | 12288:fJzxYPVsBnxO/R7krZhUgiW6QR7t5k3Ooc8iHkC2eq:fZxvBnxOJ7ki3Ooc8iHkC2e |
| MD5: | 561FA2ABB31DFA8FAB762145F81667C2 |
| SHA1: | C8CCB04EEDAC821A13FAE314A2435192860C72B8 |
| SHA-256: | DF96156F6A548FD6FE5672918DE5AE4509D3C810A57BFFD2A91DE45A3ED5B23B |
| SHA-512: | 7D960AA8E3CCE22D63A6723D7F00C195DE7DE83B877ECA126E339E2D8CC9859E813E05C5C0A5671A75BB717243E9295FD13E5E17D8C6660EB59F5BAEE63A7C43 |
| Malicious: | false |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-BKGL7.tmp\getlab.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 348160 |
| Entropy (8bit): | 6.542655141037356 |
| Encrypted: | false |
| SSDEEP: | 6144:OcV9z83OtqxnEYmt3NEnvfF+Tbmbw6An8FMciFMNrb3YgxxpbCAOxO2ElvlE:Ooz83OtIEzW+/m/AyF7bCrO/E |
| MD5: | 86F1895AE8C5E8B17D99ECE768A70732 |
| SHA1: | D5502A1D00787D68F548DDEEBBDE1ECA5E2B38CA |
| SHA-256: | 8094AF5EE310714CAEBCCAEEE7769FFB08048503BA478B879EDFEF5F1A24FEFE |
| SHA-512: | 3B7CE2B67056B6E005472B73447D2226677A8CADAE70428873F7EFA5ED11A3B3DBF6B1A42C5B05B1F2B1D8E06FF50DFC6532F043AF8452ED87687EEFBF1791DA |
| Malicious: | false |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-BKGL7.tmp\getlab.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 645592 |
| Entropy (8bit): | 6.50414583238337 |
| Encrypted: | false |
| SSDEEP: | 12288:i0zrcH2F3OfwjtWvuFEmhx0Cj37670jwX+E7tFKm0qTYh:iJUOfwh8u9hx0D70NE7tFTYh |
| MD5: | E477A96C8F2B18D6B5C27BDE49C990BF |
| SHA1: | E980C9BF41330D1E5BD04556DB4646A0210F7409 |
| SHA-256: | 16574F51785B0E2FC29C2C61477EB47BB39F714829999511DC8952B43AB17660 |
| SHA-512: | 335A86268E7C0E568B1C30981EC644E6CD332E66F96D2551B58A82515316693C1859D87B4F4B7310CF1AC386CEE671580FDD999C3BCB23ACF2C2282C01C8798C |
| Malicious: | true |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-BKGL7.tmp\getlab.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 715253 |
| Entropy (8bit): | 6.5146632006329614 |
| Encrypted: | false |
| SSDEEP: | 12288:B/kqO+1G7DMvrP537dzHsA6BllcOuGbnH3ERNIg9rNlQyRMh1K8xyF/:VkqZ1G7DMvrP537dzHsA6hcHGbH3EuhG |
| MD5: | 317EF0BA2AF7B18B55096279F8FD1591 |
| SHA1: | F7197AC8FE9FD4B5992139E65FDF68C0A4025EBB |
| SHA-256: | 1B3AAF4CA0365009D5CD77E33397AC051F7D8AB03483A104DF025EC1B9799955 |
| SHA-512: | ECEE1445960F5BBF7DFEF3B5AE46F278B88778A4B3CE6C590CEB53A4F310B71A336D6A3D8CC8C8D7809E1578341D1021CC44FBD881C58E62FCB96B2C36BCBCB0 |
| Malicious: | true |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-BKGL7.tmp\getlab.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 4806 |
| Entropy (8bit): | 4.730907338717463 |
| Encrypted: | false |
| SSDEEP: | 96:jLnWaGn8ipV7bbr9t+eOIhma7ICSss/LnhL+I:HnWaGnVpV7KHIhxICSsAnhF |
| MD5: | A97193D07E3E719C3685728B02989889 |
| SHA1: | 12FFEAD8249C8D852CEDC2ED78A9D858F522F7AF |
| SHA-256: | 86C935636E1EAE8363EABAF75294169A9C478E3C4FC3D968AD434E53397EFD8F |
| SHA-512: | BE9B8EDA1CD9FF7F031652BC7809C47E7E3836A9D21C339D0017C046FB48EB395BB1410C843675A5C3B002183707C960BF8D385165121D498C5CF003934ED91C |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-BKGL7.tmp\getlab.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 715253 |
| Entropy (8bit): | 6.5146632006329614 |
| Encrypted: | false |
| SSDEEP: | 12288:B/kqO+1G7DMvrP537dzHsA6BllcOuGbnH3ERNIg9rNlQyRMh1K8xyF/:VkqZ1G7DMvrP537dzHsA6hcHGbH3EuhG |
| MD5: | 317EF0BA2AF7B18B55096279F8FD1591 |
| SHA1: | F7197AC8FE9FD4B5992139E65FDF68C0A4025EBB |
| SHA-256: | 1B3AAF4CA0365009D5CD77E33397AC051F7D8AB03483A104DF025EC1B9799955 |
| SHA-512: | ECEE1445960F5BBF7DFEF3B5AE46F278B88778A4B3CE6C590CEB53A4F310B71A336D6A3D8CC8C8D7809E1578341D1021CC44FBD881C58E62FCB96B2C36BCBCB0 |
| Malicious: | true |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-BKGL7.tmp\getlab.tmp |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 78183 |
| Entropy (8bit): | 7.692742945771669 |
| Encrypted: | false |
| SSDEEP: | 1536:Bkt2SjEQ3r94YqwyadpL1X6Dtn4afF1VowWb8ZmmUQNk3gNqCLbMsFxJse8hbpmn:mR/CYj9dp5XIyI2b/mY3gNjLbMsOaP |
| MD5: | B1B9E6D43319F6D4E52ED858C5726A97 |
| SHA1: | 5033047A30CCCF57783C600FD76A6D220021B19D |
| SHA-256: | 8003A4A0F9F5DFB62BEFBF81F8C05894B0C1F987ACFC8654A6C6CE02B6213910 |
| SHA-512: | E56D6EC9170DEBAC28BB514942F794F73D4C194D04C54EFF9227B6EE3C74BA4FCF239FFF0BB6556DC8B847FA89D382AF206A2C481C41A3510936B0A74192D2C2 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\AppData\Local\Temp\is-BKGL7.tmp\getlab.tmp |
| File Type: | |
| Category: | modified |
| Size (bytes): | 3397185 |
| Entropy (8bit): | 6.501949315581084 |
| Encrypted: | false |
| SSDEEP: | 49152:jcpp64wB/nwOGSXpzopPdJTp19zxJwBv1g58fR:jSp61nRx5zopPdJTT9zxmw58fR |
| MD5: | 9DC53D054BB2482253850DA5D8DFF405 |
| SHA1: | F6E82BED4CA68946DC87B172D9E9AB51AB38084A |
| SHA-256: | 07D66DC4FF91DA57222F880EFEF718EDE491777EA387EE09D3E26B2CAAB7DDB2 |
| SHA-512: | 249A4782254286B6A0D999720FB62DCCA616AC21BD5267377514940C22FB5D1F20F12FA9E00577258DDD5EF7B782D945716A1C118BB56320309C9C7A75E77441 |
| Malicious: | true |
| Yara Hits: |
|
| Antivirus: |
|
| Preview: |
| File type: | |
| Entropy (8bit): | 7.9979305594973775 |
| TrID: |
|
| File name: | getlab.exe |
| File size: | 3'599'599 bytes |
| MD5: | 15bd54ed3324a464c1deb1a883e7649e |
| SHA1: | 7a6853de5875b347fe48afb232d249e44efeb879 |
| SHA256: | 7d728e3092520965203537354ccb0798292014885aecdefe1f22a988cb67661d |
| SHA512: | ce9ba0c6853f6cb77f8464c6b09ecf8f0d41555025a7de720a7a2b9b822d39bccdd8798b9e40cc188bd1c943e7a347541c72258247b8a42b5a325878cc294426 |
| SSDEEP: | 49152:1vFQDY+MpR85bqkh0X/5zflc+cOqngh0Kn3aSl0OlJaHiAJ0YAVbzzqqRnSTKqNE:NFNoK/5Bkgh0K3aJOGCVdiZ/HA |
| TLSH: | 99F53302FA9045FFE2698C75E92904124F177A6E05BEE508BA8ECE146BBEFE4D45C701 |
| File Content Preview: | MZP.....................@...............................................!..L.!..This program must be run under Win32..$7....................................................................................................................................... |
 | |
| Icon Hash: | 2d2e3797b32b2b99 |
| Entrypoint: | 0x409c40 |
| Entrypoint Section: | CODE |
| Digitally signed: | false |
| Imagebase: | 0x400000 |
| Subsystem: | windows gui |
| Image File Characteristics: | RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI |
| DLL Characteristics: | TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 1 |
| OS Version Minor: | 0 |
| File Version Major: | 1 |
| File Version Minor: | 0 |
| Subsystem Version Major: | 1 |
| Subsystem Version Minor: | 0 |
| Import Hash: | 884310b1928934402ea6fec1dbd3cf5e |
| Instruction |
|---|
| push ebp |
| mov ebp, esp |
| add esp, FFFFFFC4h |
| push ebx |
| push esi |
| push edi |
| xor eax, eax |
| mov dword ptr [ebp-10h], eax |
| mov dword ptr [ebp-24h], eax |
| call 00007FE7748C700Bh |
| call 00007FE7748C8212h |
| call 00007FE7748C84A1h |
| call 00007FE7748CA4D8h |
| call 00007FE7748CA51Fh |
| call 00007FE7748CCE4Eh |
| call 00007FE7748CCFB5h |
| xor eax, eax |
| push ebp |
| push 0040A2FCh |
| push dword ptr fs:[eax] |
| mov dword ptr fs:[eax], esp |
| xor edx, edx |
| push ebp |
| push 0040A2C5h |
| push dword ptr fs:[edx] |
| mov dword ptr fs:[edx], esp |
| mov eax, dword ptr [0040C014h] |
| call 00007FE7748CDA1Bh |
| call 00007FE7748CD64Eh |
| lea edx, dword ptr [ebp-10h] |
| xor eax, eax |
| call 00007FE7748CAB08h |
| mov edx, dword ptr [ebp-10h] |
| mov eax, 0040CE24h |
| call 00007FE7748C70B7h |
| push 00000002h |
| push 00000000h |
| push 00000001h |
| mov ecx, dword ptr [0040CE24h] |
| mov dl, 01h |
| mov eax, 0040738Ch |
| call 00007FE7748CB397h |
| mov dword ptr [0040CE28h], eax |
| xor edx, edx |
| push ebp |
| push 0040A27Dh |
| push dword ptr fs:[edx] |
| mov dword ptr fs:[edx], esp |
| call 00007FE7748CDA8Bh |
| mov dword ptr [0040CE30h], eax |
| mov eax, dword ptr [0040CE30h] |
| cmp dword ptr [eax+0Ch], 01h |
| jne 00007FE7748CDBCAh |
| mov eax, dword ptr [0040CE30h] |
| mov edx, 00000028h |
| call 00007FE7748CB798h |
| mov edx, dword ptr [00000030h] |
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0xd000 | 0x950 | .idata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x11000 | 0x2c00 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0xf000 | 0x18 | .rdata |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| CODE | 0x1000 | 0x9364 | 0x9400 | 2c410dfc3efd04d9b69c35c70921424e | False | 0.6147856841216216 | data | 6.560885192755103 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| DATA | 0xb000 | 0x24c | 0x400 | d5ea23d4ecf110fd2591314cbaa84278 | False | 0.310546875 | data | 2.7390956346874638 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| BSS | 0xc000 | 0xe88 | 0x0 | d41d8cd98f00b204e9800998ecf8427e | False | 0 | empty | 0.0 | IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .idata | 0xd000 | 0x950 | 0xa00 | bb5485bf968b970e5ea81292af2acdba | False | 0.414453125 | data | 4.430733069799036 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .tls | 0xe000 | 0x8 | 0x0 | d41d8cd98f00b204e9800998ecf8427e | False | 0 | empty | 0.0 | IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .rdata | 0xf000 | 0x18 | 0x200 | 9ba824905bf9c7922b6fc87a38b74366 | False | 0.052734375 | data | 0.2044881574398449 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ |
| .reloc | 0x10000 | 0x8b4 | 0x0 | d41d8cd98f00b204e9800998ecf8427e | False | 0 | empty | 0.0 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ |
| .rsrc | 0x11000 | 0x2c00 | 0x2c00 | 7be6483681d9a60b92b7e93f348010e6 | False | 0.32191051136363635 | data | 4.455636105188938 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| RT_ICON | 0x11354 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 192 | Dutch | Netherlands | 0.5675675675675675 |
| RT_ICON | 0x1147c | 0x568 | Device independent bitmap graphic, 16 x 32 x 8, image size 320 | Dutch | Netherlands | 0.4486994219653179 |
| RT_ICON | 0x119e4 | 0x2e8 | Device independent bitmap graphic, 32 x 64 x 4, image size 640 | Dutch | Netherlands | 0.4637096774193548 |
| RT_ICON | 0x11ccc | 0x8a8 | Device independent bitmap graphic, 32 x 64 x 8, image size 1152 | Dutch | Netherlands | 0.3935018050541516 |
| RT_STRING | 0x12574 | 0x2f2 | data | 0.35543766578249336 | ||
| RT_STRING | 0x12868 | 0x30c | data | 0.3871794871794872 | ||
| RT_STRING | 0x12b74 | 0x2ce | data | 0.42618384401114207 | ||
| RT_STRING | 0x12e44 | 0x68 | data | 0.75 | ||
| RT_STRING | 0x12eac | 0xb4 | data | 0.6277777777777778 | ||
| RT_STRING | 0x12f60 | 0xae | data | 0.5344827586206896 | ||
| RT_RCDATA | 0x13010 | 0x2c | data | 1.1590909090909092 | ||
| RT_GROUP_ICON | 0x1303c | 0x3e | data | English | United States | 0.8387096774193549 |
| RT_VERSION | 0x1307c | 0x4b8 | COM executable for DOS | English | United States | 0.26903973509933776 |
| RT_MANIFEST | 0x13534 | 0x560 | XML 1.0 document, ASCII text, with CRLF line terminators | English | United States | 0.4251453488372093 |
| DLL | Import |
|---|---|
| kernel32.dll | DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, WideCharToMultiByte, TlsSetValue, TlsGetValue, MultiByteToWideChar, GetModuleHandleA, GetLastError, GetCommandLineA, WriteFile, SetFilePointer, SetEndOfFile, RtlUnwind, ReadFile, RaiseException, GetStdHandle, GetFileSize, GetSystemTime, GetFileType, ExitProcess, CreateFileA, CloseHandle |
| user32.dll | MessageBoxA |
| oleaut32.dll | VariantChangeTypeEx, VariantCopyInd, VariantClear, SysStringLen, SysAllocStringLen |
| advapi32.dll | RegQueryValueExA, RegOpenKeyExA, RegCloseKey, OpenProcessToken, LookupPrivilegeValueA |
| kernel32.dll | WriteFile, VirtualQuery, VirtualProtect, VirtualFree, VirtualAlloc, Sleep, SizeofResource, SetLastError, SetFilePointer, SetErrorMode, SetEndOfFile, RemoveDirectoryA, ReadFile, LockResource, LoadResource, LoadLibraryA, IsDBCSLeadByte, GetWindowsDirectoryA, GetVersionExA, GetUserDefaultLangID, GetSystemInfo, GetSystemDefaultLCID, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLastError, GetFullPathNameA, GetFileSize, GetFileAttributesA, GetExitCodeProcess, GetEnvironmentVariableA, GetCurrentProcess, GetCommandLineA, GetACP, InterlockedExchange, FormatMessageA, FindResourceA, DeleteFileA, CreateProcessA, CreateFileA, CreateDirectoryA, CloseHandle |
| user32.dll | TranslateMessage, SetWindowLongA, PeekMessageA, MsgWaitForMultipleObjects, MessageBoxA, LoadStringA, ExitWindowsEx, DispatchMessageA, DestroyWindow, CreateWindowExA, CallWindowProcA, CharPrevA |
| comctl32.dll | InitCommonControls |
| advapi32.dll | AdjustTokenPrivileges |
| Language of compilation system | Country where language is spoken | Map |
|---|---|---|
| Dutch | Netherlands |  |
