Windows
Analysis Report
Bank Swift and SOA PRN0072003410853_pdf.exe
Overview
General Information
Detection
Score: | 100 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Classification
- System is w10x64
- Bank Swift and SOA PRN0072003410853_pdf.exe (PID: 1268 cmdline:
"C:\Users\ user\Deskt op\Bank Sw ift and SO A PRN00720 03410853_p df.exe" MD5: 09B9BEEBDA4769C102CB42A564EF2001) - Bank Swift and SOA PRN0072003410853_pdf.exe (PID: 1292 cmdline:
"C:\Users\ user\Deskt op\Bank Sw ift and SO A PRN00720 03410853_p df.exe" MD5: 09B9BEEBDA4769C102CB42A564EF2001)
- cleanup
Name | Description | Attribution | Blogpost URLs | Link |
---|---|---|---|---|
CloudEyE, GuLoader | CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored. | No Attribution |
{"C2 url": "https://api.telegram.org/bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendMessage"}
{"EXfil Mode": "Telegram", "Telegram Token": "7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU", "Telegram Chatid": "7382809095"}
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_MassLogger | Yara detected MassLogger RAT | Joe Security | ||
JoeSecurity_CredentialStealer | Yara detected Credential Stealer | Joe Security | ||
JoeSecurity_TelegramRAT | Yara detected Telegram RAT | Joe Security | ||
JoeSecurity_GuLoader_2 | Yara detected GuLoader | Joe Security | ||
JoeSecurity_GuLoader_2 | Yara detected GuLoader | Joe Security | ||
Click to see the 3 entries |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-12-03T10:08:13.063510+0100 | 2057744 | 1 | Malware Command and Control Activity Detected | 192.168.2.5 | 49831 | 149.154.167.220 | 443 | TCP |
2024-12-03T10:08:16.572544+0100 | 2057744 | 1 | Malware Command and Control Activity Detected | 192.168.2.5 | 49842 | 149.154.167.220 | 443 | TCP |
2024-12-03T10:08:20.685027+0100 | 2057744 | 1 | Malware Command and Control Activity Detected | 192.168.2.5 | 49851 | 149.154.167.220 | 443 | TCP |
2024-12-03T10:08:24.934366+0100 | 2057744 | 1 | Malware Command and Control Activity Detected | 192.168.2.5 | 49864 | 149.154.167.220 | 443 | TCP |
2024-12-03T10:08:29.088266+0100 | 2057744 | 1 | Malware Command and Control Activity Detected | 192.168.2.5 | 49874 | 149.154.167.220 | 443 | TCP |
2024-12-03T10:08:32.581714+0100 | 2057744 | 1 | Malware Command and Control Activity Detected | 192.168.2.5 | 49885 | 149.154.167.220 | 443 | TCP |
2024-12-03T10:08:35.925133+0100 | 2057744 | 1 | Malware Command and Control Activity Detected | 192.168.2.5 | 49894 | 149.154.167.220 | 443 | TCP |
2024-12-03T10:08:39.356327+0100 | 2057744 | 1 | Malware Command and Control Activity Detected | 192.168.2.5 | 49903 | 149.154.167.220 | 443 | TCP |
2024-12-03T10:08:42.748741+0100 | 2057744 | 1 | Malware Command and Control Activity Detected | 192.168.2.5 | 49913 | 149.154.167.220 | 443 | TCP |
2024-12-03T10:08:46.059309+0100 | 2057744 | 1 | Malware Command and Control Activity Detected | 192.168.2.5 | 49922 | 149.154.167.220 | 443 | TCP |
2024-12-03T10:08:49.558654+0100 | 2057744 | 1 | Malware Command and Control Activity Detected | 192.168.2.5 | 49933 | 149.154.167.220 | 443 | TCP |
2024-12-03T10:08:53.121035+0100 | 2057744 | 1 | Malware Command and Control Activity Detected | 192.168.2.5 | 49942 | 149.154.167.220 | 443 | TCP |
2024-12-03T10:08:56.452479+0100 | 2057744 | 1 | Malware Command and Control Activity Detected | 192.168.2.5 | 49951 | 149.154.167.220 | 443 | TCP |
2024-12-03T10:08:59.770297+0100 | 2057744 | 1 | Malware Command and Control Activity Detected | 192.168.2.5 | 49961 | 149.154.167.220 | 443 | TCP |
2024-12-03T10:09:04.369183+0100 | 2057744 | 1 | Malware Command and Control Activity Detected | 192.168.2.5 | 49970 | 149.154.167.220 | 443 | TCP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-12-03T10:08:02.353690+0100 | 2803274 | 2 | Potentially Bad Traffic | 192.168.2.5 | 49807 | 193.122.130.0 | 80 | TCP |
2024-12-03T10:08:10.884946+0100 | 2803274 | 2 | Potentially Bad Traffic | 192.168.2.5 | 49807 | 193.122.130.0 | 80 | TCP |
2024-12-03T10:08:14.588087+0100 | 2803274 | 2 | Potentially Bad Traffic | 192.168.2.5 | 49837 | 193.122.130.0 | 80 | TCP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-12-03T10:07:54.987250+0100 | 2803270 | 2 | Potentially Bad Traffic | 192.168.2.5 | 49785 | 172.217.19.174 | 443 | TCP |
Click to jump to signature section
AV Detection |
---|
Source: | Avira: |
Source: | Malware Configuration Extractor: | ||
Source: | Malware Configuration Extractor: |
Source: | Integrated Neural Analysis Model: |
Location Tracking |
---|
Source: | DNS query: |
Source: | Code function: | 4_2_3787B4C0 | |
Source: | Code function: | 4_2_3787BCB8 |
Source: | Static PE information: |
Source: | HTTPS traffic detected: |
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: |
Source: | Code function: | 0_2_00405772 | |
Source: | Code function: | 0_2_0040622D | |
Source: | Code function: | 0_2_00402770 | |
Source: | Code function: | 4_2_00402770 | |
Source: | Code function: | 4_2_00405772 | |
Source: | Code function: | 4_2_0040622D |
Source: | Code function: | 4_2_000DE6A8 | |
Source: | Code function: | 4_2_000DEC58 | |
Source: | Code function: | 4_2_000DEFAF | |
Source: | Code function: | 4_2_3787F3F8 | |
Source: | Code function: | 4_2_3787A928 | |
Source: | Code function: | 4_2_3787EFA0 | |
Source: | Code function: | 4_2_378797C8 | |
Source: | Code function: | 4_2_3787C1D0 | |
Source: | Code function: | 4_2_3787D330 | |
Source: | Code function: | 4_2_3787EB48 | |
Source: | Code function: | 4_2_37879370 | |
Source: | Code function: | 4_2_3787BD78 | |
Source: | Code function: | 4_2_3787CA80 | |
Source: | Code function: | 4_2_3787A4D0 | |
Source: | Code function: | 4_2_3787CED8 | |
Source: | Code function: | 4_2_3787E6F0 | |
Source: | Code function: | 4_2_37879C20 | |
Source: | Code function: | 4_2_3787C628 | |
Source: | Code function: | 4_2_3787F850 | |
Source: | Code function: | 4_2_3787A078 | |
Source: | Code function: | 4_2_37896130 | |
Source: | Code function: | 4_2_37896130 | |
Source: | Code function: | 4_2_378998D0 | |
Source: | Code function: | 4_2_3789A6C7 | |
Source: | Code function: | 4_2_378946F8 | |
Source: | Code function: | 4_2_37895632 | |
Source: | Code function: | 4_2_37893598 | |
Source: | Code function: | 4_2_378915F8 | |
Source: | Code function: | 4_2_37890498 | |
Source: | Code function: | 4_2_37892300 | |
Source: | Code function: | 4_2_378942A0 | |
Source: | Code function: | 4_2_378911A0 | |
Source: | Code function: | 4_2_37893140 | |
Source: | Code function: | 4_2_37890040 | |
Source: | Code function: | 4_2_37894FA8 | |
Source: | Code function: | 4_2_37891EA8 | |
Source: | Code function: | 4_2_37893E48 | |
Source: | Code function: | 4_2_37890D48 | |
Source: | Code function: | 4_2_37892CE8 | |
Source: | Code function: | 4_2_37894B50 | |
Source: | Code function: | 4_2_37891A50 | |
Source: | Code function: | 4_2_378939F0 | |
Source: | Code function: | 4_2_37892890 | |
Source: | Code function: | 4_2_378908F0 | |
Source: | Code function: | 4_2_388FE628 | |
Source: | Code function: | 4_2_388FF176 | |
Source: | Code function: | 4_2_388FF438 |
Networking |
---|
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: |
Source: | DNS query: |
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: |
Source: | IP Address: | ||
Source: | IP Address: |
Source: | JA3 fingerprint: | ||
Source: | JA3 fingerprint: | ||
Source: | JA3 fingerprint: |
Source: | DNS query: | ||
Source: | DNS query: |
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: |
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: |
Source: | HTTPS traffic detected: |
Source: | UDP traffic detected without corresponding DNS query: | ||
Source: | UDP traffic detected without corresponding DNS query: | ||
Source: | UDP traffic detected without corresponding DNS query: | ||
Source: | UDP traffic detected without corresponding DNS query: | ||
Source: | UDP traffic detected without corresponding DNS query: |
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: |
Source: | DNS traffic detected: | ||
Source: | DNS traffic detected: | ||
Source: | DNS traffic detected: | ||
Source: | DNS traffic detected: | ||
Source: | DNS traffic detected: |
Source: | HTTP traffic detected: |
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: |
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: |
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: |
Source: | Code function: | 0_2_004052D3 |
System Summary |
---|
Source: | Static PE information: |
Source: | Code function: | 0_2_0040335A | |
Source: | Code function: | 4_2_0040335A |
Source: | File created: | Jump to behavior |
Source: | Code function: | 0_2_00404B10 | |
Source: | Code function: | 0_2_0040653F | |
Source: | Code function: | 4_2_00404B10 | |
Source: | Code function: | 4_2_0040653F | |
Source: | Code function: | 4_2_000D60E0 | |
Source: | Code function: | 4_2_000D4328 | |
Source: | Code function: | 4_2_000DE6A8 | |
Source: | Code function: | 4_2_000D8DA0 | |
Source: | Code function: | 4_2_000DE69F | |
Source: | Code function: | 4_2_000D2DD1 | |
Source: | Code function: | 4_2_3787AF80 | |
Source: | Code function: | 4_2_3787F3F8 | |
Source: | Code function: | 4_2_37875B28 | |
Source: | Code function: | 4_2_3787A928 | |
Source: | Code function: | 4_2_37871608 | |
Source: | Code function: | 4_2_37875180 | |
Source: | Code function: | 4_2_3787D788 | |
Source: | Code function: | 4_2_3787EF90 | |
Source: | Code function: | 4_2_3787EFA0 | |
Source: | Code function: | 4_2_378797B9 | |
Source: | Code function: | 4_2_3787C1C0 | |
Source: | Code function: | 4_2_378797C8 | |
Source: | Code function: | 4_2_3787C1D0 | |
Source: | Code function: | 4_2_378715FB | |
Source: | Code function: | 4_2_37875908 | |
Source: | Code function: | 4_2_3787A919 | |
Source: | Code function: | 4_2_3787D321 | |
Source: | Code function: | 4_2_3787D330 | |
Source: | Code function: | 4_2_3787EB3B | |
Source: | Code function: | 4_2_3787EB48 | |
Source: | Code function: | 4_2_37879361 | |
Source: | Code function: | 4_2_3787BD68 | |
Source: | Code function: | 4_2_37879370 | |
Source: | Code function: | 4_2_3787AF70 | |
Source: | Code function: | 4_2_3787BD78 | |
Source: | Code function: | 4_2_3787CA80 | |
Source: | Code function: | 4_2_3787A4C0 | |
Source: | Code function: | 4_2_3787CEC8 | |
Source: | Code function: | 4_2_3787A4D0 | |
Source: | Code function: | 4_2_3787CED8 | |
Source: | Code function: | 4_2_3787E6F0 | |
Source: | Code function: | 4_2_378760FE | |
Source: | Code function: | 4_2_3787E60B | |
Source: | Code function: | 4_2_37879C11 | |
Source: | Code function: | 4_2_3787C618 | |
Source: | Code function: | 4_2_37879C20 | |