| English | United States |  |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | SID | Signature | Severity | Source IP | Source Port | Dest IP | Dest Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2024-11-30T02:33:53.594534+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49736 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:33:53.594534+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49736 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:33:54.179795+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49736 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:33:54.179795+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49736 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:33:58.262436+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49736 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:33:58.262436+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49736 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:33:58.849545+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49736 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:33:58.849545+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49736 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:00.572922+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49746 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:00.572922+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49746 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:02.227166+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49752 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:02.227166+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49752 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:03.917609+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49758 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:03.917609+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49758 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:04.497598+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49758 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:04.497598+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49758 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:05.066031+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49758 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:05.066031+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49758 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:06.739788+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49764 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:06.739788+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49764 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:08.320376+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49770 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:08.320376+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49770 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:09.937602+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49771 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:09.937602+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49771 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:11.556643+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49777 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:11.556643+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49777 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:13.226956+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49783 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:13.226956+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49783 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:14.944372+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49788 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:14.944372+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49788 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:16.553933+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49790 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:16.553933+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49790 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:18.166014+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49795 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:18.166014+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49795 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:19.845585+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49800 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:19.845585+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49800 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:21.511567+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49803 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:21.511567+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49803 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:22.101381+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49803 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:22.101381+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49803 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:23.884939+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49809 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:23.884939+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49809 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:25.556492+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49814 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:25.556492+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49814 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:27.189408+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49820 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:27.189408+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49820 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:28.850327+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49825 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:28.850327+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49825 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:30.470731+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49828 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:30.470731+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49828 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:32.109688+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49833 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:32.109688+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49833 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:32.691157+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49833 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:32.691157+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49833 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:34.309929+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49839 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:34.309929+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49839 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:35.944753+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49844 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:35.944753+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49844 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:37.661938+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49849 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:37.661938+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49849 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:39.304888+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49853 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:39.304888+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49853 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:40.919549+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49858 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:40.919549+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49858 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:41.503613+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49858 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:41.503613+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49858 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:43.116466+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49864 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:43.116466+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49864 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:44.735837+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49869 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:44.735837+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49869 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:46.404795+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49873 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:46.404795+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49873 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:48.037210+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49878 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:48.037210+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49878 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:49.693432+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49883 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:49.693432+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49883 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:51.306229+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49888 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:51.306229+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49888 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:53.021656+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49891 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:53.021656+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49891 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:54.635453+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49896 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:54.635453+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49896 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:56.331578+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49901 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:56.331578+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49901 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:57.905243+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49905 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:57.905243+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49905 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:59.511137+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49910 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:34:59.511137+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49910 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:35:01.180445+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49915 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:35:01.180445+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49915 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:35:02.800433+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49920 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:35:02.800433+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49920 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:35:04.465736+0100 | 2049467 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 | 1 | 192.168.2.4 | 49923 | 185.208.158.202 | 80 | TCP |
| 2024-11-30T02:35:04.465736+0100 | 2050112 | ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 | 1 | 192.168.2.4 | 49923 | 185.208.158.202 | 80 | TCP |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Nov 30, 2024 02:33:52.096848965 CET | 49736 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:33:52.216943026 CET | 80 | 49736 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:33:52.217019081 CET | 49736 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:33:52.217340946 CET | 49736 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:33:52.337357044 CET | 80 | 49736 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:33:53.594434977 CET | 80 | 49736 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:33:53.594533920 CET | 49736 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:33:53.701723099 CET | 49736 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:33:53.821722984 CET | 80 | 49736 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:33:54.179733038 CET | 80 | 49736 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:33:54.179795027 CET | 49736 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:33:54.180908918 CET | 49737 | 2023 | 192.168.2.4 | 89.105.201.183 |
| Nov 30, 2024 02:33:54.301031113 CET | 2023 | 49737 | 89.105.201.183 | 192.168.2.4 |
| Nov 30, 2024 02:33:54.301124096 CET | 49737 | 2023 | 192.168.2.4 | 89.105.201.183 |
| Nov 30, 2024 02:33:54.301193953 CET | 49737 | 2023 | 192.168.2.4 | 89.105.201.183 |
| Nov 30, 2024 02:33:54.421323061 CET | 2023 | 49737 | 89.105.201.183 | 192.168.2.4 |
| Nov 30, 2024 02:33:54.421401024 CET | 49737 | 2023 | 192.168.2.4 | 89.105.201.183 |
| Nov 30, 2024 02:33:54.541397095 CET | 2023 | 49737 | 89.105.201.183 | 192.168.2.4 |
| Nov 30, 2024 02:33:55.731463909 CET | 2023 | 49737 | 89.105.201.183 | 192.168.2.4 |
| Nov 30, 2024 02:33:55.777184963 CET | 49737 | 2023 | 192.168.2.4 | 89.105.201.183 |
| Nov 30, 2024 02:33:57.749596119 CET | 49736 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:33:57.869693041 CET | 80 | 49736 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:33:58.262341976 CET | 80 | 49736 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:33:58.262435913 CET | 49736 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:33:58.375155926 CET | 49736 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:33:58.495166063 CET | 80 | 49736 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:33:58.844825029 CET | 80 | 49736 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:33:58.849545002 CET | 49736 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:33:58.851532936 CET | 49745 | 2023 | 192.168.2.4 | 89.105.201.183 |
| Nov 30, 2024 02:33:58.972253084 CET | 2023 | 49745 | 89.105.201.183 | 192.168.2.4 |
| Nov 30, 2024 02:33:58.973149061 CET | 49745 | 2023 | 192.168.2.4 | 89.105.201.183 |
| Nov 30, 2024 02:33:58.973283052 CET | 49745 | 2023 | 192.168.2.4 | 89.105.201.183 |
| Nov 30, 2024 02:33:58.973344088 CET | 49745 | 2023 | 192.168.2.4 | 89.105.201.183 |
| Nov 30, 2024 02:33:59.077771902 CET | 49736 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:33:59.078171968 CET | 49746 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:33:59.093359947 CET | 2023 | 49745 | 89.105.201.183 | 192.168.2.4 |
| Nov 30, 2024 02:33:59.135555983 CET | 2023 | 49745 | 89.105.201.183 | 192.168.2.4 |
| Nov 30, 2024 02:33:59.198087931 CET | 80 | 49746 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:33:59.198156118 CET | 49746 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:33:59.198226929 CET | 80 | 49736 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:33:59.198266983 CET | 49736 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:33:59.198496103 CET | 49746 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:33:59.318337917 CET | 80 | 49746 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:00.015137911 CET | 2023 | 49745 | 89.105.201.183 | 192.168.2.4 |
| Nov 30, 2024 02:34:00.016177893 CET | 49745 | 2023 | 192.168.2.4 | 89.105.201.183 |
| Nov 30, 2024 02:34:00.572812080 CET | 80 | 49746 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:00.572921991 CET | 49746 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:00.686316967 CET | 49746 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:00.686544895 CET | 49752 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:00.806529045 CET | 80 | 49752 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:00.806634903 CET | 49752 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:00.806781054 CET | 49752 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:00.806833029 CET | 80 | 49746 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:00.806890011 CET | 49746 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:00.926696062 CET | 80 | 49752 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:02.227019072 CET | 80 | 49752 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:02.227165937 CET | 49752 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:02.343282938 CET | 49752 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:02.343614101 CET | 49758 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:02.463560104 CET | 80 | 49758 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:02.463644981 CET | 49758 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:02.463706017 CET | 80 | 49752 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:02.463758945 CET | 49752 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:02.467372894 CET | 49758 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:02.587374926 CET | 80 | 49758 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:03.916752100 CET | 80 | 49758 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:03.917608976 CET | 49758 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:04.031367064 CET | 49758 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:04.151328087 CET | 80 | 49758 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:04.493899107 CET | 80 | 49758 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:04.497597933 CET | 49758 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:04.608022928 CET | 49758 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:04.727838039 CET | 80 | 49758 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:05.065917969 CET | 80 | 49758 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:05.066030979 CET | 49758 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:05.273112059 CET | 49758 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:05.277271986 CET | 49764 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:05.393543005 CET | 80 | 49758 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:05.393676996 CET | 49758 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:05.397216082 CET | 80 | 49764 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:05.397308111 CET | 49764 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:05.415508986 CET | 49764 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:05.535389900 CET | 80 | 49764 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:06.739707947 CET | 80 | 49764 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:06.739788055 CET | 49764 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:06.858076096 CET | 49764 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:06.858366013 CET | 49770 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:06.978216887 CET | 80 | 49770 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:06.978344917 CET | 80 | 49764 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:06.978482008 CET | 49764 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:06.978771925 CET | 49770 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:06.978771925 CET | 49770 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:07.098635912 CET | 80 | 49770 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:08.320300102 CET | 80 | 49770 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:08.320375919 CET | 49770 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:08.436048985 CET | 49770 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:08.436395884 CET | 49771 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:08.556494951 CET | 80 | 49771 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:08.556513071 CET | 80 | 49770 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:08.556616068 CET | 49770 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:08.556629896 CET | 49771 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:08.556945086 CET | 49771 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:08.676769972 CET | 80 | 49771 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:09.935836077 CET | 80 | 49771 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:09.937602043 CET | 49771 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:10.061472893 CET | 49771 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:10.062005997 CET | 49777 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:10.181926012 CET | 80 | 49777 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:10.182003021 CET | 49777 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:10.182109118 CET | 80 | 49771 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:10.182163954 CET | 49771 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:10.182204008 CET | 49777 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:10.302063942 CET | 80 | 49777 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:11.556437969 CET | 80 | 49777 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:11.556643009 CET | 49777 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:11.670712948 CET | 49777 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:11.671011925 CET | 49783 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:11.790993929 CET | 80 | 49783 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:11.791013002 CET | 80 | 49777 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:11.791148901 CET | 49777 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:11.791178942 CET | 49783 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:11.791414022 CET | 49783 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:11.911262035 CET | 80 | 49783 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:13.226771116 CET | 80 | 49783 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:13.226955891 CET | 49783 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:13.342508078 CET | 49783 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:13.342849970 CET | 49788 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:13.462625027 CET | 80 | 49783 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:13.462713003 CET | 49783 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:13.462719917 CET | 80 | 49788 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:13.462790012 CET | 49788 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:13.462992907 CET | 49788 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:13.582854033 CET | 80 | 49788 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:14.944133997 CET | 80 | 49788 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:14.944371939 CET | 49788 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:15.061223984 CET | 49788 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:15.061567068 CET | 49790 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:15.181313038 CET | 80 | 49788 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:15.181411982 CET | 49788 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:15.181451082 CET | 80 | 49790 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:15.181521893 CET | 49790 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:15.181719065 CET | 49790 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:15.301517963 CET | 80 | 49790 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:16.553778887 CET | 80 | 49790 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:16.553932905 CET | 49790 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:16.670644045 CET | 49790 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:16.670928955 CET | 49795 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:16.790906906 CET | 80 | 49795 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:16.790930033 CET | 80 | 49790 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:16.791151047 CET | 49795 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:16.791153908 CET | 49790 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:16.791323900 CET | 49795 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:16.911159039 CET | 80 | 49795 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:18.165915012 CET | 80 | 49795 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:18.166013956 CET | 49795 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:18.280327082 CET | 49795 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:18.280673027 CET | 49800 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:18.400732040 CET | 80 | 49800 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:18.400752068 CET | 80 | 49795 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:18.400803089 CET | 49800 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:18.400825977 CET | 49795 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:18.401058912 CET | 49800 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:18.521006107 CET | 80 | 49800 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:19.841476917 CET | 80 | 49800 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:19.845585108 CET | 49800 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:19.968292952 CET | 49800 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:19.968590975 CET | 49803 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:20.088435888 CET | 80 | 49803 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:20.088620901 CET | 80 | 49800 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:20.088771105 CET | 49800 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:20.089040995 CET | 49803 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:20.089040995 CET | 49803 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:20.208970070 CET | 80 | 49803 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:21.511260986 CET | 80 | 49803 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:21.511567116 CET | 49803 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:21.624417067 CET | 49803 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:21.744282007 CET | 80 | 49803 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:22.101311922 CET | 80 | 49803 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:22.101381063 CET | 49803 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:22.382354975 CET | 49803 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:22.386368036 CET | 49809 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:22.502546072 CET | 80 | 49803 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:22.502618074 CET | 49803 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:22.506269932 CET | 80 | 49809 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:22.506351948 CET | 49809 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:22.510927916 CET | 49809 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:22.630809069 CET | 80 | 49809 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:23.884879112 CET | 80 | 49809 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:23.884938955 CET | 49809 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:23.998876095 CET | 49809 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:23.999216080 CET | 49814 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:24.176381111 CET | 80 | 49814 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:24.176397085 CET | 80 | 49809 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:24.176506996 CET | 49809 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:24.176518917 CET | 49814 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:24.176803112 CET | 49814 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:24.296818972 CET | 80 | 49814 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:25.556432009 CET | 80 | 49814 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:25.556492090 CET | 49814 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:25.670952082 CET | 49814 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:25.671250105 CET | 49820 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:25.791266918 CET | 80 | 49820 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:25.791400909 CET | 80 | 49814 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:25.791511059 CET | 49814 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:25.791538954 CET | 49820 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:25.791766882 CET | 49820 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:25.911608934 CET | 80 | 49820 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:27.189121008 CET | 80 | 49820 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:27.189408064 CET | 49820 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:27.312123060 CET | 49820 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:27.312432051 CET | 49825 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:27.432490110 CET | 80 | 49825 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:27.432507038 CET | 80 | 49820 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:27.432620049 CET | 49820 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:27.432646036 CET | 49825 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:27.432925940 CET | 49825 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:27.552746058 CET | 80 | 49825 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:28.850276947 CET | 80 | 49825 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:28.850327015 CET | 49825 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:28.967328072 CET | 49825 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:28.967669010 CET | 49828 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:29.087527037 CET | 80 | 49825 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:29.087548971 CET | 80 | 49828 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:29.087709904 CET | 49825 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:29.087764978 CET | 49828 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:29.087987900 CET | 49828 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:29.207875967 CET | 80 | 49828 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:30.470597982 CET | 80 | 49828 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:30.470731020 CET | 