Source: | Code function: | 4_2_3787C628 | |
Source: | Code function: | 4_2_3787F843 | |
Source: | Code function: | 4_2_3787F850 | |
Source: | Code function: | 4_2_3787A068 | |
Source: | Code function: | 4_2_3787CA70 | |
Source: | Code function: | 4_2_3787A078 | |
Source: | Code function: | 4_2_378977F0 | |
Source: | Code function: | 4_2_37899568 | |
Source: | Code function: | 4_2_37898490 | |
Source: | Code function: | 4_2_378971A8 | |
Source: | Code function: | 4_2_37896130 | |
Source: | Code function: | 4_2_37897E40 | |
Source: | Code function: | 4_2_378998D0 | |
Source: | Code function: | 4_2_378977E0 | |
Source: | Code function: | 4_2_378946EA | |
Source: | Code function: | 4_2_378946F8 | |
Source: | Code function: | 4_2_37895632 | |
Source: | Code function: | 4_2_37893588 | |
Source: | Code function: | 4_2_37893598 | |
Source: | Code function: | 4_2_378915EF | |
Source: | Code function: | 4_2_378915F8 | |
Source: | Code function: | 4_2_37890488 | |
Source: | Code function: | 4_2_37898481 | |
Source: | Code function: | 4_2_37890498 | |
Source: | Code function: | 4_2_37892300 | |
Source: | Code function: | 4_2_37894299 | |
Source: | Code function: | 4_2_378942A0 | |
Source: | Code function: | 4_2_378922F3 | |
Source: | Code function: | 4_2_37891190 | |
Source: | Code function: | 4_2_378911A0 | |
Source: | Code function: | 4_2_37896121 | |
Source: | Code function: | 4_2_37893130 | |
Source: | Code function: | 4_2_37893140 | |
Source: | Code function: | 4_2_37890007 | |
Source: | Code function: | 4_2_3789E030 | |
Source: | Code function: | 4_2_37890040 | |
Source: | Code function: | 4_2_37894F99 | |
Source: | Code function: | 4_2_37894FA8 | |
Source: | Code function: | 4_2_37891E98 | |
Source: | Code function: | 4_2_37891EA8 | |
Source: | Code function: | 4_2_37893E38 | |
Source: | Code function: | 4_2_37897E30 | |
Source: | Code function: | 4_2_37893E48 | |
Source: | Code function: | 4_2_37890D38 | |
Source: | Code function: | 4_2_37890D48 | |
Source: | Code function: | 4_2_37892CD8 | |
Source: | Code function: | 4_2_37892CE8 | |
Source: | Code function: | 4_2_37894B40 | |
Source: | Code function: | 4_2_37894B50 | |
Source: | Code function: | 4_2_37898ACA | |
Source: | Code function: | 4_2_37898AD8 | |
Source: | Code function: | 4_2_37891A43 | |
Source: | Code function: | 4_2_37891A50 | |
Source: | Code function: | 4_2_378939E0 | |
Source: | Code function: | 4_2_378939F0 | |
Source: | Code function: | 4_2_37892890 | |
Source: | Code function: | 4_2_378908E3 | |
Source: | Code function: | 4_2_378908F0 | |
Source: | Code function: | 4_2_3789287F | |
Source: | Code function: | 4_2_388FD478 | |
Source: | Code function: | 4_2_388FE628 | |
Source: | Code function: | 4_2_388F73D0 |
Source: | Code function: |
Source: | Binary or memory string: |
Source: | Static PE information: |
Source: | Classification label: |
Source: | Code function: | 0_2_004045CA |
Source: | Code function: | 0_2_0040206A |
Source: | File created: | Jump to behavior |
Source: | Mutant created: |
Source: | File created: | Jump to behavior |
Source: | Static PE information: |
Source: | File read: | Jump to behavior |
Source: | Key opened: | Jump to behavior |
Source: | Binary or memory string: |
Source: | File read: | Jump to behavior |
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | Jump to behavior |
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior |
Source: | Key value queried: | Jump to behavior |
Source: | Key opened: | Jump to behavior |
Data Obfuscation |
---|
Source: | File source: | ||
Source: | File source: |
Source: | Code function: | 0_2_00406254 |
Source: | Code function: | 0_2_10002DCE |
Source: | File created: | Jump to dropped file |
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior |
Malware Analysis System Evasion |
---|
Source: | API/Special instruction interceptor: | ||
Source: | API/Special instruction interceptor: |
Source: | RDTSC instruction interceptor: | ||
Source: | RDTSC instruction interceptor: |
Source: | Memory allocated: | Jump to behavior | ||
Source: | Memory allocated: | Jump to behavior | ||
Source: | Memory allocated: | Jump to behavior |
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior |
Source: | Window / User API: | Jump to behavior | ||
Source: | Window / User API: | Jump to behavior |
Source: | Dropped PE file which has not been started: | Jump to dropped file |
Source: | API coverage: |
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep count: | Jump to behavior | ||
Source: | Thread sleep count: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior |
Source: | Code function: | 0_2_00405772 | |
Source: | Code function: | 0_2_0040622D | |
Source: | Code function: | 0_2_00402770 | |
Source: | Code function: | 4_2_00402770 | |
Source: | Code function: | 4_2_00405772 | |
Source: | Code function: | 4_2_0040622D |
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior |
Source: | Binary or memory string: | ||
Source: | Binary or memory string: |
Source: | API call chain: | graph_0-4797 | ||
Source: | API call chain: | graph_0-4799 |
Source: | Code function: | 0_2_00406254 |
Source: | Process token adjusted: | Jump to behavior |
Source: | Memory allocated: | Jump to behavior |
Source: | Process created: | Jump to behavior |
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior |
Source: | Code function: | 0_2_00405F0C |
Source: | Key value queried: | Jump to behavior |
Lowering of HIPS / PFW / Operating System Security Settings |
---|
Source: | Registry value created: | Jump to behavior |
Source: | Registry value created: | Jump to behavior |
Source: | Registry key created or modified: | Jump to behavior |
Stealing of Sensitive Information |
---|
Source: | File source: | ||
Source: | File source: |
Source: | File source: | ||
Source: | File source: |
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior |
Source: | Key opened: | Jump to behavior |
Source: | File source: | ||
Source: | File source: |
Remote Access Functionality |
---|
Source: | File source: | ||
Source: | File source: |
Source: | File source: | ||
Source: | File source: |
Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | 1 Native API | 1 DLL Side-Loading | 11 Process Injection | 11 Masquerading | 1 OS Credential Dumping | 21 Security Software Discovery | Remote Services | 1 Email Collection | 1 Web Service | Exfiltration Over Other Network Medium | 1 System Shutdown/Reboot |
Credentials | Domains | Default Accounts | Scheduled Task/Job | Boot or Logon Initialization Scripts | 1 DLL Side-Loading | 31 Disable or Modify Tools | LSASS Memory | 31 Virtualization/Sandbox Evasion | Remote Desktop Protocol | 1 Archive Collected Data | 21 Encrypted Channel | Exfiltration Over Bluetooth | Network Denial of Service |
Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | Logon Script (Windows) | 31 Virtualization/Sandbox Evasion | Security Account Manager | 1 Application Window Discovery | SMB/Windows Admin Shares | 1 Data from Local System | 1 Ingress Tool Transfer | Automated Exfiltration | Data Encrypted for Impact |
Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | 11 Process Injection | NTDS | 1 System Network Configuration Discovery | Distributed Component Object Model | 1 Clipboard Data | 3 Non-Application Layer Protocol | Traffic Duplication | Data Destruction |
Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | Network Logon Script | 1 Deobfuscate/Decode Files or Information | LSA Secrets | 2 File and Directory Discovery | SSH | Keylogging | 14 Application Layer Protocol | Scheduled Transfer | Data Encrypted for Impact |
Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | 3 Obfuscated Files or Information | Cached Domain Credentials | 215 System Information Discovery | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | 1 DLL Side-Loading | DCSync | Remote System Discovery | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
This section contains all screenshots as thumbnails, including those not shown in the slideshow.
Source | Detection | Scanner | Label | Link |
---|---|---|---|---|
5% | ReversingLabs | |||
100% | Avira | HEUR/AGEN.1337946 |
Source | Detection | Scanner | Label | Link |
---|---|---|---|---|
0% | ReversingLabs |
Name | IP | Active | Malicious | Antivirus Detection | Reputation |
---|---|---|---|---|---|
drive.google.com | 172.217.19.174 | true | false | high | |
drive.usercontent.google.com | 142.250.181.33 | true | false | high | |
reallyfreegeoip.org | 172.67.177.134 | true | false | high | |
api.telegram.org | 149.154.167.220 | true | false | high | |
checkip.dyndns.com | 193.122.130.0 | true | false | high | |
checkip.dyndns.org | unknown | unknown | false | high |
Name | Malicious | Antivirus Detection | Reputation |
---|---|---|---|
false | high | ||
false | high | ||
false | high |
Name | Source | Malicious | Antivirus Detection | Reputation |
---|---|---|---|---|
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false | high |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
---|---|---|---|---|---|---|
149.154.167.220 | api.telegram.org | United Kingdom | 62041 | TELEGRAMRU | false | |
193.122.130.0 | checkip.dyndns.com | United States | 31898 | ORACLE-BMC-31898US | false | |
172.217.19.174 | drive.google.com | United States | 15169 | GOOGLEUS | false | |
142.250.181.33 | drive.usercontent.google.com | United States | 15169 | GOOGLEUS | false | |
172.67.177.134 | reallyfreegeoip.org | United States | 13335 | CLOUDFLARENETUS | false |
Joe Sandbox version: | 41.0.0 Charoite |
Analysis ID: | 1567225 |
Start date and time: | 2024-12-03 10:06:06 +01:00 |
Joe Sandbox product: | CloudBasic |
Overall analysis duration: | 0h 6m 39s |
Hypervisor based Inspection enabled: | false |
Report type: | full |
Cookbook file name: | default.jbs |
Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
Number of analysed new started processes analysed: | 5 |
Number of new started drivers analysed: | 0 |
Number of existing processes analysed: | 0 |
Number of existing drivers analysed: | 0 |
Number of injected processes analysed: | 0 |
Technologies: |
|
Analysis Mode: | default |
Analysis stop reason: | Timeout |
Sample name: | Bank Swift and SOA PRN0072003410853_pdf.exe |
Detection: | MAL |
Classification: | mal100.troj.spyw.evad.winEXE@3/8@5/5 |
EGA Information: |
|
HCA Information: |
|
Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
- Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
- Report size getting too big, too many NtOpenKeyEx calls found.
- Report size getting too big, too many NtQueryValueKey calls found.
- Report size getting too big, too many NtReadVirtualMemory calls found.
- Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
- VT rate limit hit for: Bank Swift and SOA PRN0072003410853_pdf.exe
Time | Type | Description |
---|---|---|
04:08:09 | API Interceptor |
Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
---|---|---|---|---|---|---|
149.154.167.220 | Get hash | malicious | HTMLPhisher | Browse | ||
Get hash | malicious | HTMLPhisher | Browse | |||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse | |||
Get hash | malicious | HTMLPhisher | Browse | |||
Get hash | malicious | Discord Token Stealer, DotStealer | Browse | |||
Get hash | malicious | AsyncRAT, XWorm | Browse | |||
Get hash | malicious | HTMLPhisher | Browse | |||
Get hash | malicious | GuLoader, Snake Keylogger, VIP Keylogger | Browse | |||
Get hash | malicious | Snake Keylogger | Browse | |||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse | |||
193.122.130.0 | Get hash | malicious | Snake Keylogger | Browse |
| |
Get hash | malicious | Snake Keylogger | Browse |
| ||
Get hash | malicious | MassLogger RAT, PureLog Stealer | Browse |
| ||
Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger | Browse |
| ||
Get hash | malicious | PureLog Stealer, Snake Keylogger | Browse |
| ||
Get hash | malicious | PureLog Stealer, Snake Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
|
Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
---|---|---|---|---|---|---|
checkip.dyndns.com | Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| |
Get hash | malicious | GuLoader, Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | PureLog Stealer, Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger | Browse |
| ||
Get hash | malicious | MassLogger RAT | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
api.telegram.org | Get hash | malicious | HTMLPhisher | Browse |
| |
Get hash | malicious | HTMLPhisher | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | HTMLPhisher | Browse |
| ||
Get hash | malicious | Discord Token Stealer, DotStealer | Browse |
| ||
Get hash | malicious | AsyncRAT, XWorm | Browse |
| ||
Get hash | malicious | HTMLPhisher | Browse |
| ||
Get hash | malicious | GuLoader, Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
reallyfreegeoip.org | Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| |
Get hash | malicious | GuLoader, Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | PureLog Stealer, Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger | Browse |
| ||
Get hash | malicious | MassLogger RAT | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
|
Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
---|---|---|---|---|---|---|
TELEGRAMRU | Get hash | malicious | HTMLPhisher | Browse |
| |
Get hash | malicious | HTMLPhisher | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | HTMLPhisher | Browse |
| ||
Get hash | malicious | Discord Token Stealer, DotStealer | Browse |
| ||
Get hash | malicious | AsyncRAT, XWorm | Browse |
| ||
Get hash | malicious | HTMLPhisher | Browse |
| ||
Get hash | malicious | GuLoader, Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
ORACLE-BMC-31898US | Get hash | malicious | Snake Keylogger | Browse |
| |
Get hash | malicious | Snake Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | PureLog Stealer, Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger | Browse |
| ||
Get hash | malicious | MassLogger RAT | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | MassLogger RAT, PureLog Stealer | Browse |
| ||
Get hash | malicious | Gurcu Stealer | Browse |
| ||
CLOUDFLARENETUS | Get hash | malicious | Unknown | Browse |
| |
Get hash | malicious | FormBook | Browse |
| ||
Get hash | malicious | HTMLPhisher | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Amadey, LummaC Stealer, Nymaim, Stealc, Vidar | Browse |
| ||
Get hash | malicious | LummaC Stealer | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
|
Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
---|---|---|---|---|---|---|
54328bd36c14bd82ddaa0c04b25ed9ad | Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| |
Get hash | malicious | GuLoader, Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | PureLog Stealer, Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger | Browse |
| ||
Get hash | malicious | MassLogger RAT | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
3b5074b1b5d032e5620f69f9f700ff0e | Get hash | malicious | Unknown | Browse |
| |
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Amadey, Stealc, Vidar | Browse |
| ||
Get hash | malicious | LummaC Stealer | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | HTMLPhisher | Browse |
| ||
37f463bf4616ecd445d4a1937da06e19 | Get hash | malicious | Unknown | Browse |
| |
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Amadey, LummaC Stealer, Nymaim, RHADAMANTHYS, Stealc, Vidar | Browse |
| ||
Get hash | malicious | DCRat, PureLog Stealer, zgRAT | Browse |
| ||
Get hash | malicious | GuLoader, Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | GuLoader, Remcos | Browse |
|
Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
---|---|---|---|---|---|---|
C:\Users\user\AppData\Local\Temp\nsh20B3.tmp\System.dll | Get hash | malicious | Azorult, GuLoader | Browse | ||
Get hash | malicious | GuLoader, Snake Keylogger | Browse | |||
Get hash | malicious | GuLoader | Browse | |||
Get hash | malicious | GuLoader | Browse | |||
Get hash | malicious | GuLoader, Snake Keylogger | Browse | |||
Get hash | malicious | GuLoader, Snake Keylogger, VIP Keylogger | Browse | |||
Get hash | malicious | GuLoader, Snake Keylogger, VIP Keylogger | Browse | |||
Get hash | malicious | GuLoader, Snake Keylogger | Browse | |||
Get hash | malicious | GuLoader | Browse | |||
Get hash | malicious | Azorult, GuLoader | Browse |
Process: | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 11264 |
Entropy (8bit): | 5.801108840712148 |
Encrypted: | false |
SSDEEP: | 192:e/b2HS5ih/7i00eWz9T7PH6yeFcQMI5+Vw+EXWZ77dslFZk:ewSUmWw9T7MmnI5+/F7Kdk |
MD5: | FC90DFB694D0E17B013D6F818BCE41B0 |
SHA1: | 3243969886D640AF3BFA442728B9F0DFF9D5F5B0 |
SHA-256: | 7FE77CA13121A113C59630A3DBA0C8AAA6372E8082393274DA8F8608C4CE4528 |
SHA-512: | 324F13AA7A33C6408E2A57C3484D1691ECEE7C3C1366DE2BB8978C8DC66B18425D8CAB5A32D1702C13C43703E36148A022263DE7166AFDCE141DA2B01169F1C6 |
Malicious: | false |
Antivirus: |
|
Joe Sandbox View: |
|
Reputation: | moderate, very likely benign file |
Preview: |
Process: | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 1239961 |
Entropy (8bit): | 3.4529710226083643 |
Encrypted: | false |
SSDEEP: | 6144:KO8rRdpVXWcyIXDtKgsw1dnPXWkBFWoveSw+ShCdf0PBfjmNakqxQ8u9a6Ioj6wf:f8rRdTmoDo/wPnvWkqmaNxQuqWpKJ |
MD5: | 0BEBE86FDEE11B7B6297247AD6302535 |
SHA1: | 68EC7B70BEF8FF7787DCC549638FC8236195390A |
SHA-256: | A3713D189F3B9D30D8A350C275BA3E50C53CCD99E76C1FEA06E6CFB4E03935D1 |
SHA-512: | 25369AF5A43A9256F067901F5815B1D9B1A3DD809ED45DD520D7547FC5471CE6B9ED985D45FB695EEB02E0C91D11CF8B1B16D8CC368949BC4F489AE75ED78545 |
Malicious: | false |
Reputation: | low |
Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Emalje.kap
Download File
Process: | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 161977 |
Entropy (8bit): | 1.2465706431701635 |
Encrypted: | false |
SSDEEP: | 768:j91kr2E4uLB4rAvVSJUxZOKLuPYUIlh6njQqVK+P7T6r6hI4W7lD1jBCgUpo:94irAZug+TLg1cpo |
MD5: | 818D9B577C6A2CCB8C8D753C89B0AEED |
SHA1: | 1912E60E75B47E0AC0B0ACDB2B320F0B36D3CE22 |
SHA-256: | B53DFB245A8D5A0F0FAEEC7E8B4AE273522AC29FD29B33608F9BA7F9ADB90279 |
SHA-512: | 91993AA2E3E2666A3945886101B2B670CD3B0D76CF3CFFF3684DCB310FE324A1C650FAB5D5D00B8CFA49B5A7713FE2DBBA6DC2D8BB8DAC7A169495E6694CE4C6 |
Malicious: | false |
Reputation: | low |
Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Slagman.Chl
Download File
Process: | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 95383 |
Entropy (8bit): | 4.590493249543966 |
Encrypted: | false |
SSDEEP: | 1536:mkP6Ro1trv6OfpGwoB/UOKwNFtqr7jU9HDwdC:m6IoPrv6qpNqFtAjEDl |
MD5: | 5A8AE9C714F277A73E892829DFB49020 |
SHA1: | 223575F96382A8826268B7BA7E2632AD395F501B |
SHA-256: | 96135BA6FFD66EE96685104A0036C663B1E9146CFF61624EF66208954E390529 |
SHA-512: | 80D8880ECA73F2808F1ADF851DF201937427C166B64FB5F87473DCCBE54BB1E6292CA4132F6724656081F7F913D413563CA2ABA4704A063865969CF94F98798A |
Malicious: | false |
Reputation: | low |
Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Ufyldestgrendes.Fug212
Download File
Process: | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 266379 |
Entropy (8bit): | 7.804024163240316 |
Encrypted: | false |
SSDEEP: | 6144:xVXWcyIXDtKgsw1dnPXWkBFWoveSw+ShCdf0PBfjmNakqxQ9:bmoDo/wPnvWkqmaNxQ9 |
MD5: | 487EF3DA1EE32F8ED740FAE037C63CEE |
SHA1: | AF57E5FAFBC549BAE546F2E700AE06C9318CE7BA |
SHA-256: | 5664D4123F3C4EBD8ED539CBA72BF64766132D1F49C39EB963A59937AB3A165B |
SHA-512: | 94D417157EC4AC81962F514B05DF9F706CFA50671D6F13A6DBD940B184D6251721666E7C41900167D8427037AB8F49C4589FE8474FDC90D660D91EBB9EEBBFA4 |
Malicious: | false |
Reputation: | low |
Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\img2.jpg
Download File
Process: | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 2929 |
Entropy (8bit): | 7.418910042244289 |
Encrypted: | false |
SSDEEP: | 48:j2XBhBOaFxHfEaq1kk1YunCRbvwxhjAxnyHIvR4SnHP7oNLpLR8Fqhr:j2XBv9Fx2kkO7RihjlovpnHPCpaQ1 |
MD5: | 49DAF4E74443D8502F3229468615185F |
SHA1: | 9BB41BF5F382EE315893366F559FA26D57A4CD5F |
SHA-256: | E5EE495A89E55467DB6A396F012EDB6A71D2E762CFC7FC6846FE7259528BF168 |
SHA-512: | EE9ABC6A19215FED64584BA24736ECBA24139CD03A75530FF351C99A25628410472A28F4EE08E87CE1F75DC79396A2A9C1AC79C399720C320437BC18993B561A |
Malicious: | false |
Reputation: | low |
Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\pinrail.whe
Download File
Process: | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 461378 |
Entropy (8bit): | 1.252059381950645 |
Encrypted: | false |
SSDEEP: | 1536:s3tr+hilKd11tUzcxZg7SBobbR5FF7b7IvSog:sRVmQc3u9F7b76 |
MD5: | 3AD2FE4EA13486258EADDD1E5940A6D7 |
SHA1: | 06D0468A125D754D4534C182D79444DFB7A1CF61 |
SHA-256: | E4C5F20595C446D20C978CF7B486579BA2FFC17E64B940733B40C89DF4331319 |
SHA-512: | 82328E01492BDB8B23555CB369279A5352B35E0B51A4A4AC88D9F9285BBDABA627FE01139B4F9669847252D5A59FC512B2463A364EFD5C33B83309D6A8985D59 |
Malicious: | false |
Reputation: | low |
Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\unyouthfully.ske
Download File
Process: | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 225641 |
Entropy (8bit): | 1.2362366155163755 |
Encrypted: | false |
SSDEEP: | 768:HcPiBl7QD/ad4B+etLBBF64vscOIBiMFYnfBc1TS/HVtHlY4bDzZkmNQyFY670Fn:QaxOPt/G9V4yf7P/zZkX00b/h |
MD5: | 94C4B93474D07658FCBD411A20E68532 |
SHA1: | 66421117EB902B48D39A1514C88C868394085FCF |
SHA-256: | 50B1D7356F0CC22F2A9AE93A7CC9738C6BC0907724ACDB85F68F594333B706DC |
SHA-512: | BC1C40FF5B9FD71590E9B3E71D7B58A46E8AFBE56DFBD22C39F5DC0952ACEDC96F2BC4D8428EA0BCD75D67BD32F2B095585925CD8141063801FB128EA46F7471 |
Malicious: | false |
Reputation: | low |
Preview: |
File type: | |
Entropy (8bit): | 7.090943260853394 |
TrID: |
|
File name: | Bank Swift and SOA PRN0072003410853_pdf.exe |
File size: | 746'748 bytes |
MD5: | 09b9beebda4769c102cb42a564ef2001 |
SHA1: | a79649f64f1b3684436d0e8ec8226224a3cb35e6 |
SHA256: | ec936a27fcad21e1435ca19859482e5f91fc4822b65498bb1f4cc68b75a11567 |
SHA512: | 531fbb9efce2c880c04612192eff0e0e7aec2d214464d40f9dc0dab2af9fc4f6650177c267d79eec1605963c0c7c61f4a85221ad3d6a8630b44f5eab98f1cbec |
SSDEEP: | 12288:xlYZmcRHOw+fUtqk6u+0n1eq2fHQSxmx7FBkqIaToWB6/gf:UmcdO5fUt4u+0Z2/t67FafWB+q |
TLSH: | CBF4E06F57078456EF9015F2B8A39E4362F5BEBC216833095DA2FE1790B2F70394E489 |
File Content Preview: | MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1.D9u.*ju.*ju.*j..ujw.*ju.+j..*j..wjd.*j!..j..*j..,jt.*jRichu.*j........PE..L.....oS.................`...*......Z3.......p....@ |
Icon Hash: | 058cc0e474936126 |
Entrypoint: | 0x40335a |
Entrypoint Section: | .text |
Digitally signed: | false |
Imagebase: | 0x400000 |
Subsystem: | windows gui |
Image File Characteristics: | RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE |
DLL Characteristics: | TERMINAL_SERVER_AWARE |
Time Stamp: | 0x536FD79B [Sun May 11 20:03:39 2014 UTC] |
TLS Callbacks: | |
CLR (.Net) Version: | |
OS Version Major: | 4 |
OS Version Minor: | 0 |
File Version Major: | 4 |
File Version Minor: | 0 |
Subsystem Version Major: | 4 |
Subsystem Version Minor: | 0 |
Import Hash: | e221f4f7d36469d53810a4b5f9fc8966 |
Instruction |
---|
sub esp, 000002D4h |
push ebx |
push ebp |
push esi |
push edi |
push 00000020h |
xor ebp, ebp |
pop esi |
mov dword ptr [esp+14h], ebp |
mov dword ptr [esp+10h], 00409230h |
mov dword ptr [esp+1Ch], ebp |
call dword ptr [00407034h] |
push 00008001h |
call dword ptr [004070BCh] |
push ebp |
call dword ptr [004072ACh] |
push 00000008h |
mov dword ptr [00429298h], eax |
call 00007FB6852B52ACh |
mov dword ptr [004291E4h], eax |
push ebp |
lea eax, dword ptr [esp+34h] |
push 000002B4h |
push eax |
push ebp |
push 00420690h |
call dword ptr [0040717Ch] |
push 0040937Ch |
push 004281E0h |
call 00007FB6852B4F17h |
call dword ptr [00407134h] |
mov ebx, 00434000h |
push eax |
push ebx |
call 00007FB6852B4F05h |
push ebp |
call dword ptr [0040710Ch] |
cmp word ptr [00434000h], 0022h |
mov dword ptr [004291E0h], eax |
mov eax, ebx |
jne 00007FB6852B23FAh |
push 00000022h |
mov eax, 00434002h |
pop esi |
push esi |
push eax |
call 00007FB6852B4956h |
push eax |
call dword ptr [00407240h] |
mov dword ptr [esp+18h], eax |
jmp 00007FB6852B24BEh |
push 00000020h |
pop edx |
cmp cx, dx |
jne 00007FB6852B23F9h |
inc eax |
inc eax |
cmp word ptr [eax], dx |
je 00007FB6852B23EBh |
add word ptr [eax], 0000h |
Programming Language: |
|
Name | Virtual Address | Virtual Size | Is in Section |
---|---|---|---|
IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_IMPORT | 0x7494 | 0xb4 | .rdata |
IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x5f000 | 0x43188 | .rsrc |
IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_DEBUG | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_TLS | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_IAT | 0x7000 | 0x2b8 | .rdata |
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
---|---|---|---|---|---|---|---|---|---|
.text | 0x1000 | 0x5e68 | 0x6000 | 2f6554958e1a5093777de617d6e0bffc | False | 0.6566162109375 | data | 6.419811957742583 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
.rdata | 0x7000 | 0x1354 | 0x1400 | 2222fe44ebbadbc32af32dfc9c88e48e | False | 0.4306640625 | data | 5.037511188789184 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
.data | 0x9000 | 0x202d8 | 0x600 | 9587277f9a9b39e2caf86eae07909d87 | False | 0.4733072916666667 | data | 3.757932017065988 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
.ndata | 0x2a000 | 0x35000 | 0x0 | d41d8cd98f00b204e9800998ecf8427e | False | 0 | empty | 0.0 | IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
.rsrc | 0x5f000 | 0x43188 | 0x43200 | ad79ab7bc0418c21ba04b90eb50d4a0c | False | 0.18500494646182494 | data | 4.605797713668011 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
---|---|---|---|---|---|---|
RT_BITMAP | 0x5f2b0 | 0x368 | Device independent bitmap graphic, 96 x 16 x 4, image size 768 | English | United States | 0.23623853211009174 |
RT_ICON | 0x5f618 | 0x42028 | Device independent bitmap graphic, 256 x 512 x 32, image size 270336 | English | United States | 0.1810552711779152 |
RT_DIALOG | 0xa1640 | 0x144 | data | English | United States | 0.5216049382716049 |
RT_DIALOG | 0xa1788 | 0x13c | data | English | United States | 0.5506329113924051 |
RT_DIALOG | 0xa18c8 | 0x100 | data | English | United States | 0.5234375 |
RT_DIALOG | 0xa19c8 | 0x11c | data | English | United States | 0.6091549295774648 |
RT_DIALOG | 0xa1ae8 | 0xc4 | data | English | United States | 0.5918367346938775 |
RT_DIALOG | 0xa1bb0 | 0x60 | data | English | United States | 0.7291666666666666 |
RT_GROUP_ICON | 0xa1c10 | 0x14 | data | English | United States | 1.1 |
RT_VERSION | 0xa1c28 | 0x258 | data | English | United States | 0.5216666666666666 |
RT_MANIFEST | 0xa1e80 | 0x305 | XML 1.0 document, ASCII text, with very long lines (773), with no line terminators | English | United States | 0.5614489003880984 |
DLL | Import |
---|---|
KERNEL32.dll | CompareFileTime, SearchPathW, SetFileTime, CloseHandle, GetShortPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, GetFullPathNameW, CreateDirectoryW, Sleep, GetTickCount, CreateFileW, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, SetEnvironmentVariableW, GetWindowsDirectoryW, SetFileAttributesW, ExpandEnvironmentStringsW, SetErrorMode, LoadLibraryW, lstrlenW, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, CreateProcessW, RemoveDirectoryW, lstrcmpiA, GetTempFileNameW, lstrcpyA, lstrcpyW, lstrcatW, GetSystemDirectoryW, GetVersion, GetProcAddress, LoadLibraryA, GetModuleHandleA, GetModuleHandleW, lstrcmpiW, lstrcmpW, WaitForSingleObject, GlobalFree, GlobalAlloc, LoadLibraryExW, GetExitCodeProcess, FreeLibrary, WritePrivateProfileStringW, GetCommandLineW, GetTempPathW, GetPrivateProfileStringW, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, MulDiv, MultiByteToWideChar, WriteFile, lstrlenA, WideCharToMultiByte |
USER32.dll | EndDialog, ScreenToClient, GetWindowRect, RegisterClassW, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, wsprintfW, CreateWindowExW, SystemParametersInfoW, AppendMenuW, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, GetDC, SetWindowLongW, LoadImageW, SendMessageTimeoutW, FindWindowExW, EmptyClipboard, OpenClipboard, TrackPopupMenu, EndPaint, ShowWindow, GetDlgItem, IsWindow, SetForegroundWindow |
GDI32.dll | SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor |
SHELL32.dll | SHGetSpecialFolderLocation, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW |
ADVAPI32.dll | RegCloseKey, RegOpenKeyExW, RegDeleteKeyW, RegDeleteValueW, RegEnumValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumKeyW |
COMCTL32.dll | ImageList_Create, ImageList_AddMasked, ImageList_Destroy |
ole32.dll | CoCreateInstance, CoTaskMemFree, OleInitialize, OleUninitialize |
VERSION.dll | GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW |
Language of compilation system | Country where language is spoken | Map |
---|---|---|
English | United States |
Timestamp | SID | Signature | Severity | Source IP | Source Port | Dest IP | Dest Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-12-03T10:07:54.987250+0100 | 2803270 | ETPRO MALWARE Common Downloader Header Pattern UHCa | 2 | 192.168.2.5 | 49785 | 172.217.19.174 | 443 | TCP |
2024-12-03T10:08:02.353690+0100 | 2803274 | ETPRO MALWARE Common Downloader Header Pattern UH | 2 | 192.168.2.5 | 49807 | 193.122.130.0 | 80 | TCP |
2024-12-03T10:08:10.884946+0100 | 2803274 | ETPRO MALWARE Common Downloader Header Pattern UH | 2 | 192.168.2.5 | 49807 | 193.122.130.0 | 80 | TCP |
2024-12-03T10:08:13.063510+0100 | 2057744 | ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram | 1 | 192.168.2.5 | 49831 | 149.154.167.220 | 443 | TCP |
2024-12-03T10:08:14.588087+0100 | 2803274 | ETPRO MALWARE Common Downloader Header Pattern UH | 2 | 192.168.2.5 | 49837 | 193.122.130.0 | 80 | TCP |
2024-12-03T10:08:16.572544+0100 | 2057744 | ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram | 1 | 192.168.2.5 | 49842 | 149.154.167.220 | 443 | TCP |
2024-12-03T10:08:20.685027+0100 | 2057744 | ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram | 1 | 192.168.2.5 | 49851 | 149.154.167.220 | 443 | TCP |
2024-12-03T10:08:24.934366+0100 | 2057744 | ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram | 1 | 192.168.2.5 | 49864 | 149.154.167.220 | 443 | TCP |
2024-12-03T10:08:29.088266+0100 | 2057744 | ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram | 1 | 192.168.2.5 | 49874 | 149.154.167.220 | 443 | TCP |
2024-12-03T10:08:32.581714+0100 | 2057744 | ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram | 1 | 192.168.2.5 | 49885 | 149.154.167.220 | 443 | TCP |
2024-12-03T10:08:35.925133+0100 | 2057744 | ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram | 1 | 192.168.2.5 | 49894 | 149.154.167.220 | 443 | TCP |
2024-12-03T10:08:39.356327+0100 | 2057744 | ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram | 1 | 192.168.2.5 | 49903 | 149.154.167.220 | 443 | TCP |
2024-12-03T10:08:42.748741+0100 | 2057744 | ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram | 1 | 192.168.2.5 | 49913 | 149.154.167.220 | 443 | TCP |
2024-12-03T10:08:46.059309+0100 | 2057744 | ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram | 1 | 192.168.2.5 | 49922 | 149.154.167.220 | 443 | TCP |
2024-12-03T10:08:49.558654+0100 | 2057744 | ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram | 1 | 192.168.2.5 | 49933 | 149.154.167.220 | 443 | TCP |
2024-12-03T10:08:53.121035+0100 | 2057744 | ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram | 1 | 192.168.2.5 | 49942 | 149.154.167.220 | 443 | TCP |
2024-12-03T10:08:56.452479+0100 | 2057744 | ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram | 1 | 192.168.2.5 | 49951 | 149.154.167.220 | 443 | TCP |
2024-12-03T10:08:59.770297+0100 | 2057744 | ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram | 1 | 192.168.2.5 | 49961 | 149.154.167.220 | 443 | TCP |
2024-12-03T10:09:04.369183+0100 | 2057744 | ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram | 1 | 192.168.2.5 | 49970 | 149.154.167.220 | 443 | TCP |
Timestamp | Source Port | Dest Port | Source IP | Dest IP |
---|---|---|---|---|
Dec 3, 2024 10:07:52.308252096 CET | 49785 | 443 | 192.168.2.5 | 172.217.19.174 |
Dec 3, 2024 10:07:52.308293104 CET | 443 | 49785 | 172.217.19.174 | 192.168.2.5 |
Dec 3, 2024 10:07:52.308451891 CET | 49785 | 443 | 192.168.2.5 | 172.217.19.174 |
Dec 3, 2024 10:07:52.318130970 CET | 49785 | 443 | 192.168.2.5 | 172.217.19.174 |
Dec 3, 2024 10:07:52.318145037 CET | 443 | 49785 | 172.217.19.174 | 192.168.2.5 |
Dec 3, 2024 10:07:54.061575890 CET | 443 | 49785 | 172.217.19.174 | 192.168.2.5 |
Dec 3, 2024 10:07:54.061651945 CET | 49785 | 443 | 192.168.2.5 | 172.217.19.174 |
Dec 3, 2024 10:07:54.062355995 CET | 443 | 49785 | 172.217.19.174 | 192.168.2.5 |
Dec 3, 2024 10:07:54.062405109 CET | 49785 | 443 | 192.168.2.5 | 172.217.19.174 |
Dec 3, 2024 10:07:54.254080057 CET | 49785 | 443 | 192.168.2.5 | 172.217.19.174 |
Dec 3, 2024 10:07:54.254106998 CET | 443 | 49785 | 172.217.19.174 | 192.168.2.5 |
Dec 3, 2024 10:07:54.254478931 CET | 443 | 49785 | 172.217.19.174 | 192.168.2.5 |
Dec 3, 2024 10:07:54.254537106 CET | 49785 | 443 | 192.168.2.5 | 172.217.19.174 |
Dec 3, 2024 10:07:54.258322954 CET | 49785 | 443 | 192.168.2.5 | 172.217.19.174 |
Dec 3, 2024 10:07:54.303333044 CET | 443 | 49785 | 172.217.19.174 | 192.168.2.5 |
Dec 3, 2024 10:07:54.987246990 CET | 443 | 49785 | 172.217.19.174 | 192.168.2.5 |
Dec 3, 2024 10:07:54.987351894 CET | 49785 | 443 | 192.168.2.5 | 172.217.19.174 |
Dec 3, 2024 10:07:54.987369061 CET | 443 | 49785 | 172.217.19.174 | 192.168.2.5 |
Dec 3, 2024 10:07:54.987416983 CET | 49785 | 443 | 192.168.2.5 | 172.217.19.174 |
Dec 3, 2024 10:07:54.987566948 CET | 49785 | 443 | 192.168.2.5 | 172.217.19.174 |
Dec 3, 2024 10:07:54.987601042 CET | 443 | 49785 | 172.217.19.174 | 192.168.2.5 |
Dec 3, 2024 10:07:54.987749100 CET | 443 | 49785 | 172.217.19.174 | 192.168.2.5 |
Dec 3, 2024 10:07:54.987804890 CET | 49785 | 443 | 192.168.2.5 | 172.217.19.174 |
Dec 3, 2024 10:07:54.987823009 CET | 49785 | 443 | 192.168.2.5 | 172.217.19.174 |
Dec 3, 2024 10:07:55.144848108 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:55.144900084 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:55.144983053 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:55.145345926 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:55.145361900 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:56.843743086 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:56.843836069 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:57.011948109 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:57.011982918 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:57.012299061 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:57.012360096 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:57.020736933 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:57.067334890 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:59.485512018 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:59.485713959 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:59.498872995 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:59.499048948 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:59.605344057 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:59.605439901 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:59.605470896 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:59.605518103 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:59.609663010 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:59.609723091 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:59.677036047 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:59.677092075 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:59.680948973 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:59.680994987 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:59.681035042 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:59.681072950 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:59.686813116 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:59.686861992 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:59.694703102 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:59.694756985 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:59.696090937 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:59.696135998 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:59.704077959 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:59.704159975 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:59.707262993 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:59.707304001 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:59.713555098 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:59.713608980 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:59.720829010 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:59.720885038 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:59.724673033 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:59.724714041 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:59.734544992 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:59.734581947 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:59.737777948 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:59.737827063 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:59.748128891 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:59.748172045 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:59.751101017 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:59.751140118 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:59.761818886 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:59.761856079 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:59.764774084 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:59.764810085 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:59.775536060 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:59.775584936 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:59.778541088 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:59.778585911 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:59.789225101 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:59.789263964 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:59.792155027 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:59.792198896 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:59.803423882 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:59.803467035 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:59.803478956 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:59.803519011 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:59.816587925 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:59.816643000 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:59.835717916 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:59.835755110 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:59.835791111 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:59.835824013 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:59.868757010 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:59.868812084 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:59.868881941 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:59.868917942 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:59.871825933 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:59.871875048 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:59.871942997 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:59.871973991 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:59.876399994 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:59.876445055 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:59.879369020 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:59.879403114 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:59.879409075 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:59.879442930 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:59.891202927 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:59.891237974 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:59.891248941 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:59.891283035 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:59.891288996 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:59.891323090 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:59.910558939 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:59.910623074 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:59.910708904 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:59.910743952 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:59.913140059 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:59.913172960 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:59.913191080 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:59.913222075 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:59.923012972 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:59.923058987 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:59.923136950 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:59.923171997 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:59.933249950 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:59.933312893 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:59.933322906 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:59.933358908 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:59.944777966 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:59.944843054 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:59.944854975 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:59.944909096 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:59.953768015 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:59.953839064 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:59.953846931 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:59.953896046 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:59.963593960 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:59.963666916 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:59.963784933 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:59.963824034 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:59.973730087 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:59.973799944 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:59.973809004 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:59.973860025 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:59.983242035 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:59.983309031 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:59.983401060 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:59.983438969 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:59.992258072 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:59.992322922 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:07:59.992387056 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:07:59.992424965 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:08:00.001390934 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:08:00.001456022 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:08:00.001466990 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:08:00.001503944 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:08:00.010183096 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:08:00.010242939 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:08:00.010258913 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:08:00.010293961 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:08:00.011518955 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:08:00.011569977 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:08:00.011616945 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:08:00.011679888 CET | 443 | 49793 | 142.250.181.33 | 192.168.2.5 |