49828 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:30.592765093 CET | 49828 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:30.593074083 CET | 49833 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:30.713043928 CET | 80 | 49833 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:30.713177919 CET | 80 | 49828 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:30.713259935 CET | 49833 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:30.713304043 CET | 49828 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:30.713514090 CET | 49833 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:30.833376884 CET | 80 | 49833 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:32.109592915 CET | 80 | 49833 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:32.109688044 CET | 49833 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:32.217515945 CET | 49833 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:32.337502956 CET | 80 | 49833 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:32.691086054 CET | 80 | 49833 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:32.691157103 CET | 49833 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:32.811235905 CET | 49833 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:32.811549902 CET | 49839 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:32.932055950 CET | 80 | 49833 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:32.932080984 CET | 80 | 49839 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:32.932176113 CET | 49833 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:32.932218075 CET | 49839 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:32.932424068 CET | 49839 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:33.052288055 CET | 80 | 49839 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:34.309799910 CET | 80 | 49839 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:34.309928894 CET | 49839 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:34.439785957 CET | 49839 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:34.440141916 CET | 49844 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:34.560129881 CET | 80 | 49844 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:34.560152054 CET | 80 | 49839 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:34.560234070 CET | 49844 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:34.560262918 CET | 49839 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:34.631422043 CET | 49844 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:34.751395941 CET | 80 | 49844 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:35.942440033 CET | 80 | 49844 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:35.944752932 CET | 49844 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:36.061141014 CET | 49844 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:36.061429977 CET | 49849 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:36.181315899 CET | 80 | 49849 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:36.181371927 CET | 80 | 49844 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:36.181521893 CET | 49844 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:36.181535006 CET | 49849 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:36.181797981 CET | 49849 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:36.301757097 CET | 80 | 49849 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:37.661833048 CET | 80 | 49849 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:37.661937952 CET | 49849 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:37.784380913 CET | 49849 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:37.784852982 CET | 49853 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:37.905019045 CET | 80 | 49849 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:37.905126095 CET | 49849 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:37.905194998 CET | 80 | 49853 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:37.905273914 CET | 49853 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:37.905771017 CET | 49853 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:38.025670052 CET | 80 | 49853 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:39.304721117 CET | 80 | 49853 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:39.304888010 CET | 49853 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:39.420496941 CET | 49853 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:39.420835972 CET | 49858 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:39.540684938 CET | 80 | 49858 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:39.540762901 CET | 49858 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:39.540852070 CET | 80 | 49853 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:39.540896893 CET | 49853 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:39.541003942 CET | 49858 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:39.660795927 CET | 80 | 49858 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:40.919466972 CET | 80 | 49858 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:40.919548988 CET | 49858 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:41.030101061 CET | 49858 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:41.150053978 CET | 80 | 49858 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:41.502412081 CET | 80 | 49858 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:41.503612995 CET | 49858 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:41.623684883 CET | 49858 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:41.623995066 CET | 49864 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:41.743902922 CET | 80 | 49864 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:41.744030952 CET | 80 | 49858 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:41.744155884 CET | 49858 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:41.744174004 CET | 49864 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:41.744410038 CET | 49864 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:41.864295959 CET | 80 | 49864 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:43.116338015 CET | 80 | 49864 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:43.116466045 CET | 49864 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:43.233156919 CET | 49864 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:43.233530998 CET | 49869 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:43.353444099 CET | 80 | 49864 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:43.353470087 CET | 80 | 49869 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:43.353588104 CET | 49864 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:43.353630066 CET | 49869 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:43.353902102 CET | 49869 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:43.473754883 CET | 80 | 49869 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:44.735771894 CET | 80 | 49869 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:44.735836983 CET | 49869 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:44.842367887 CET | 49869 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:44.842696905 CET | 49873 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:44.962610006 CET | 80 | 49873 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:44.962800026 CET | 49873 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:44.962877989 CET | 49873 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:44.963287115 CET | 80 | 49869 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:44.963335037 CET | 49869 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:45.082739115 CET | 80 | 49873 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:46.404664040 CET | 80 | 49873 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:46.404794931 CET | 49873 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:46.521770000 CET | 49873 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:46.522124052 CET | 49878 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:46.641990900 CET | 80 | 49878 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:46.642059088 CET | 49878 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:46.642117977 CET | 80 | 49873 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:46.642191887 CET | 49873 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:46.642376900 CET | 49878 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:46.762418032 CET | 80 | 49878 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:48.037117958 CET | 80 | 49878 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:48.037209988 CET | 49878 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:48.154921055 CET | 49878 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:48.155200958 CET | 49883 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:48.275046110 CET | 80 | 49878 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:48.275084019 CET | 80 | 49883 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:48.275151014 CET | 49878 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:48.275219917 CET | 49883 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:48.275427103 CET | 49883 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:48.396260977 CET | 80 | 49883 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:49.693346024 CET | 80 | 49883 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:49.693432093 CET | 49883 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:49.811206102 CET | 49883 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:49.811477900 CET | 49888 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:49.931391954 CET | 80 | 49888 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:49.931528091 CET | 80 | 49883 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:49.931550980 CET | 49888 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:49.931586027 CET | 49883 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:49.931793928 CET | 49888 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:50.051645994 CET | 80 | 49888 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:51.306162119 CET | 80 | 49888 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:51.306229115 CET | 49888 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:51.473712921 CET | 49888 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:51.477802038 CET | 49891 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:51.594193935 CET | 80 | 49888 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:51.594249964 CET | 49888 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:51.597675085 CET | 80 | 49891 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:51.597743034 CET | 49891 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:51.609775066 CET | 49891 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:51.729650021 CET | 80 | 49891 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:53.020618916 CET | 80 | 49891 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:53.021656036 CET | 49891 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:53.139545918 CET | 49891 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:53.139858007 CET | 49896 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:53.259752035 CET | 80 | 49891 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:53.259766102 CET | 80 | 49896 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:53.259852886 CET | 49891 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:53.259881973 CET | 49896 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:53.260059118 CET | 49896 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:53.379936934 CET | 80 | 49896 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:54.635322094 CET | 80 | 49896 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:54.635452986 CET | 49896 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:54.751071930 CET | 49896 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:54.756572962 CET | 49901 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:54.871299028 CET | 80 | 49896 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:54.871359110 CET | 49896 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:54.876502991 CET | 80 | 49901 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:54.876574039 CET | 49901 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:54.876821995 CET | 49901 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:54.996762991 CET | 80 | 49901 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:56.331507921 CET | 80 | 49901 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:56.331578016 CET | 49901 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:56.455981016 CET | 49901 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:56.456423998 CET | 49905 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:56.576117039 CET | 80 | 49901 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:56.576191902 CET | 49901 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:56.576307058 CET | 80 | 49905 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:56.576379061 CET | 49905 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:56.577852964 CET | 49905 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:56.697689056 CET | 80 | 49905 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:57.905153990 CET | 80 | 49905 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:57.905242920 CET | 49905 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:58.016191959 CET | 49905 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:58.016494989 CET | 49910 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:58.136452913 CET | 80 | 49905 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:58.136466026 CET | 80 | 49910 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:58.136523962 CET | 49905 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:58.136563063 CET | 49910 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:58.136842012 CET | 49910 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:58.256668091 CET | 80 | 49910 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:59.511039972 CET | 80 | 49910 