Dec 3, 2024 10:08:00.011727095 CET | 49793 | 443 | 192.168.2.5 | 142.250.181.33 |
Dec 3, 2024 10:08:00.525810957 CET | 49807 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:00.645775080 CET | 80 | 49807 | 193.122.130.0 | 192.168.2.5 |
Dec 3, 2024 10:08:00.646013021 CET | 49807 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:00.646189928 CET | 49807 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:00.766145945 CET | 80 | 49807 | 193.122.130.0 | 192.168.2.5 |
Dec 3, 2024 10:08:01.968810081 CET | 80 | 49807 | 193.122.130.0 | 192.168.2.5 |
Dec 3, 2024 10:08:01.973212004 CET | 49807 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:02.093446016 CET | 80 | 49807 | 193.122.130.0 | 192.168.2.5 |
Dec 3, 2024 10:08:02.302242994 CET | 80 | 49807 | 193.122.130.0 | 192.168.2.5 |
Dec 3, 2024 10:08:02.353689909 CET | 49807 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:03.457870960 CET | 49814 | 443 | 192.168.2.5 | 172.67.177.134 |
Dec 3, 2024 10:08:03.457912922 CET | 443 | 49814 | 172.67.177.134 | 192.168.2.5 |
Dec 3, 2024 10:08:03.457978964 CET | 49814 | 443 | 192.168.2.5 | 172.67.177.134 |
Dec 3, 2024 10:08:03.460316896 CET | 49814 | 443 | 192.168.2.5 | 172.67.177.134 |
Dec 3, 2024 10:08:03.460329056 CET | 443 | 49814 | 172.67.177.134 | 192.168.2.5 |
Dec 3, 2024 10:08:04.724203110 CET | 443 | 49814 | 172.67.177.134 | 192.168.2.5 |
Dec 3, 2024 10:08:04.724277973 CET | 49814 | 443 | 192.168.2.5 | 172.67.177.134 |
Dec 3, 2024 10:08:04.727526903 CET | 49814 | 443 | 192.168.2.5 | 172.67.177.134 |
Dec 3, 2024 10:08:04.727533102 CET | 443 | 49814 | 172.67.177.134 | 192.168.2.5 |
Dec 3, 2024 10:08:04.727802038 CET | 443 | 49814 | 172.67.177.134 | 192.168.2.5 |
Dec 3, 2024 10:08:04.731786966 CET | 49814 | 443 | 192.168.2.5 | 172.67.177.134 |
Dec 3, 2024 10:08:04.779331923 CET | 443 | 49814 | 172.67.177.134 | 192.168.2.5 |
Dec 3, 2024 10:08:05.182600975 CET | 443 | 49814 | 172.67.177.134 | 192.168.2.5 |
Dec 3, 2024 10:08:05.182678938 CET | 443 | 49814 | 172.67.177.134 | 192.168.2.5 |
Dec 3, 2024 10:08:05.182729006 CET | 49814 | 443 | 192.168.2.5 | 172.67.177.134 |
Dec 3, 2024 10:08:05.188462973 CET | 49814 | 443 | 192.168.2.5 | 172.67.177.134 |
Dec 3, 2024 10:08:10.509001017 CET | 49807 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:10.629084110 CET | 80 | 49807 | 193.122.130.0 | 192.168.2.5 |
Dec 3, 2024 10:08:10.838803053 CET | 80 | 49807 | 193.122.130.0 | 192.168.2.5 |
Dec 3, 2024 10:08:10.884946108 CET | 49807 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:10.987449884 CET | 49831 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:10.987489939 CET | 443 | 49831 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:10.987554073 CET | 49831 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:10.988054037 CET | 49831 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:10.988069057 CET | 443 | 49831 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:12.400612116 CET | 443 | 49831 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:12.400686026 CET | 49831 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:12.402599096 CET | 49831 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:12.402606964 CET | 443 | 49831 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:12.402842045 CET | 443 | 49831 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:12.404386044 CET | 49831 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:12.451333046 CET | 443 | 49831 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:12.451395035 CET | 49831 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:12.451401949 CET | 443 | 49831 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:13.063586950 CET | 443 | 49831 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:13.063690901 CET | 443 | 49831 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:13.063745975 CET | 49831 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:13.064152956 CET | 49831 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:13.213227034 CET | 49807 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:13.214443922 CET | 49837 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:13.333719015 CET | 80 | 49807 | 193.122.130.0 | 192.168.2.5 |
Dec 3, 2024 10:08:13.333781958 CET | 49807 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:13.334470034 CET | 80 | 49837 | 193.122.130.0 | 192.168.2.5 |
Dec 3, 2024 10:08:13.334546089 CET | 49837 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:13.334702015 CET | 49837 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:13.454571962 CET | 80 | 49837 | 193.122.130.0 | 192.168.2.5 |
Dec 3, 2024 10:08:14.547318935 CET | 80 | 49837 | 193.122.130.0 | 192.168.2.5 |
Dec 3, 2024 10:08:14.548990965 CET | 49842 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:14.549046993 CET | 443 | 49842 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:14.549132109 CET | 49842 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:14.549921036 CET | 49842 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:14.549937010 CET | 443 | 49842 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:14.588087082 CET | 49837 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:15.909826040 CET | 443 | 49842 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:15.911549091 CET | 49842 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:15.911577940 CET | 443 | 49842 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:15.911634922 CET | 49842 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:15.911644936 CET | 443 | 49842 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:16.572587967 CET | 443 | 49842 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:16.572664976 CET | 443 | 49842 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:16.572830915 CET | 49842 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:16.573153019 CET | 49842 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:16.577709913 CET | 49848 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:16.697768927 CET | 80 | 49848 | 193.122.130.0 | 192.168.2.5 |
Dec 3, 2024 10:08:16.697858095 CET | 49848 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:16.697962999 CET | 49848 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:16.817890882 CET | 80 | 49848 | 193.122.130.0 | 192.168.2.5 |
Dec 3, 2024 10:08:18.319653988 CET | 80 | 49848 | 193.122.130.0 | 192.168.2.5 |
Dec 3, 2024 10:08:18.320969105 CET | 49851 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:18.321018934 CET | 443 | 49851 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:18.321094990 CET | 49851 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:18.321367979 CET | 49851 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:18.321382999 CET | 443 | 49851 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:18.369478941 CET | 49848 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:19.780359983 CET | 443 | 49851 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:19.822447062 CET | 49851 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:19.827480078 CET | 49851 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:19.827500105 CET | 443 | 49851 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:19.827586889 CET | 49851 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:19.827596903 CET | 443 | 49851 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:20.684988976 CET | 443 | 49851 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:20.685110092 CET | 443 | 49851 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:20.685178041 CET | 49851 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:20.685626984 CET | 49851 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:20.690805912 CET | 49848 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:20.691814899 CET | 49857 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:20.811111927 CET | 80 | 49848 | 193.122.130.0 | 192.168.2.5 |
Dec 3, 2024 10:08:20.811218023 CET | 49848 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:20.811706066 CET | 80 | 49857 | 193.122.130.0 | 192.168.2.5 |
Dec 3, 2024 10:08:20.811780930 CET | 49857 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:20.811891079 CET | 49857 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:20.931798935 CET | 80 | 49857 | 193.122.130.0 | 192.168.2.5 |
Dec 3, 2024 10:08:22.804289103 CET | 80 | 49857 | 193.122.130.0 | 192.168.2.5 |
Dec 3, 2024 10:08:22.839510918 CET | 49864 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:22.839554071 CET | 443 | 49864 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:22.839612961 CET | 49864 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:22.839889050 CET | 49864 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:22.839901924 CET | 443 | 49864 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:22.853699923 CET | 49857 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:24.245956898 CET | 443 | 49864 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:24.247615099 CET | 49864 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:24.247654915 CET | 443 | 49864 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:24.247715950 CET | 49864 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:24.247724056 CET | 443 | 49864 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:24.934370995 CET | 443 | 49864 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:24.934541941 CET | 443 | 49864 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:24.934596062 CET | 49864 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:24.934937954 CET | 49864 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:24.938741922 CET | 49857 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:24.939814091 CET | 49869 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:25.059501886 CET | 80 | 49857 | 193.122.130.0 | 192.168.2.5 |
Dec 3, 2024 10:08:25.059698105 CET | 49857 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:25.059783936 CET | 80 | 49869 | 193.122.130.0 | 192.168.2.5 |
Dec 3, 2024 10:08:25.059855938 CET | 49869 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:25.060040951 CET | 49869 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:25.179907084 CET | 80 | 49869 | 193.122.130.0 | 192.168.2.5 |
Dec 3, 2024 10:08:26.832870960 CET | 80 | 49869 | 193.122.130.0 | 192.168.2.5 |
Dec 3, 2024 10:08:26.834481955 CET | 49874 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:26.834525108 CET | 443 | 49874 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:26.834615946 CET | 49874 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:26.834943056 CET | 49874 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:26.834959030 CET | 443 | 49874 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:26.885060072 CET | 49869 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:28.258903027 CET | 443 | 49874 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:28.260943890 CET | 49874 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:28.260973930 CET | 443 | 49874 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:28.261020899 CET | 49874 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:28.261030912 CET | 443 | 49874 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:29.088251114 CET | 443 | 49874 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:29.088388920 CET | 443 | 49874 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:29.088458061 CET | 49874 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:29.089413881 CET | 49874 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:29.112016916 CET | 49869 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:29.113399982 CET | 49880 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:29.234740973 CET | 80 | 49869 | 193.122.130.0 | 192.168.2.5 |
Dec 3, 2024 10:08:29.234817028 CET | 49869 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:29.235008955 CET | 80 | 49880 | 193.122.130.0 | 192.168.2.5 |
Dec 3, 2024 10:08:29.235085011 CET | 49880 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:29.235251904 CET | 49880 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:29.355972052 CET | 80 | 49880 | 193.122.130.0 | 192.168.2.5 |
Dec 3, 2024 10:08:30.469878912 CET | 80 | 49880 | 193.122.130.0 | 192.168.2.5 |
Dec 3, 2024 10:08:30.471200943 CET | 49885 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:30.471240044 CET | 443 | 49885 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:30.471343040 CET | 49885 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:30.471616983 CET | 49885 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:30.471631050 CET | 443 | 49885 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:30.509970903 CET | 49880 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:31.931579113 CET | 443 | 49885 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:31.934571028 CET | 49885 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:31.934611082 CET | 443 | 49885 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:31.934654951 CET | 49885 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:31.934662104 CET | 443 | 49885 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:32.581763029 CET | 443 | 49885 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:32.581851959 CET | 443 | 49885 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:32.582081079 CET | 49885 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:32.582372904 CET | 49885 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:32.585388899 CET | 49880 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:32.586627960 CET | 49890 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:32.709280014 CET | 80 | 49880 | 193.122.130.0 | 192.168.2.5 |
Dec 3, 2024 10:08:32.709292889 CET | 80 | 49890 | 193.122.130.0 | 192.168.2.5 |
Dec 3, 2024 10:08:32.709388018 CET | 49880 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:32.709428072 CET | 49890 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:32.709659100 CET | 49890 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:32.829530954 CET | 80 | 49890 | 193.122.130.0 | 192.168.2.5 |
Dec 3, 2024 10:08:33.899415016 CET | 80 | 49890 | 193.122.130.0 | 192.168.2.5 |
Dec 3, 2024 10:08:33.901041031 CET | 49894 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:33.901082039 CET | 443 | 49894 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:33.901165962 CET | 49894 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:33.901452065 CET | 49894 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:33.901464939 CET | 443 | 49894 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:33.947535038 CET | 49890 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:35.263245106 CET | 443 | 49894 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:35.264904976 CET | 49894 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:35.264935017 CET | 443 | 49894 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:35.264998913 CET | 49894 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:35.265005112 CET | 443 | 49894 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:35.925127029 CET | 443 | 49894 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:35.925303936 CET | 443 | 49894 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:35.925389051 CET | 49894 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:35.925756931 CET | 49894 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:35.928833008 CET | 49890 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:35.930093050 CET | 49900 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:36.049257994 CET | 80 | 49890 | 193.122.130.0 | 192.168.2.5 |
Dec 3, 2024 10:08:36.049335957 CET | 49890 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:36.050019026 CET | 80 | 49900 | 193.122.130.0 | 192.168.2.5 |
Dec 3, 2024 10:08:36.050092936 CET | 49900 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:36.050265074 CET | 49900 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:36.170135975 CET | 80 | 49900 | 193.122.130.0 | 192.168.2.5 |
Dec 3, 2024 10:08:37.212111950 CET | 80 | 49900 | 193.122.130.0 | 192.168.2.5 |
Dec 3, 2024 10:08:37.226476908 CET | 49903 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:37.226506948 CET | 443 | 49903 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:37.226588964 CET | 49903 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:37.226872921 CET | 49903 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:37.226890087 CET | 443 | 49903 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:37.259972095 CET | 49900 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:38.695303917 CET | 443 | 49903 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:38.697222948 CET | 49903 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:38.697246075 CET | 443 | 49903 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:38.697369099 CET | 49903 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:38.697375059 CET | 443 | 49903 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:39.356333971 CET | 443 | 49903 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:39.356410027 CET | 443 | 49903 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:39.356604099 CET | 49903 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:39.357029915 CET | 49903 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:39.359951019 CET | 49900 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:39.360968113 CET | 49909 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:39.480211973 CET | 80 | 49900 | 193.122.130.0 | 192.168.2.5 |
Dec 3, 2024 10:08:39.480278015 CET | 49900 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:39.480870008 CET | 80 | 49909 | 193.122.130.0 | 192.168.2.5 |
Dec 3, 2024 10:08:39.480942011 CET | 49909 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:39.481106997 CET | 49909 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:39.601067066 CET | 80 | 49909 | 193.122.130.0 | 192.168.2.5 |
Dec 3, 2024 10:08:40.669373989 CET | 80 | 49909 | 193.122.130.0 | 192.168.2.5 |
Dec 3, 2024 10:08:40.696718931 CET | 49913 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:40.696785927 CET | 443 | 49913 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:40.696892977 CET | 49913 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:40.703758955 CET | 49913 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:40.703777075 CET | 443 | 49913 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:40.713079929 CET | 49909 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:42.110208035 CET | 443 | 49913 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:42.111902952 CET | 49913 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:42.111927032 CET | 443 | 49913 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:42.111968040 CET | 49913 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:42.111977100 CET | 443 | 49913 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:42.748802900 CET | 443 | 49913 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:42.748900890 CET | 443 | 49913 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:42.748953104 CET | 49913 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:42.749382973 CET | 49913 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:42.752367973 CET | 49909 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:42.753441095 CET | 49919 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:42.872672081 CET | 80 | 49909 | 193.122.130.0 | 192.168.2.5 |
Dec 3, 2024 10:08:42.872749090 CET | 49909 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:42.873342991 CET | 80 | 49919 | 193.122.130.0 | 192.168.2.5 |
Dec 3, 2024 10:08:42.873428106 CET | 49919 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:42.873558998 CET | 49919 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:42.993369102 CET | 80 | 49919 | 193.122.130.0 | 192.168.2.5 |
Dec 3, 2024 10:08:44.015513897 CET | 80 | 49919 | 193.122.130.0 | 192.168.2.5 |
Dec 3, 2024 10:08:44.017005920 CET | 49922 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:44.017044067 CET | 443 | 49922 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:44.017132998 CET | 49922 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:44.017411947 CET | 49922 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:44.017426014 CET | 443 | 49922 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:44.057054996 CET | 49919 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:45.424751997 CET | 443 | 49922 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:45.427303076 CET | 49922 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:45.427334070 CET | 443 | 49922 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:45.427419901 CET | 49922 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:45.427424908 CET | 443 | 49922 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:46.059392929 CET | 443 | 49922 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:46.059484959 CET | 443 | 49922 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:46.059540987 CET | 49922 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:46.060249090 CET | 49922 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:46.071611881 CET | 49919 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:46.072597027 CET | 49927 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:46.191939116 CET | 80 | 49919 | 193.122.130.0 | 192.168.2.5 |
Dec 3, 2024 10:08:46.192012072 CET | 49919 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:46.192475080 CET | 80 | 49927 | 193.122.130.0 | 192.168.2.5 |
Dec 3, 2024 10:08:46.192540884 CET | 49927 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:46.196389914 CET | 49927 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:46.316418886 CET | 80 | 49927 | 193.122.130.0 | 192.168.2.5 |
Dec 3, 2024 10:08:47.381109953 CET | 80 | 49927 | 193.122.130.0 | 192.168.2.5 |
Dec 3, 2024 10:08:47.382405043 CET | 49933 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:47.382425070 CET | 443 | 49933 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:47.382503033 CET | 49933 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:47.382808924 CET | 49933 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:47.382822037 CET | 443 | 49933 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:47.431900024 CET | 49927 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:48.837893009 CET | 443 | 49933 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:48.839405060 CET | 49933 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:48.839421034 CET | 443 | 49933 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:48.839587927 CET | 49933 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:48.839592934 CET | 443 | 49933 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:49.558690071 CET | 443 | 49933 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:49.558767080 CET | 443 | 49933 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:49.558814049 CET | 49933 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:49.565958977 CET | 49933 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:49.580900908 CET | 49927 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:49.582788944 CET | 49938 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:49.701293945 CET | 80 | 49927 | 193.122.130.0 | 192.168.2.5 |
Dec 3, 2024 10:08:49.701347113 CET | 49927 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:49.702671051 CET | 80 | 49938 | 193.122.130.0 | 192.168.2.5 |
Dec 3, 2024 10:08:49.702742100 CET | 49938 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:49.702931881 CET | 49938 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:49.822797060 CET | 80 | 49938 | 193.122.130.0 | 192.168.2.5 |
Dec 3, 2024 10:08:51.071820974 CET | 80 | 49938 | 193.122.130.0 | 192.168.2.5 |
Dec 3, 2024 10:08:51.073708057 CET | 49942 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:51.073725939 CET | 443 | 49942 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:51.073792934 CET | 49942 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:51.074131012 CET | 49942 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:51.074142933 CET | 443 | 49942 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:51.119457006 CET | 49938 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:52.484857082 CET | 443 | 49942 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:52.486308098 CET | 49942 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:52.486325026 CET | 443 | 49942 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:52.486373901 CET | 49942 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:52.486381054 CET | 443 | 49942 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:53.121051073 CET | 443 | 49942 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:53.121633053 CET | 443 | 49942 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:53.121692896 CET | 49942 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:53.122088909 CET | 49942 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:53.125890970 CET | 49938 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:53.126471996 CET | 49947 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:53.246160984 CET | 80 | 49938 | 193.122.130.0 | 192.168.2.5 |
Dec 3, 2024 10:08:53.246226072 CET | 49938 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:53.246556044 CET | 80 | 49947 | 193.122.130.0 | 192.168.2.5 |
Dec 3, 2024 10:08:53.246634007 CET | 49947 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:53.246826887 CET | 49947 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:53.366715908 CET | 80 | 49947 | 193.122.130.0 | 192.168.2.5 |
Dec 3, 2024 10:08:54.447940111 CET | 80 | 49947 | 193.122.130.0 | 192.168.2.5 |
Dec 3, 2024 10:08:54.451680899 CET | 49951 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:54.451704979 CET | 443 | 49951 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:54.451787949 CET | 49951 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:54.452049971 CET | 49951 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:54.452064037 CET | 443 | 49951 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:54.494431973 CET | 49947 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:55.816524982 CET | 443 | 49951 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:55.818135023 CET | 49951 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:55.818164110 CET | 443 | 49951 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:55.818227053 CET | 49951 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:55.818234921 CET | 443 | 49951 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:56.452549934 CET | 443 | 49951 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:56.452641010 CET | 443 | 49951 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:56.452704906 CET | 49951 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:56.453161955 CET | 49951 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:56.456420898 CET | 49947 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:56.457542896 CET | 49957 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:56.576567888 CET | 80 | 49947 | 193.122.130.0 | 192.168.2.5 |
Dec 3, 2024 10:08:56.576653004 CET | 49947 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:56.577403069 CET | 80 | 49957 | 193.122.130.0 | 192.168.2.5 |
Dec 3, 2024 10:08:56.577478886 CET | 49957 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:56.577637911 CET | 49957 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:56.697557926 CET | 80 | 49957 | 193.122.130.0 | 192.168.2.5 |
Dec 3, 2024 10:08:57.719907045 CET | 80 | 49957 | 193.122.130.0 | 192.168.2.5 |
Dec 3, 2024 10:08:57.721332073 CET | 49961 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:57.721340895 CET | 443 | 49961 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:57.721499920 CET | 49961 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:57.721918106 CET | 49961 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:57.721932888 CET | 443 | 49961 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:57.760026932 CET | 49957 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:59.132040024 CET | 443 | 49961 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:59.134321928 CET | 49961 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:59.134351015 CET | 443 | 49961 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:59.134402990 CET | 49961 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:59.134407997 CET | 443 | 49961 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:59.770325899 CET | 443 | 49961 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:59.770462990 CET | 443 | 49961 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:08:59.770517111 CET | 49961 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:59.770960093 CET | 49961 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:08:59.773785114 CET | 49957 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:59.774868011 CET | 49966 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:59.894021034 CET | 80 | 49957 | 193.122.130.0 | 192.168.2.5 |
Dec 3, 2024 10:08:59.894287109 CET | 49957 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:59.894761086 CET | 80 | 49966 | 193.122.130.0 | 192.168.2.5 |
Dec 3, 2024 10:08:59.894845963 CET | 49966 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:08:59.894996881 CET | 49966 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:09:00.014884949 CET | 80 | 49966 | 193.122.130.0 | 192.168.2.5 |
Dec 3, 2024 10:09:01.097229958 CET | 80 | 49966 | 193.122.130.0 | 192.168.2.5 |
Dec 3, 2024 10:09:01.099020004 CET | 49970 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:09:01.099050999 CET | 443 | 49970 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:09:01.099138021 CET | 49970 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:09:01.099436998 CET | 49970 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:09:01.099455118 CET | 443 | 49970 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:09:01.150566101 CET | 49966 | 80 | 192.168.2.5 | 193.122.130.0 |
Dec 3, 2024 10:09:02.518564939 CET | 443 | 49970 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:09:02.572455883 CET | 49970 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:09:03.632581949 CET | 49970 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:09:03.632611036 CET | 443 | 49970 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:09:03.632658958 CET | 49970 | 443 | 192.168.2.5 | 149.154.167.220 |
Dec 3, 2024 10:09:03.632668018 CET | 443 | 49970 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:09:04.369224072 CET | 443 | 49970 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:09:04.369313002 CET | 443 | 49970 | 149.154.167.220 | 192.168.2.5 |
Dec 3, 2024 10:09:04.369371891 CET | 49970 | 443 | 192.168.2.5 | 149.154.167.220 |
Timestamp | Source Port | Dest Port | Source IP | Dest IP |
---|---|---|---|---|
Dec 3, 2024 10:07:52.161222935 CET | 49821 | 53 | 192.168.2.5 | 1.1.1.1 |
Dec 3, 2024 10:07:52.299455881 CET | 53 | 49821 | 1.1.1.1 | 192.168.2.5 |
Dec 3, 2024 10:07:55.006166935 CET | 50048 | 53 | 192.168.2.5 | 1.1.1.1 |
Dec 3, 2024 10:07:55.143876076 CET | 53 | 50048 | 1.1.1.1 | 192.168.2.5 |
Dec 3, 2024 10:08:00.375009060 CET | 57592 | 53 | 192.168.2.5 | 1.1.1.1 |
Dec 3, 2024 10:08:00.520926952 CET | 53 | 57592 | 1.1.1.1 | 192.168.2.5 |
Dec 3, 2024 10:08:03.104756117 CET | 60520 | 53 | 192.168.2.5 | 1.1.1.1 |
Dec 3, 2024 10:08:03.457077980 CET | 53 | 60520 | 1.1.1.1 | 192.168.2.5 |
Dec 3, 2024 10:08:10.842678070 CET | 59534 | 53 | 192.168.2.5 | 1.1.1.1 |
Dec 3, 2024 10:08:10.981194019 CET | 53 | 59534 | 1.1.1.1 | 192.168.2.5 |
Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
---|---|---|---|---|---|---|---|---|
Dec 3, 2024 10:07:52.161222935 CET | 192.168.2.5 | 1.1.1.1 | 0xd1bd | Standard query (0) | A (IP address) | IN (0x0001) | false | |
Dec 3, 2024 10:07:55.006166935 CET | 192.168.2.5 | 1.1.1.1 | 0xfd3a | Standard query (0) | A (IP address) | IN (0x0001) | false | |