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:59.511137009 CET | 49910 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:59.628184080 CET | 49910 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:59.628520012 CET | 49915 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:59.748548985 CET | 80 | 49910 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:59.748567104 CET | 80 | 49915 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:34:59.748604059 CET | 49910 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:59.748658895 CET | 49915 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:59.749279976 CET | 49915 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:34:59.869153976 CET | 80 | 49915 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:35:01.180387020 CET | 80 | 49915 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:35:01.180444956 CET | 49915 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:35:01.307809114 CET | 49915 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:35:01.308211088 CET | 49920 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:35:01.427999973 CET | 80 | 49915 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:35:01.428054094 CET | 49915 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:35:01.428080082 CET | 80 | 49920 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:35:01.428174973 CET | 49920 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:35:01.428373098 CET | 49920 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:35:01.548226118 CET | 80 | 49920 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:35:02.800364017 CET | 80 | 49920 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:35:02.800432920 CET | 49920 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:35:02.924017906 CET | 49920 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:35:02.924439907 CET | 49923 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:35:03.044697046 CET | 80 | 49920 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:35:03.044711113 CET | 80 | 49923 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:35:03.044766903 CET | 49920 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:35:03.044810057 CET | 49923 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:35:03.045042992 CET | 49923 | 80 | 192.168.2.4 | 185.208.158.202 |
| Nov 30, 2024 02:35:03.164876938 CET | 80 | 49923 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:35:04.463563919 CET | 80 | 49923 | 185.208.158.202 | 192.168.2.4 |
| Nov 30, 2024 02:35:04.465735912 CET | 49923 | 80 | 192.168.2.4 | 185.208.158.202 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Nov 30, 2024 02:33:51.737341881 CET | 51052 | 53 | 192.168.2.4 | 141.98.234.31 |
| Nov 30, 2024 02:33:52.050406933 CET | 53 | 51052 | 141.98.234.31 | 192.168.2.4 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Nov 30, 2024 02:33:51.737341881 CET | 192.168.2.4 | 141.98.234.31 | 0xbdc9 | Standard query (0) | A (IP address) | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Nov 30, 2024 02:33:52.050406933 CET | 141.98.234.31 | 192.168.2.4 | 0xbdc9 | No error (0) | 185.208.158.202 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.4 | 49736 | 185.208.158.202 | 80 | 3320 | C:\Users\user\AppData\Local\XLGear 3.1.3.157\xlgear32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 30, 2024 02:33:52.217340946 CET | 317 | OUT | |
| Nov 30, 2024 02:33:53.594434977 CET | 220 | IN | |
| Nov 30, 2024 02:33:53.701723099 CET | 317 | OUT | |
| Nov 30, 2024 02:33:54.179733038 CET | 1084 | IN | |
| Nov 30, 2024 02:33:57.749596119 CET | 325 | OUT | |
| Nov 30, 2024 02:33:58.262341976 CET | 220 | IN | |
| Nov 30, 2024 02:33:58.375155926 CET | 325 | OUT | |
| Nov 30, 2024 02:33:58.844825029 CET | 940 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.4 | 49746 | 185.208.158.202 | 80 | 3320 | C:\Users\user\AppData\Local\XLGear 3.1.3.157\xlgear32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 30, 2024 02:33:59.198496103 CET | 325 | OUT | |
| Nov 30, 2024 02:34:00.572812080 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 2 | 192.168.2.4 | 49752 | 185.208.158.202 | 80 | 3320 | C:\Users\user\AppData\Local\XLGear 3.1.3.157\xlgear32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 30, 2024 02:34:00.806781054 CET | 325 | OUT | |
| Nov 30, 2024 02:34:02.227019072 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 3 | 192.168.2.4 | 49758 | 185.208.158.202 | 80 | 3320 | C:\Users\user\AppData\Local\XLGear 3.1.3.157\xlgear32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 30, 2024 02:34:02.467372894 CET | 325 | OUT | |
| Nov 30, 2024 02:34:03.916752100 CET | 220 | IN | |
| Nov 30, 2024 02:34:04.031367064 CET | 325 | OUT | |
| Nov 30, 2024 02:34:04.493899107 CET | 220 | IN | |
| Nov 30, 2024 02:34:04.608022928 CET | 325 | OUT | |
| Nov 30, 2024 02:34:05.065917969 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 4 | 192.168.2.4 | 49764 | 185.208.158.202 | 80 | 3320 | C:\Users\user\AppData\Local\XLGear 3.1.3.157\xlgear32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 30, 2024 02:34:05.415508986 CET | 325 | OUT | |
| Nov 30, 2024 02:34:06.739707947 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 5 | 192.168.2.4 | 49770 | 185.208.158.202 | 80 | 3320 | C:\Users\user\AppData\Local\XLGear 3.1.3.157\xlgear32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 30, 2024 02:34:06.978771925 CET | 325 | OUT | |
| Nov 30, 2024 02:34:08.320300102 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 6 | 192.168.2.4 | 49771 | 185.208.158.202 | 80 | 3320 | C:\Users\user\AppData\Local\XLGear 3.1.3.157\xlgear32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 30, 2024 02:34:08.556945086 CET | 325 | OUT | |
| Nov 30, 2024 02:34:09.935836077 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 7 | 192.168.2.4 | 49777 | 185.208.158.202 | 80 | 3320 | C:\Users\user\AppData\Local\XLGear 3.1.3.157\xlgear32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 30, 2024 02:34:10.182204008 CET | 325 | OUT | |
| Nov 30, 2024 02:34:11.556437969 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 8 | 192.168.2.4 | 49783 | 185.208.158.202 | 80 | 3320 | C:\Users\user\AppData\Local\XLGear 3.1.3.157\xlgear32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 30, 2024 02:34:11.791414022 CET | 325 | OUT | |
| Nov 30, 2024 02:34:13.226771116 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 9 | 192.168.2.4 | 49788 | 185.208.158.202 | 80 | 3320 | C:\Users\user\AppData\Local\XLGear 3.1.3.157\xlgear32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 30, 2024 02:34:13.462992907 CET | 325 | OUT | |
| Nov 30, 2024 02:34:14.944133997 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 10 | 192.168.2.4 | 49790 | 185.208.158.202 | 80 | 3320 | C:\Users\user\AppData\Local\XLGear 3.1.3.157\xlgear32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 30, 2024 02:34:15.181719065 CET | 325 | OUT | |
| Nov 30, 2024 02:34:16.553778887 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 11 | 192.168.2.4 | 49795 | 185.208.158.202 | 80 | 3320 | C:\Users\user\AppData\Local\XLGear 3.1.3.157\xlgear32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 30, 2024 02:34:16.791323900 CET | 325 | OUT | |
| Nov 30, 2024 02:34:18.165915012 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 12 | 192.168.2.4 | 49800 | 185.208.158.202 | 80 | 3320 | C:\Users\user\AppData\Local\XLGear 3.1.3.157\xlgear32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 30, 2024 02:34:18.401058912 CET | 325 | OUT | |
| Nov 30, 2024 02:34:19.841476917 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 13 | 192.168.2.4 | 49803 | 185.208.158.202 | 80 | 3320 | C:\Users\user\AppData\Local\XLGear 3.1.3.157\xlgear32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 30, 2024 02:34:20.089040995 CET | 325 | OUT | |
| Nov 30, 2024 02:34:21.511260986 CET | 220 | IN | |
| Nov 30, 2024 02:34:21.624417067 CET | 325 | OUT | |
| Nov 30, 2024 02:34:22.101311922 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 14 | 192.168.2.4 | 49809 | 185.208.158.202 | 80 | 3320 | C:\Users\user\AppData\Local\XLGear 3.1.3.157\xlgear32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 30, 2024 02:34:22.510927916 CET | 325 | OUT | |
| Nov 30, 2024 02:34:23.884879112 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 15 | 192.168.2.4 | 49814 | 185.208.158.202 | 80 | 3320 | C:\Users\user\AppData\Local\XLGear 3.1.3.157\xlgear32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 30, 2024 02:34:24.176803112 CET | 325 | OUT | |
| Nov 30, 2024 02:34:25.556432009 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 16 | 192.168.2.4 | 49820 | 185.208.158.202 | 80 | 3320 | C:\Users\user\AppData\Local\XLGear 3.1.3.157\xlgear32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 30, 2024 02:34:25.791766882 CET | 325 | OUT | |
| Nov 30, 2024 02:34:27.189121008 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 17 | 192.168.2.4 | 49825 | 185.208.158.202 | 80 | 3320 | C:\Users\user\AppData\Local\XLGear 3.1.3.157\xlgear32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 30, 2024 02:34:27.432925940 CET | 325 | OUT | |
| Nov 30, 2024 02:34:28.850276947 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 18 | 192.168.2.4 | 49828 | 185.208.158.202 | 80 | 3320 | C:\Users\user\AppData\Local\XLGear 3.1.3.157\xlgear32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 30, 2024 02:34:29.087987900 CET | 325 | OUT | |
| Nov 30, 2024 02:34:30.470597982 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 19 | 192.168.2.4 | 49833 | 185.208.158.202 | 80 | 3320 | C:\Users\user\AppData\Local\XLGear 3.1.3.157\xlgear32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 30, 2024 02:34:30.713514090 CET | 325 | OUT | |
| Nov 30, 2024 02:34:32.109592915 CET | 220 | IN | |
| Nov 30, 2024 02:34:32.217515945 CET | 325 | OUT | |
| Nov 30, 2024 02:34:32.691086054 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 20 | 192.168.2.4 | 49839 | 185.208.158.202 | 80 | 3320 | C:\Users\user\AppData\Local\XLGear 3.1.3.157\xlgear32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 30, 2024 02:34:32.932424068 CET | 325 | OUT | |
| Nov 30, 2024 02:34:34.309799910 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 21 | 192.168.2.4 | 49844 | 185.208.158.202 | 80 | 3320 | C:\Users\user\AppData\Local\XLGear 3.1.3.157\xlgear32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 30, 2024 02:34:34.631422043 CET | 325 | OUT | |
| Nov 30, 2024 02:34:35.942440033 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 22 | 192.168.2.4 | 49849 | 185.208.158.202 | 80 | 3320 | C:\Users\user\AppData\Local\XLGear 3.1.3.157\xlgear32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 30, 2024 02:34:36.181797981 CET | 325 | OUT | |
| Nov 30, 2024 02:34:37.661833048 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 23 | 192.168.2.4 | 49853 | 185.208.158.202 | 80 | 3320 | C:\Users\user\AppData\Local\XLGear 3.1.3.157\xlgear32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 30, 2024 02:34:37.905771017 CET | 325 | OUT | |
| Nov 30, 2024 02:34:39.304721117 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 24 | 192.168.2.4 | 49858 | 185.208.158.202 | 80 | 3320 | C:\Users\user\AppData\Local\XLGear 3.1.3.157\xlgear32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 30, 2024 02:34:39.541003942 CET | 325 | OUT | |
| Nov 30, 2024 02:34:40.919466972 CET | 220 | IN | |
| Nov 30, 2024 02:34:41.030101061 CET | 325 | OUT | |
| Nov 30, 2024 02:34:41.502412081 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 25 | 192.168.2.4 | 49864 | 185.208.158.202 | 80 | 3320 | C:\Users\user\AppData\Local\XLGear 3.1.3.157\xlgear32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 30, 2024 02:34:41.744410038 CET | 325 | OUT | |
| Nov 30, 2024 02:34:43.116338015 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 26 | 192.168.2.4 | 49869 | 185.208.158.202 | 80 | 3320 | C:\Users\user\AppData\Local\XLGear 3.1.3.157\xlgear32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 30, 2024 02:34:43.353902102 CET | 325 | OUT | |
| Nov 30, 2024 02:34:44.735771894 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 27 | 192.168.2.4 | 49873 | 185.208.158.202 | 80 | 3320 | C:\Users\user\AppData\Local\XLGear 3.1.3.157\xlgear32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 30, 2024 02:34:44.962877989 CET | 325 | OUT | |
| Nov 30, 2024 02:34:46.404664040 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 28 | 192.168.2.4 | 49878 | 185.208.158.202 | 80 | 3320 | C:\Users\user\AppData\Local\XLGear 3.1.3.157\xlgear32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 30, 2024 02:34:46.642376900 CET | 325 | OUT | |
| Nov 30, 2024 02:34:48.037117958 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 29 | 192.168.2.4 | 49883 | 185.208.158.202 | 80 | 3320 | C:\Users\user\AppData\Local\XLGear 3.1.3.157\xlgear32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 30, 2024 02:34:48.275427103 CET | 325 | OUT | |
| Nov 30, 2024 02:34:49.693346024 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 30 | 192.168.2.4 | 49888 | 185.208.158.202 | 80 | 3320 | C:\Users\user\AppData\Local\XLGear 3.1.3.157\xlgear32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 30, 2024 02:34:49.931793928 CET | 325 | OUT | |
| Nov 30, 2024 02:34:51.306162119 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 31 | 192.168.2.4 | 49891 | 185.208.158.202 | 80 | 3320 | C:\Users\user\AppData\Local\XLGear 3.1.3.157\xlgear32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 30, 2024 02:34:51.609775066 CET | 325 | OUT | |
| Nov 30, 2024 02:34:53.020618916 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 32 | 192.168.2.4 | 49896 | 185.208.158.202 | 80 | 3320 | C:\Users\user\AppData\Local\XLGear 3.1.3.157\xlgear32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 30, 2024 02:34:53.260059118 CET | 325 | OUT | |
| Nov 30, 2024 02:34:54.635322094 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 33 | 192.168.2.4 | 49901 | 185.208.158.202 | 80 | 3320 | C:\Users\user\AppData\Local\XLGear 3.1.3.157\xlgear32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 30, 2024 02:34:54.876821995 CET | 325 | OUT | |
| Nov 30, 2024 02:34:56.331507921 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 34 | 192.168.2.4 | 49905 | 185.208.158.202 | 80 | 3320 | C:\Users\user\AppData\Local\XLGear 3.1.3.157\xlgear32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 30, 2024 02:34:56.577852964 CET | 325 | OUT | |