Dec 3, 2024 10:08:00.375009060 CET | 192.168.2.5 | 1.1.1.1 | 0x50fa | Standard query (0) | A (IP address) | IN (0x0001) | false | |
Dec 3, 2024 10:08:03.104756117 CET | 192.168.2.5 | 1.1.1.1 | 0xcd8c | Standard query (0) | A (IP address) | IN (0x0001) | false | |
Dec 3, 2024 10:08:10.842678070 CET | 192.168.2.5 | 1.1.1.1 | 0x88b0 | Standard query (0) | A (IP address) | IN (0x0001) | false |
Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
---|---|---|---|---|---|---|---|---|---|---|
Dec 3, 2024 10:07:52.299455881 CET | 1.1.1.1 | 192.168.2.5 | 0xd1bd | No error (0) | 172.217.19.174 | A (IP address) | IN (0x0001) | false | ||
Dec 3, 2024 10:07:55.143876076 CET | 1.1.1.1 | 192.168.2.5 | 0xfd3a | No error (0) | 142.250.181.33 | A (IP address) | IN (0x0001) | false | ||
Dec 3, 2024 10:08:00.520926952 CET | 1.1.1.1 | 192.168.2.5 | 0x50fa | No error (0) | checkip.dyndns.com | CNAME (Canonical name) | IN (0x0001) | false | ||
Dec 3, 2024 10:08:00.520926952 CET | 1.1.1.1 | 192.168.2.5 | 0x50fa | No error (0) | 193.122.130.0 | A (IP address) | IN (0x0001) | false | ||
Dec 3, 2024 10:08:00.520926952 CET | 1.1.1.1 | 192.168.2.5 | 0x50fa | No error (0) | 132.226.8.169 | A (IP address) | IN (0x0001) | false | ||
Dec 3, 2024 10:08:00.520926952 CET | 1.1.1.1 | 192.168.2.5 | 0x50fa | No error (0) | 158.101.44.242 | A (IP address) | IN (0x0001) | false | ||
Dec 3, 2024 10:08:00.520926952 CET | 1.1.1.1 | 192.168.2.5 | 0x50fa | No error (0) | 132.226.247.73 | A (IP address) | IN (0x0001) | false | ||
Dec 3, 2024 10:08:00.520926952 CET | 1.1.1.1 | 192.168.2.5 | 0x50fa | No error (0) | 193.122.6.168 | A (IP address) | IN (0x0001) | false | ||
Dec 3, 2024 10:08:03.457077980 CET | 1.1.1.1 | 192.168.2.5 | 0xcd8c | No error (0) | 172.67.177.134 | A (IP address) | IN (0x0001) | false | ||
Dec 3, 2024 10:08:03.457077980 CET | 1.1.1.1 | 192.168.2.5 | 0xcd8c | No error (0) | 104.21.67.152 | A (IP address) | IN (0x0001) | false | ||
Dec 3, 2024 10:08:10.981194019 CET | 1.1.1.1 | 192.168.2.5 | 0x88b0 | No error (0) | 149.154.167.220 | A (IP address) | IN (0x0001) | false |
|
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
0 | 192.168.2.5 | 49807 | 193.122.130.0 | 80 | 1292 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
Dec 3, 2024 10:08:00.646189928 CET | 151 | OUT | |
Dec 3, 2024 10:08:01.968810081 CET | 321 | IN | |
Dec 3, 2024 10:08:01.973212004 CET | 127 | OUT | |
Dec 3, 2024 10:08:02.302242994 CET | 321 | IN | |
Dec 3, 2024 10:08:10.509001017 CET | 127 | OUT | |
Dec 3, 2024 10:08:10.838803053 CET | 321 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
1 | 192.168.2.5 | 49837 | 193.122.130.0 | 80 | 1292 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
Dec 3, 2024 10:08:13.334702015 CET | 127 | OUT | |
Dec 3, 2024 10:08:14.547318935 CET | 321 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
2 | 192.168.2.5 | 49848 | 193.122.130.0 | 80 | 1292 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
Dec 3, 2024 10:08:16.697962999 CET | 151 | OUT | |
Dec 3, 2024 10:08:18.319653988 CET | 321 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
3 | 192.168.2.5 | 49857 | 193.122.130.0 | 80 | 1292 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
Dec 3, 2024 10:08:20.811891079 CET | 151 | OUT | |
Dec 3, 2024 10:08:22.804289103 CET | 321 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
4 | 192.168.2.5 | 49869 | 193.122.130.0 | 80 | 1292 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
Dec 3, 2024 10:08:25.060040951 CET | 151 | OUT | |
Dec 3, 2024 10:08:26.832870960 CET | 321 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
5 | 192.168.2.5 | 49880 | 193.122.130.0 | 80 | 1292 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
Dec 3, 2024 10:08:29.235251904 CET | 151 | OUT | |
Dec 3, 2024 10:08:30.469878912 CET | 321 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
6 | 192.168.2.5 | 49890 | 193.122.130.0 | 80 | 1292 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
Dec 3, 2024 10:08:32.709659100 CET | 151 | OUT | |
Dec 3, 2024 10:08:33.899415016 CET | 321 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
7 | 192.168.2.5 | 49900 | 193.122.130.0 | 80 | 1292 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
Dec 3, 2024 10:08:36.050265074 CET | 151 | OUT | |
Dec 3, 2024 10:08:37.212111950 CET | 321 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
8 | 192.168.2.5 | 49909 | 193.122.130.0 | 80 | 1292 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
Dec 3, 2024 10:08:39.481106997 CET | 151 | OUT | |
Dec 3, 2024 10:08:40.669373989 CET | 321 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
9 | 192.168.2.5 | 49919 | 193.122.130.0 | 80 | 1292 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
Dec 3, 2024 10:08:42.873558998 CET | 151 | OUT | |
Dec 3, 2024 10:08:44.015513897 CET | 321 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
10 | 192.168.2.5 | 49927 | 193.122.130.0 | 80 | 1292 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
Dec 3, 2024 10:08:46.196389914 CET | 151 | OUT | |
Dec 3, 2024 10:08:47.381109953 CET | 321 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
11 | 192.168.2.5 | 49938 | 193.122.130.0 | 80 | 1292 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
Dec 3, 2024 10:08:49.702931881 CET | 151 | OUT | |
Dec 3, 2024 10:08:51.071820974 CET | 321 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
12 | 192.168.2.5 | 49947 | 193.122.130.0 | 80 | 1292 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
Dec 3, 2024 10:08:53.246826887 CET | 151 | OUT | |
Dec 3, 2024 10:08:54.447940111 CET | 321 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
13 | 192.168.2.5 | 49957 | 193.122.130.0 | 80 | 1292 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
Dec 3, 2024 10:08:56.577637911 CET | 151 | OUT | |
Dec 3, 2024 10:08:57.719907045 CET | 321 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
14 | 192.168.2.5 | 49966 | 193.122.130.0 | 80 | 1292 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
Dec 3, 2024 10:08:59.894996881 CET | 151 | OUT | |
Dec 3, 2024 10:09:01.097229958 CET | 321 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
0 | 192.168.2.5 | 49785 | 172.217.19.174 | 443 | 1292 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-12-03 09:07:54 UTC | 216 | OUT | |
2024-12-03 09:07:54 UTC | 1920 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
1 | 192.168.2.5 | 49793 | 142.250.181.33 | 443 | 1292 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-12-03 09:07:57 UTC | 258 | OUT | |
2024-12-03 09:07:59 UTC | 4915 | IN | |
2024-12-03 09:07:59 UTC | 4915 | IN | |
2024-12-03 09:07:59 UTC | 4872 | IN | |
2024-12-03 09:07:59 UTC | 1318 | IN | |
2024-12-03 09:07:59 UTC | 1390 | IN | |
2024-12-03 09:07:59 UTC | 1390 | IN | |
2024-12-03 09:07:59 UTC | 1390 | IN | |
2024-12-03 09:07:59 UTC | 1390 | IN | |
2024-12-03 09:07:59 UTC | 1390 | IN | |
2024-12-03 09:07:59 UTC | 1390 | IN | |
2024-12-03 09:07:59 UTC | 1390 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
2 | 192.168.2.5 | 49814 | 172.67.177.134 | 443 | 1292 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-12-03 09:08:04 UTC | 85 | OUT | |
2024-12-03 09:08:05 UTC | 879 | IN | |
2024-12-03 09:08:05 UTC | 362 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
3 | 192.168.2.5 | 49831 | 149.154.167.220 | 443 | 1292 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-12-03 09:08:12 UTC | 296 | OUT | |
2024-12-03 09:08:12 UTC | 1090 | OUT | |
2024-12-03 09:08:13 UTC | 388 | IN | |
2024-12-03 09:08:13 UTC | 544 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
4 | 192.168.2.5 | 49842 | 149.154.167.220 | 443 | 1292 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-12-03 09:08:15 UTC | 296 | OUT | |
2024-12-03 09:08:15 UTC | 1090 | OUT | |
2024-12-03 09:08:16 UTC | 388 | IN | |
2024-12-03 09:08:16 UTC | 541 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
5 | 192.168.2.5 | 49851 | 149.154.167.220 | 443 | 1292 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-12-03 09:08:19 UTC | 272 | OUT | |
2024-12-03 09:08:19 UTC | 1090 | OUT | |
2024-12-03 09:08:20 UTC | 388 | IN | |
2024-12-03 09:08:20 UTC | 541 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
6 | 192.168.2.5 | 49864 | 149.154.167.220 | 443 | 1292 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-12-03 09:08:24 UTC | 296 | OUT | |
2024-12-03 09:08:24 UTC | 1090 | OUT | |
2024-12-03 09:08:24 UTC | 388 | IN | |
2024-12-03 09:08:24 UTC | 541 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
7 | 192.168.2.5 | 49874 | 149.154.167.220 | 443 | 1292 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-12-03 09:08:28 UTC | 296 | OUT | |
2024-12-03 09:08:28 UTC | 1090 | OUT | |
2024-12-03 09:08:29 UTC | 388 | IN | |
2024-12-03 09:08:29 UTC | 541 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
8 | 192.168.2.5 | 49885 | 149.154.167.220 | 443 | 1292 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-12-03 09:08:31 UTC | 296 | OUT | |
2024-12-03 09:08:31 UTC | 1090 | OUT | |
2024-12-03 09:08:32 UTC | 388 | IN | |
2024-12-03 09:08:32 UTC | 541 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
9 | 192.168.2.5 | 49894 | 149.154.167.220 | 443 | 1292 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-12-03 09:08:35 UTC | 296 | OUT | |
2024-12-03 09:08:35 UTC | 1090 | OUT | |
2024-12-03 09:08:35 UTC | 388 | IN | |
2024-12-03 09:08:35 UTC | 541 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
10 | 192.168.2.5 | 49903 | 149.154.167.220 | 443 | 1292 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-12-03 09:08:38 UTC | 296 | OUT | |
2024-12-03 09:08:38 UTC | 1090 | OUT | |
2024-12-03 09:08:39 UTC | 388 | IN | |
2024-12-03 09:08:39 UTC | 541 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
11 | 192.168.2.5 | 49913 | 149.154.167.220 | 443 | 1292 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-12-03 09:08:42 UTC | 296 | OUT | |
2024-12-03 09:08:42 UTC | 1090 | OUT | |
2024-12-03 09:08:42 UTC | 388 | IN | |
2024-12-03 09:08:42 UTC | 541 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
12 | 192.168.2.5 | 49922 | 149.154.167.220 | 443 | 1292 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-12-03 09:08:45 UTC | 296 | OUT | |
2024-12-03 09:08:45 UTC | 1090 | OUT | |
2024-12-03 09:08:46 UTC | 388 | IN | |
2024-12-03 09:08:46 UTC | 541 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
13 | 192.168.2.5 | 49933 | 149.154.167.220 | 443 | 1292 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-12-03 09:08:48 UTC | 296 | OUT | |
2024-12-03 09:08:48 UTC | 1090 | OUT | |
2024-12-03 09:08:49 UTC | 388 | IN | |
2024-12-03 09:08:49 UTC | 540 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
14 | 192.168.2.5 | 49942 | 149.154.167.220 | 443 | 1292 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-12-03 09:08:52 UTC | 296 | OUT | |
2024-12-03 09:08:52 UTC | 1090 | OUT | |
2024-12-03 09:08:53 UTC | 388 | IN | |
2024-12-03 09:08:53 UTC | 541 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
15 | 192.168.2.5 | 49951 | 149.154.167.220 | 443 | 1292 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-12-03 09:08:55 UTC | 296 | OUT | |
2024-12-03 09:08:55 UTC | 1090 | OUT | |
2024-12-03 09:08:56 UTC | 388 | IN | |
2024-12-03 09:08:56 UTC | 541 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
16 | 192.168.2.5 | 49961 | 149.154.167.220 | 443 | 1292 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-12-03 09:08:59 UTC | 296 | OUT | |
2024-12-03 09:08:59 UTC | 1090 | OUT | |
2024-12-03 09:08:59 UTC | 388 | IN | |
2024-12-03 09:08:59 UTC | 541 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
17 | 192.168.2.5 | 49970 | 149.154.167.220 | 443 | 1292 | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-12-03 09:09:03 UTC | 296 | OUT | |
2024-12-03 09:09:03 UTC | 1090 | OUT | |
2024-12-03 09:09:04 UTC | 388 | IN | |
2024-12-03 09:09:04 UTC | 541 | IN |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
Target ID: | 0 |
Start time: | 04:06:54 |
Start date: | 03/12/2024 |
Path: | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
Wow64 process (32bit): | true |
Commandline: | |
Imagebase: | 0x400000 |
File size: | 746'748 bytes |
MD5 hash: | 09B9BEEBDA4769C102CB42A564EF2001 |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Yara matches: |
|
Reputation: | low |
Has exited: | true |
Target ID: | 4 |
Start time: | 04:07:44 |
Start date: | 03/12/2024 |
Path: | C:\Users\user\Desktop\Bank Swift and SOA PRN0072003410853_pdf.exe |
Wow64 process (32bit): | true |
Commandline: | |
Imagebase: | 0x400000 |
File size: | 746'748 bytes |
MD5 hash: | 09B9BEEBDA4769C102CB42A564EF2001 |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Yara matches: |
|
Reputation: | low |
Has exited: | false |
Execution Graph
Execution Coverage: | 20.1% |
Dynamic/Decrypted Code Coverage: | 15.2% |
Signature Coverage: | 18.9% |
Total number of Nodes: | 1510 |
Total number of Limit Nodes: | 45 |
Graph
Function 0040335A Relevance: 75.6, APIs: 27, Strings: 16, Instructions: 335stringfilecomCOMMON
Control-flow Graph
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00404B10 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON
Control-flow Graph
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00405F0C Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 207stringCOMMON
Control-flow Graph
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00405772 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148filestringCOMMON
Control-flow Graph
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040653F Relevance: 5.4, APIs: 4, Instructions: 382COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004038B4 Relevance: 49.2, APIs: 15, Strings: 13, Instructions: 216stringregistrylibraryCOMMON
Control-flow Graph
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Control-flow Graph
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00402DBC Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 203memoryCOMMON
Control-flow Graph
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00401752 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145stringtimeCOMMON
Control-flow Graph
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00402573 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 142fileCOMMON
Control-flow Graph
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040317D Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 108fileCOMMON
Control-flow Graph
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00402331 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71registrystringCOMMON
Control-flow Graph
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Control-flow Graph
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Control-flow Graph
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Control-flow Graph
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Control-flow Graph
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00405108 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00405665 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00406974 Relevance: 5.2, APIs: 4, Instructions: 236COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00406B75 Relevance: 5.2, APIs: 4, Instructions: 208COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040688B Relevance: 5.2, APIs: 4, Instructions: 205COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00406390 Relevance: 5.2, APIs: 4, Instructions: 198COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004067DE Relevance: 5.2, APIs: 4, Instructions: 180COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004068FC Relevance: 5.2, APIs: 4, Instructions: 170COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00406848 Relevance: 5.2, APIs: 4, Instructions: 168COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00401F98 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00401B22 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 10002868 Relevance: 3.2, APIs: 2, Instructions: 156COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00401DC7 Relevance: 3.0, APIs: 2, Instructions: 21COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00405B56 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004026F9 Relevance: 1.5, APIs: 1, Instructions: 26COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00402253 Relevance: 1.5, APIs: 1, Instructions: 25COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00401718 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00405BD9 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 1000278D Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00404164 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040330F Relevance: 1.5, APIs: 1, Instructions: 6COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 1000121B Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004052D3 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282windowclipboardmemoryCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004045CA Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 269stringCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00402770 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004042CC Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 207windowstringCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00405C08 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 136stringmemoryfileCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004024EE Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 54filestringCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00404196 Relevance: 12.1, APIs: 8, Instructions: 61COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00404A5E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00402C7F Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 1000248D Relevance: 9.1, APIs: 6, Instructions: 108COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 100018C1 Relevance: 7.7, APIs: 5, Instructions: 190COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 10001617 Relevance: 7.5, APIs: 5, Instructions: 41memorylibraryloaderCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00401CE5 Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00401D41 Relevance: 7.5, APIs: 5, Instructions: 38COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00404978 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78stringCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00401BCA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00405DB7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45registryCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00405935 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00401F08 Relevance: 6.1, APIs: 4, Instructions: 55memoryCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00405981 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 100010E1 Relevance: 5.1, APIs: 4, Instructions: 104memoryCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00405ABB Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Execution Graph
Execution Coverage: | 11.7% |
Dynamic/Decrypted Code Coverage: | 100% |
Signature Coverage: | 3.6% |
Total number of Nodes: | 196 |
Total number of Limit Nodes: | 16 |
Graph
Function 388FE628 Relevance: 2.0, Strings: 1, Instructions: 764COMMON
Strings |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 378998D0 Relevance: 2.0, Strings: 1, Instructions: 758COMMON
Strings |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 388FD478 Relevance: 1.9, APIs: 1, Instructions: 396COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 37896130 Relevance: .7, Instructions: 709COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 3787A928 Relevance: .3, Instructions: 296COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 3787F3F8 Relevance: .3, Instructions: 268COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000DE6A8 Relevance: .3, Instructions: 268COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000DEC58 Relevance: .2, Instructions: 228COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 378977F0 Relevance: .2, Instructions: 219COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 37897E40 Relevance: .2, Instructions: 219COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 37898490 Relevance: .2, Instructions: 218COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 378971A8 Relevance: .2, Instructions: 218COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000DEFAF Relevance: .2, Instructions: 202COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 37899568 Relevance: .2, Instructions: 194COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 37896121 Relevance: .2, Instructions: 167COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 37898481 Relevance: .2, Instructions: 164COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 388FF176 Relevance: .2, Instructions: 154COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 378977E0 Relevance: .1, Instructions: 108COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 37897E30 Relevance: .1, Instructions: 106COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 388F0608 Relevance: 6.1, APIs: 4, Instructions: 128threadCOMMON
Control-flow Graph
APIs |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 3789B028 Relevance: 3.9, Strings: 3, Instructions: 151COMMON
Control-flow Graph
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000DFD4F Relevance: 1.6, APIs: 1, Instructions: 115COMMON
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000DFD8C Relevance: 1.6, APIs: 1, Instructions: 115COMMON
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000DFD98 Relevance: 1.6, APIs: 1, Instructions: 113COMMON
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 388F14E4 Relevance: 1.6, APIs: 1, Instructions: 97COMMON
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 388F0849 Relevance: 1.6, APIs: 1, Instructions: 65COMMON
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 388F0850 Relevance: 1.6, APIs: 1, Instructions: 62COMMON
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 388FC4BC Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 388FC410 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 388F1CB8 Relevance: 1.5, APIs: 1, Instructions: 45timeCOMMON
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 388FD258 Relevance: 1.5, APIs: 1, Instructions: 45comCOMMON
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 388F1CC0 Relevance: 1.5, APIs: 1, Instructions: 44timeCOMMON
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 388FE560 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 37899C55 Relevance: .3, Instructions: 322COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 37899C53 Relevance: .3, Instructions: 319COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 3789F0E1 Relevance: .2, Instructions: 248COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 3789E9B0 Relevance: .2, Instructions: 189COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 37899FAF Relevance: .2, Instructions: 155COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 37895400 Relevance: .1, Instructions: 147COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 3789DB00 Relevance: .1, Instructions: 146COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 3789A709 Relevance: .1, Instructions: 144COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 3789AA10 Relevance: .1, Instructions: 93COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 3789FE40 Relevance: .1, Instructions: 90COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 3789AA48 Relevance: .1, Instructions: 88COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 3789E99F Relevance: .1, Instructions: 85COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 3789AA39 Relevance: .1, Instructions: 77COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 378953F0 Relevance: .1, Instructions: 76COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000AD030 Relevance: .1, Instructions: 72COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 37899498 Relevance: .1, Instructions: 61COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 378994A8 Relevance: .1, Instructions: 56COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 000AD02B Relevance: .1, Instructions: 53COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 3789DAE4 Relevance: .0, Instructions: 50COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 3789DEFC Relevance: .0, Instructions: 49COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 3789FEA1 Relevance: .0, Instructions: 43COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 3789A931 Relevance: .0, Instructions: 42COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 3789A940 Relevance: .0, Instructions: 39COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 378970C8 Relevance: .0, Instructions: 39COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 3789AFA8 Relevance: .0, Instructions: 37COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 378970E8 Relevance: .0, Instructions: 35COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 37899879 Relevance: .0, Instructions: 23COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 37896F19 Relevance: .0, Instructions: 19COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 3789AB75 Relevance: .0, Instructions: 19COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 378970B8 Relevance: .0, Instructions: 15COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 37899828 Relevance: .0, Instructions: 13COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 37896F94 Relevance: .0, Instructions: 12COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00404B10 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040335A Relevance: 63.3, APIs: 27, Strings: 9, Instructions: 335stringfilecomCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00405772 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 148filestringCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 37898AD8 Relevance: 11.7, Strings: 9, Instructions: 461COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 37898ACA Relevance: 11.6, Strings: 9, Instructions: 365COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040653F Relevance: 5.4, APIs: 4, Instructions: 382COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 37895632 Relevance: 1.9, Strings: 1, Instructions: 601COMMON
Strings |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 3787EFA0 Relevance: .3, Instructions: 268COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 378797C8 Relevance: .3, Instructions: 268COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 3787C1D0 Relevance: .3, Instructions: 268COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 3787D330 Relevance: .3, Instructions: 268COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 3787EB48 Relevance: .3, Instructions: 268COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 37879370 Relevance: .3, Instructions: 268COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 3787BD78 Relevance: .3, Instructions: 268COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 3787CA80 Relevance: .3, Instructions: 268COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 3787A4D0 Relevance: .3, Instructions: 268COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 3787CED8 Relevance: .3, Instructions: 268COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 3787E6F0 Relevance: .3, Instructions: 268COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 37879C20 Relevance: .3, Instructions: 268COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 3787C628 Relevance: .3, Instructions: 268COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 3787F850 Relevance: .3, Instructions: 268COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 3787A078 Relevance: .3, Instructions: 268COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 37894FA8 Relevance: .3, Instructions: 268COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 37891EA8 Relevance: .3, Instructions: 268COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 378946F8 Relevance: .3, Instructions: 268COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 37893E48 Relevance: .3, Instructions: 268COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 37893598 Relevance: .3, Instructions: 268COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 378915F8 Relevance: .3, Instructions: 268COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 37890D48 Relevance: .3, Instructions: 268COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 37890498 Relevance: .3, Instructions: 268COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 37892CE8 Relevance: .3, Instructions: 268COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 37892300 Relevance: .3, Instructions: 268COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 37894B50 Relevance: .3, Instructions: 268COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 378942A0 Relevance: .3, Instructions: 268COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 37891A50 Relevance: .3, Instructions: 268COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 378911A0 Relevance: .3, Instructions: 268COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 378939F0 Relevance: .3, Instructions: 268COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 37893140 Relevance: .3, Instructions: 268COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 37892890 Relevance: .3, Instructions: 268COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 378908F0 Relevance: .3, Instructions: 268COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 37890040 Relevance: .3, Instructions: 268COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 388FF438 Relevance: .0, Instructions: 18COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 3789A6C7 Relevance: .0, Instructions: 17COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004052D3 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282windowclipboardmemoryCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004038B4 Relevance: 40.5, APIs: 15, Strings: 8, Instructions: 216stringregistrylibraryCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004042CC Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 207windowstringCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00405C08 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 136stringmemoryfileCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004045CA Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 269stringCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00402DBC Relevance: 19.5, APIs: 5, Strings: 6, Instructions: 203memoryCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00405F0C Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 207stringCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00404196 Relevance: 12.1, APIs: 8, Instructions: 61COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00402573 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 142fileCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00404A5E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00402C7F Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040317D Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 108fileCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004024EE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54filestringCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00401CE5 Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00401D41 Relevance: 7.5, APIs: 5, Instructions: 38COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00404978 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78stringCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00401BCA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004015B9 Relevance: 6.1, APIs: 4, Instructions: 57COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00401F08 Relevance: 6.1, APIs: 4, Instructions: 55memoryCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00405108 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00405665 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00406974 Relevance: 5.2, APIs: 4, Instructions: 236COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00406B75 Relevance: 5.2, APIs: 4, Instructions: 208COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040688B Relevance: 5.2, APIs: 4, Instructions: 205COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00406390 Relevance: 5.2, APIs: 4, Instructions: 198COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004067DE Relevance: 5.2, APIs: 4, Instructions: 180COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004068FC Relevance: 5.2, APIs: 4, Instructions: 170COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00406848 Relevance: 5.2, APIs: 4, Instructions: 168COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00405ABB Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|