| Nov 30, 2024 02:34:57.905153990 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 35 | 192.168.2.4 | 49910 | 185.208.158.202 | 80 | 3320 | C:\Users\user\AppData\Local\XLGear 3.1.3.157\xlgear32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 30, 2024 02:34:58.136842012 CET | 325 | OUT | |
| Nov 30, 2024 02:34:59.511039972 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 36 | 192.168.2.4 | 49915 | 185.208.158.202 | 80 | 3320 | C:\Users\user\AppData\Local\XLGear 3.1.3.157\xlgear32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 30, 2024 02:34:59.749279976 CET | 325 | OUT | |
| Nov 30, 2024 02:35:01.180387020 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 37 | 192.168.2.4 | 49920 | 185.208.158.202 | 80 | 3320 | C:\Users\user\AppData\Local\XLGear 3.1.3.157\xlgear32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 30, 2024 02:35:01.428373098 CET | 325 | OUT | |
| Nov 30, 2024 02:35:02.800364017 CET | 220 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 38 | 192.168.2.4 | 49923 | 185.208.158.202 | 80 | 3320 | C:\Users\user\AppData\Local\XLGear 3.1.3.157\xlgear32.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 30, 2024 02:35:03.045042992 CET | 325 | OUT | |
| Nov 30, 2024 02:35:04.463563919 CET | 220 | IN |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
| Target ID: | 0 |
| Start time: | 20:32:55 |
| Start date: | 29/11/2024 |
| Path: | C:\Users\user\Desktop\getlab.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x400000 |
| File size: | 3'599'599 bytes |
| MD5 hash: | 15BD54ED3324A464C1DEB1A883E7649E |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | low |
| Has exited: | false |
| Target ID: | 1 |
| Start time: | 20:32:55 |
| Start date: | 29/11/2024 |
| Path: | C:\Users\user\AppData\Local\Temp\is-BKGL7.tmp\getlab.tmp |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x400000 |
| File size: | 704'000 bytes |
| MD5 hash: | A0CFF52B882184452424B6E618FA061B |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Reputation: | low |
| Has exited: | false |
| Target ID: | 2 |
| Start time: | 20:32:56 |
| Start date: | 29/11/2024 |
| Path: | C:\Windows\SysWOW64\net.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0xbb0000 |
| File size: | 47'104 bytes |
| MD5 hash: | 31890A7DE89936F922D44D677F681A7F |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 3 |
| Start time: | 20:32:56 |
| Start date: | 29/11/2024 |
| Path: | C:\Windows\System32\conhost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff7699e0000 |
| File size: | 862'208 bytes |
| MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 4 |
| Start time: | 20:32:57 |
| Start date: | 29/11/2024 |
| Path: | C:\Users\user\AppData\Local\XLGear 3.1.3.157\xlgear32.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x400000 |
| File size: | 3'397'185 bytes |
| MD5 hash: | 9DC53D054BB2482253850DA5D8DFF405 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Antivirus matches: |
|
| Reputation: | low |
| Has exited: | false |
| Target ID: | 5 |
| Start time: | 20:32:57 |
| Start date: | 29/11/2024 |
| Path: | C:\Windows\SysWOW64\net1.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0xd70000 |
| File size: | 139'776 bytes |
| MD5 hash: | 2EFE6ED4C294AB8A39EB59C80813FEC1 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
Execution Graph
| Execution Coverage: | 21.2% |
| Dynamic/Decrypted Code Coverage: | 0% |
| Signature Coverage: | 2.4% |
| Total number of Nodes: | 1498 |
| Total number of Limit Nodes: | 22 |
Graph
Function 00409B30 Relevance: 7.6, APIs: 5, Instructions: 78memoryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004051FC Relevance: 1.5, APIs: 1, Instructions: 29COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040457C Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 27libraryloaderCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004090A4 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 46libraryloaderCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004099A4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 77processCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00409E47 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 117windowCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00409E62 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113windowCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00407749 Relevance: 3.3, APIs: 2, Instructions: 284fileCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00406FA0 Relevance: 3.0, APIs: 2, Instructions: 33libraryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040766C Relevance: 3.0, APIs: 2, Instructions: 30COMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040762C Relevance: 3.0, APIs: 2, Instructions: 30fileCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004075C4 Relevance: 3.0, APIs: 2, Instructions: 24COMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401430 Relevance: 2.5, APIs: 2, Instructions: 37memoryCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405270 Relevance: 1.6, APIs: 1, Instructions: 99COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00407576 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00407578 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004069DC Relevance: 1.5, APIs: 1, Instructions: 29COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004076C8 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00407284 Relevance: 1.5, APIs: 1, Instructions: 28windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004076AC Relevance: 1.5, APIs: 1, Instructions: 11fileCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00406FFB Relevance: 1.5, APIs: 1, Instructions: 10COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00407017 Relevance: 1.5, APIs: 1, Instructions: 5COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00406970 Relevance: 1.5, APIs: 1, Instructions: 4COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00407F10 Relevance: 1.3, APIs: 1, Instructions: 62memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401658 Relevance: 1.3, APIs: 1, Instructions: 48COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00407548 Relevance: 1.3, APIs: 1, Instructions: 20COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00407EB8 Relevance: 1.3, APIs: 1, Instructions: 15COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00409448 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 41shutdownCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00409BEC Relevance: 6.0, APIs: 4, Instructions: 31COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405248 Relevance: 1.5, APIs: 1, Instructions: 23COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004026C4 Relevance: 1.5, APIs: 1, Instructions: 20timeCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405CE4 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040840C Relevance: .5, Instructions: 545COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00407024 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 86registrylibraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00403A97 Relevance: 15.1, APIs: 10, Instructions: 122fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004019DC Relevance: 9.1, APIs: 6, Instructions: 59COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00403D02 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 72windowCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004036B8 Relevance: 7.6, APIs: 5, Instructions: 55memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401918 Relevance: 6.0, APIs: 4, Instructions: 48memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00406E10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 113registryCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004094D8 Relevance: 5.0, APIs: 4, Instructions: 45sleepCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Execution Graph
| Execution Coverage: | 16% |
| Dynamic/Decrypted Code Coverage: | 0% |
| Signature Coverage: | 4.5% |
| Total number of Nodes: | 2000 |
| Total number of Limit Nodes: | 69 |
Graph
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0042E094 Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 178memorylibraryloaderCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00450294 Relevance: 26.3, APIs: 8, Strings: 7, Instructions: 45libraryloaderCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00423C04 Relevance: 21.4, APIs: 14, Instructions: 395COMMON
Download Yara Rule
Control-flow Graph
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004671CC Relevance: 13.9, APIs: 4, Strings: 3, Instructions: 1649windowCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00452A34 Relevance: 3.0, APIs: 2, Instructions: 45fileCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0046DF04 Relevance: 3.0, APIs: 2, Instructions: 28comCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00408558 Relevance: 1.5, APIs: 1, Instructions: 29COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00423B7C Relevance: 1.5, APIs: 1, Instructions: 24nativeCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00455570 Relevance: 1.5, APIs: 1, Instructions: 20COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0042F518 Relevance: 1.5, APIs: 1, Instructions: 17nativeCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0046EE78 Relevance: 72.2, APIs: 1, Strings: 40, Instructions: 500registryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00491D44 Relevance: 56.4, APIs: 16, Strings: 16, Instructions: 431sleepCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00483038 Relevance: 26.3, APIs: 9, Strings: 6, Instructions: 68libraryloaderCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00468BB0 Relevance: 24.7, APIs: 1, Strings: 13, Instructions: 155registryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0042386C Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 98windowregistryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0047C65C Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 95libraryloaderCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040631C Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 27libraryloaderCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0042F558 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 90windowregistryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004531C4 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 46libraryloaderCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00466FA8 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 141windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00430938 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 23registryclipboardthreadCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00423684 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 96windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00418F30 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55threadCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00413634 Relevance: 9.1, APIs: 6, Instructions: 60COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00471F5C Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 263fileCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004556AC Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 142registryCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0042DE3C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 32registrylibraryloaderCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00454DA8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 102libraryloaderCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0042ED30 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 55libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004559E4 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 41registryCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0047F340 Relevance: 6.1, APIs: 4, Instructions: 147fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0042126C Relevance: 6.1, APIs: 4, Instructions: 127windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00416B3A Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00454F50 Relevance: 6.1, APIs: 4, Instructions: 54COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004230C0 Relevance: 6.1, APIs: 4, Instructions: 54COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0042DBF8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 113registryCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0047BE88 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36registryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0046EC64 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34registryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00456ED4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 11libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0046CC10 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 8libraryloaderCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00481240 Relevance: 4.6, APIs: 3, Instructions: 98windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004524E4 Relevance: 4.6, APIs: 3, Instructions: 75COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0044B384 Relevance: 4.6, APIs: 3, Instructions: 74COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0044B0B8 Relevance: 4.6, APIs: 3, Instructions: 72COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004243F4 Relevance: 4.6, APIs: 3, Instructions: 59windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0041663C Relevance: 4.5, APIs: 3, Instructions: 39COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0041EE4C Relevance: 4.5, APIs: 3, Instructions: 27windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0047BDA4 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39registryCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0046ECD4 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24registryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0042DE14 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 18registryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0047DABC Relevance: 3.2, APIs: 2, Instructions: 160windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00494F90 Relevance: 3.1, APIs: 2, Instructions: 65COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004527BC Relevance: 3.1, APIs: 2, Instructions: 60processCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040AFC0 Relevance: 3.1, APIs: 2, Instructions: 51COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0041EE9C Relevance: 3.0, APIs: 2, Instructions: 49threadCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00452C54 Relevance: 3.0, APIs: 2, Instructions: 48fileCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00452744 Relevance: 3.0, APIs: 2, Instructions: 43COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00423234 Relevance: 3.0, APIs: 2, Instructions: 35COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0042E38C Relevance: 3.0, APIs: 2, Instructions: 33libraryCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004162C2 Relevance: 3.0, APIs: 2, Instructions: 27COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004508CC Relevance: 3.0, APIs: 2, Instructions: 22COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040625C Relevance: 3.0, APIs: 2, Instructions: 6memoryCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004014E4 Relevance: 2.5, APIs: 2, Instructions: 37memoryCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004085CC Relevance: 1.6, APIs: 1, Instructions: 99COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0041FB94 Relevance: 1.6, APIs: 1, Instructions: 65COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0046C270 Relevance: 1.5, APIs: 1, Instructions: 37COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0044138C Relevance: 1.5, APIs: 1, Instructions: 36fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00416548 Relevance: 1.5, APIs: 1, Instructions: 32COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004149AC Relevance: 1.5, APIs: 1, Instructions: 31COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00450798 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0042CCC4 Relevance: 1.5, APIs: 1, Instructions: 29COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0042E8C0 Relevance: 1.5, APIs: 1, Instructions: 28windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004062E8 Relevance: 1.5, APIs: 1, Instructions: 27COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00454BCC Relevance: 1.5, APIs: 1, Instructions: 25COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00414674 Relevance: 1.5, APIs: 1, Instructions: 23COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00406F00 Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00423644 Relevance: 1.5, APIs: 1, Instructions: 22COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004242BC Relevance: 1.5, APIs: 1, Instructions: 21COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00466968 Relevance: 1.5, APIs: 1, Instructions: 16COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0042CD1C Relevance: 1.5, APIs: 1, Instructions: 16COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00406EB0 Relevance: 1.5, APIs: 1, Instructions: 14fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00450900 Relevance: 1.5, APIs: 1, Instructions: 11fileCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00407298 Relevance: 1.5, APIs: 1, Instructions: 11COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0042E3E7 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004165E4 Relevance: 1.5, APIs: 1, Instructions: 4COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00448720 Relevance: 1.4, APIs: 1, Instructions: 158COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0047D57C Relevance: 1.4, APIs: 1, Instructions: 150COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0041F3BC Relevance: 1.3, APIs: 1, Instructions: 52memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00452F98 Relevance: 1.3, APIs: 1, Instructions: 48COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040170C Relevance: 1.3, APIs: 1, Instructions: 48COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00406F38 Relevance: 1.3, APIs: 1, Instructions: 3COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0041F110 Relevance: 45.6, APIs: 15, Strings: 11, Instructions: 87libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004583E8 Relevance: 40.4, APIs: 11, Strings: 12, Instructions: 186pipeprocessfileCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0041837C Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 58windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004555B8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 41shutdownCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0045CFA8 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 34libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004975B0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 90fileCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004573B4 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 241windownativeCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00455DE0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 112libraryloaderCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00417CC8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76windowCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00463B04 Relevance: 7.6, APIs: 5, Instructions: 129fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00463F80 Relevance: 7.6, APIs: 5, Instructions: 129fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0042E92C Relevance: 7.6, APIs: 5, Instructions: 50fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00482EF8 Relevance: 6.0, APIs: 4, Instructions: 47windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00462578 Relevance: 4.6, APIs: 3, Instructions: 67fileCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004241D4 Relevance: 4.5, APIs: 3, Instructions: 32windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00417CC6 Relevance: 3.0, APIs: 2, Instructions: 49windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00417590 Relevance: 3.0, APIs: 2, Instructions: 44windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0042418C Relevance: 3.0, APIs: 2, Instructions: 22windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004125D0 Relevance: 1.7, APIs: 1, Instructions: 188nativeCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00478554 Relevance: 1.6, APIs: 1, Instructions: 107nativeCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0045D05C Relevance: 1.5, APIs: 1, Instructions: 12COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0045D074 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 10001130 Relevance: .1, Instructions: 55COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 10001000 Relevance: .0, Instructions: 2COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0044B650 Relevance: 166.5, APIs: 48, Strings: 47, Instructions: 252libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004978DC Relevance: 23.0, APIs: 7, Strings: 6, Instructions: 251synchronizationCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0045C9E0 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 182libraryloadermemoryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00456538 Relevance: 21.3, APIs: 4, Strings: 8, Instructions: 282comCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00454848 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 244registryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00459278 Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 165registryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00458864 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 70sleepsynchronizationCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004544FC Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 228registryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0049615C Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 141fileCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0042E410 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 86registrylibraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00462818 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 82libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0042F180 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 82libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00458A3C Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 127pipeCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00456B40 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 99libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404ABF Relevance: 15.1, APIs: 10, Instructions: 122fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00480E18 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 175windowCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0045D0D4 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 41libraryloaderCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0044D170 Relevance: 13.6, APIs: 9, Instructions: 90COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00495A00 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 90sleepsynchronizationthreadCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0047001C Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 89registrywindowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00462C58 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 75windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00477E04 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 66libraryfileloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00429478 Relevance: 12.1, APIs: 8, Instructions: 62COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0041DE1C Relevance: 12.1, APIs: 8, Instructions: 60windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004766E4 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 200windowCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004116EC Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 158windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004570FC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0046B240 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 99sleepCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00477700 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 92windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004595A4 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 86libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0041C140 Relevance: 10.6, APIs: 7, Instructions: 70windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00418C4C Relevance: 10.6, APIs: 7, Instructions: 67COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00483228 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 61registryCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0041B45A Relevance: 10.6, APIs: 7, Instructions: 57windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00494838 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 47libraryloaderCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0045D4A8 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 33libraryloaderCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0042EA14 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 30libraryloaderwindowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0044C7D4 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 28libraryloaderCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004786B4 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 14libraryloaderCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0041B664 Relevance: 9.1, APIs: 6, Instructions: 144windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0041B934 Relevance: 9.1, APIs: 6, Instructions: 142windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0041B500 Relevance: 9.1, APIs: 6, Instructions: 113windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0041BD84 Relevance: 9.1, APIs: 6, Instructions: 71COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0047DDA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0041B268 Relevance: 9.0, APIs: 6, Instructions: 43COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00453890 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 100fileCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0042EAA0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49libraryloaderCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004019CC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 48memoryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0042E9A4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00477628 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderthreadCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00416C24 Relevance: 7.6, APIs: 5, Instructions: 104COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004147F8 Relevance: 7.6, APIs: 5, Instructions: 102COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004297C4 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0041BBB0 Relevance: 7.6, APIs: 5, Instructions: 83COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00403CA4 Relevance: 7.6, APIs: 5, Instructions: 55memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004143D8 Relevance: 7.6, APIs: 5, Instructions: 51COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00406F94 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 156shareCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00416408 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89registryCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404D2A Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72windowCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00456A1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65registryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00456F74 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60windowCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00478180 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55windowkeyboardCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00459184 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39registryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00483180 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39registryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0042D8E8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 27libraryloaderCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0042EB4C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 23libraryloaderCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0044F73C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00497E74 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0046441C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 8libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0047CE60 Relevance: 6.2, APIs: 4, Instructions: 195fileCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00413CF0 Relevance: 6.1, APIs: 4, Instructions: 107COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00408A44 Relevance: 6.1, APIs: 4, Instructions: 95windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0044E8BC Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00494E30 Relevance: 6.1, APIs: 4, Instructions: 81COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00417210 Relevance: 6.1, APIs: 4, Instructions: 72COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00494AE8 Relevance: 6.1, APIs: 4, Instructions: 59COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040D1F8 Relevance: 6.1, APIs: 4, Instructions: 51COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401548 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 45memoryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0047C52C Relevance: 6.0, APIs: 4, Instructions: 35sleepCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00477C98 Relevance: 6.0, APIs: 4, Instructions: 31COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00424238 Relevance: 6.0, APIs: 4, Instructions: 26windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040626C Relevance: 6.0, APIs: 4, Instructions: 11memoryCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00479BDC Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 210registryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0047892C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 86registryCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0045013C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 78windowCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004958AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59processCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0042DD5C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56registryCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00455648 Relevance: 5.0, APIs: 4, Instructions: 45sleepCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Execution Graph
| Execution Coverage: | 2.7% |
| Dynamic/Decrypted Code Coverage: | 83.8% |
| Signature Coverage: | 13.9% |
| Total number of Nodes: | 1041 |
| Total number of Limit Nodes: | 38 |
Graph
Function 02D972AB Relevance: 74.2, APIs: 29, Strings: 13, Instructions: 659networksleepfileCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D9648B Relevance: 70.2, APIs: 34, Strings: 6, Instructions: 228memorysleeplibraryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00401B4B Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 74libraryloaderCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02D9F9A7 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 87libraryloaderCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D9F8A3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 100fileCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Control-flow Graph
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02D91CF8 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 105synchronizationCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D94D86 Relevance: 16.8, APIs: 11, Instructions: 256COMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02D926DB Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 92timeCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D92B95 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 132networkCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D929EE Relevance: 7.6, APIs: 5, Instructions: 79networkCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D91BA7 Relevance: 7.6, APIs: 5, Instructions: 75COMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00403310 Relevance: 6.1, APIs: 4, Instructions: 75COMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02D92EDD Relevance: 6.0, APIs: 4, Instructions: 49networkCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D92DB5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100networkCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D92AC7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72networkCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D9353E Relevance: 4.6, APIs: 3, Instructions: 127COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D9369A Relevance: 4.6, APIs: 3, Instructions: 60COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02DA20F0 Relevance: 4.5, APIs: 3, Instructions: 42threadCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02D91AA9 Relevance: 4.5, APIs: 3, Instructions: 18networkCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02D94BED Relevance: 3.1, APIs: 2, Instructions: 137COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02D92D39 Relevance: 3.0, APIs: 2, Instructions: 50networkCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00402694 Relevance: 3.0, APIs: 2, Instructions: 41fileCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02D983EA Relevance: 3.0, APIs: 2, Instructions: 32networkCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00404454 Relevance: 3.0, APIs: 2, Instructions: 30memoryCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02DCFE33 Relevance: 1.7, APIs: 1, Instructions: 200fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02D95119 Relevance: 1.7, APIs: 1, Instructions: 196COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02DDA6EA Relevance: 1.6, APIs: 1, Instructions: 126fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02DCFD3B Relevance: 1.6, APIs: 1, Instructions: 101fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02D9E9C1 Relevance: 1.6, APIs: 1, Instructions: 75COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02DD3769 Relevance: 1.6, APIs: 1, Instructions: 63fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02D933B2 Relevance: 1.6, APIs: 1, Instructions: 50COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02DE5E00 Relevance: 1.6, APIs: 1, Instructions: 50fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00402BFD Relevance: 1.5, APIs: 1, Instructions: 36COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02D9E551 Relevance: 1.5, APIs: 1, Instructions: 36COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 02DF020B Relevance: 1.5, APIs: 1, Instructions: 30COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02DD36BC Relevance: 1.5, APIs: 1, Instructions: 21fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02D9E330 Relevance: 1.5, APIs: 1, Instructions: 20COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00402CF3 Relevance: 1.5, APIs: 1, Instructions: 7COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004022BC Relevance: 1.5, APIs: 1, Instructions: 7registryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040D39B Relevance: 1.5, APIs: 1, Instructions: 7libraryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00402C93 Relevance: 1.5, APIs: 1, Instructions: 6registryCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00402C74 Relevance: 1.5, APIs: 1, Instructions: 3fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 02DA2160 Relevance: 1.3, APIs: 1, Instructions: 43COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0040D801 Relevance: 1.3, APIs: 1, Instructions: 19stringCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040D556 Relevance: 1.3, APIs: 1, Instructions: 10sleepCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040D00D Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040D320 Relevance: 1.3, APIs: 1, Instructions: 3sleepCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6096748C Relevance: 131.0, APIs: 72, Strings: 2, Instructions: 1504COMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 609687A7 Relevance: 36.3, APIs: 24, Instructions: 282COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6096923E Relevance: 29.3, APIs: 19, Instructions: 779COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6094A6C5 Relevance: 10.6, APIs: 7, Instructions: 144COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6094B407 Relevance: 9.1, APIs: 6, Instructions: 99COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6094B54C Relevance: 7.6, APIs: 5, Instructions: 145COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6093F42E Relevance: 6.4, APIs: 4, Instructions: 416COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6094C64A Relevance: 6.2, APIs: 4, Instructions: 201COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6096A38C Relevance: 6.1, APIs: 4, Instructions: 76COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6096A2BD Relevance: 6.1, APIs: 4, Instructions: 69COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6095F7F7 Relevance: 6.0, APIs: 4, Instructions: 44COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6094B6ED Relevance: 4.5, APIs: 3, Instructions: 34COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6090C1D6 Relevance: 3.0, APIs: 2, Instructions: 39COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 609255D4 Relevance: 1.6, APIs: 1, Instructions: 85COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6092570B Relevance: 1.5, APIs: 1, Instructions: 43COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 609254B1 Relevance: 1.5, APIs: 1, Instructions: 41COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 60925686 Relevance: 1.5, APIs: 1, Instructions: 38COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 60925655 Relevance: 1.5, APIs: 1, Instructions: 20COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 609256E5 Relevance: 1.5, APIs: 1, Instructions: 14COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 609255FF Relevance: .0, Instructions: 16COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6092562A Relevance: .0, Instructions: 16COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6090F435 Relevance: .0, Instructions: 14COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6091A3AA Relevance: 16.7, APIs: 11, Instructions: 175COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6092854D Relevance: 15.4, APIs: 10, Instructions: 432COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 60912453 Relevance: 15.2, APIs: 10, Instructions: 247COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6095F5D9 Relevance: 15.1, APIs: 10, Instructions: 121COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6094078D Relevance: 15.0, APIs: 10, Instructions: 43COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6091C159 Relevance: 14.0, Strings: 11, Instructions: 290COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 609061F1 Relevance: 13.9, Strings: 11, Instructions: 114COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6091B05A Relevance: 12.3, APIs: 8, Instructions: 349COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6096544A Relevance: 12.3, APIs: 8, Instructions: 317COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 609644FC Relevance: 12.2, APIs: 8, Instructions: 204COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 609634F0 Relevance: 10.6, APIs: 7, Instructions: 95COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 609406CF Relevance: 10.5, APIs: 7, Instructions: 40COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 60963637 Relevance: 7.8, APIs: 5, Instructions: 258COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6094B137 Relevance: 7.7, APIs: 5, Instructions: 204COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6093A1DD Relevance: 7.7, APIs: 5, Instructions: 157COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6093A0C5 Relevance: 7.6, APIs: 5, Instructions: 98COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6092535E Relevance: 7.6, APIs: 5, Instructions: 91COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 60961389 Relevance: 7.6, APIs: 5, Instructions: 89COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 60939097 Relevance: 7.6, APIs: 5, Instructions: 76COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6091A2E8 Relevance: 7.6, APIs: 5, Instructions: 70COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 60903571 Relevance: 7.6, APIs: 5, Instructions: 54COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6096D170 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 93memoryCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 60901184 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 23libraryloaderCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 60922538 Relevance: 6.3, APIs: 4, Instructions: 317COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6095B7D1 Relevance: 6.1, APIs: 4, Instructions: 108COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 609292DA Relevance: 6.1, APIs: 4, Instructions: 84COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 60961492 Relevance: 6.1, APIs: 4, Instructions: 82COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6093A57B Relevance: 6.1, APIs: 4, Instructions: 80COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 609034B2 Relevance: 6.1, APIs: 4, Instructions: 57COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6092A43E Relevance: 6.0, APIs: 4, Instructions: 47COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6092A3C4 Relevance: 6.0, APIs: 4, Instructions: 44COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 60969133 Relevance: 6.0, APIs: 4, Instructions: 40COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 609296D1 Relevance: 6.0, APIs: 4, Instructions: 40COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 60961580 Relevance: 6.0, APIs: 4, Instructions: 38COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6092A62C Relevance: 6.0, APIs: 4, Instructions: 38stringCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 609084D1 Relevance: 6.0, APIs: 4, Instructions: 36COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6096D5A0 Relevance: 5.0, APIs: 4, Instructions: 48COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6096D4C0 Relevance: 5.0, APIs: 4, Instructions: 44COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|