Edit tour
Windows
Analysis Report
beNxougDFV.exe
Overview
General Information
| Sample name: | beNxougDFV.exerenamed because original name is a hash value |
| Original sample name: | 3468b04eea8016136fe8dc5b259c22cf2088b3faa4b41f52f54ade1f0cb5078f.exe |
| Analysis ID: | 1567517 |
| MD5: | 8a678142d7d4bd32f67a17757cc896a0 |
| SHA1: | fa2ca787bbd87d95fba79851e1aba0000b9cfd8c |
| SHA256: | 3468b04eea8016136fe8dc5b259c22cf2088b3faa4b41f52f54ade1f0cb5078f |
| Tags: | exeGuLoaderuser-adrian__luca |
| Infos: |   |
 | |
Detection
GuLoader
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Early bird code injection technique detected
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected GuLoader
AI detected suspicious sample
Found suspicious powershell code related to unpacking or dynamic code loading
Loading BitLocker PowerShell Module
Powershell drops PE file
Queues an APC in another process (thread injection)
Suspicious powershell command line found
Writes to foreign memory regions
Abnormal high CPU Usage
Contains functionality for read data from the clipboard
Contains functionality to shutdown / reboot the system
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Msiexec Initiated Connection
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Classification
- System is w10x64
beNxougDFV.exe (PID: 7728 cmdline: "C:\Users\ user\Deskt op\beNxoug DFV.exe" MD5: 8A678142D7D4BD32F67A17757CC896A0) 
powershell.exe (PID: 1352 cmdline: "powershel l.exe" -wi ndowstyle hidden "$G oniac=Get- Content -r aw 'C:\Use rs\user\Ap pData\Loca l\unshabbi ly\Special effektens. San246';$F loragrafer edes=$Goni ac.SubStri ng(53737,3 );.$Florag raferedes( $Goniac)" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC) 
conhost.exe (PID: 6716 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
msiexec.exe (PID: 7252 cmdline: "C:\Window s\SysWOW64 \msiexec.e xe" MD5: 9D09DC1EDA745A5F87553048E57620CF)
- cleanup
| Name | Description | Attribution | Blogpost URLs | Link |
|---|---|---|---|---|
| CloudEyE, GuLoader | CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored. | No Attribution |
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_GuLoader_2 | Yara detected GuLoader | Joe Security |
System Summary |   |
|---|
| Source: | Author: frack113: | ||
| Source: | Author: frack113, Nasreddine Bencherchali (Nextron Systems): | ||
| Source: | Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): | ||
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2024-12-03T16:42:16.487474+0100 | 2803270 | 2 | Potentially Bad Traffic | 192.168.2.10 | 49893 | 172.217.19.174 | 443 | TCP |
Click to jump to signature section
Show All Signature Results
AV Detection | |
|---|
| Source: | Avira: | ||
| Source: | Avira: | ||
| Source: | ReversingLabs: | ||
| Source: | ReversingLabs: | ||
| Source: | Integrated Neural Analysis Model: | ||
| Source: | Static PE information: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Static PE information: | ||
| Source: | Code function: | 0_2_00406232 | |
| Source: | Code function: | 0_2_004056F7 | |
| Source: | Code function: | 0_2_004026F8 | |
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | JA3 fingerprint: | ||
| Source: | Suricata IDS: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Code function: | 0_2_00405194 | |
System Summary | |
|---|
| Source: | File created: | Jump to dropped file | ||
| Source: | Process Stats: | ||
| Source: | Code function: | 0_2_004031BB | |
| Source: | Code function: | 0_2_004049D3 | |
| Source: | Code function: | 0_2_004065BB | |
| Source: | Static PE information: | ||
| Source: | Classification label: | ||
| Source: | Code function: | 0_2_004031BB | |
| Source: | Code function: | 0_2_00404460 | |
| Source: | Code function: | 0_2_004020CB | |
| Source: | File created: | Jump to behavior | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | WMI Queries: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | ReversingLabs: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Key value queried: | Jump to behavior | ||
| Source: | Window detected: | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Static PE information: | ||
Data Obfuscation | |
|---|
| Source: | File source: | ||
| Source: | Anti Malware Scan Interface: | ||
| Source: | Anti Malware Scan Interface: | ||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
Hooking and other Techniques for Hiding and Protection | |
|---|
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Last function: | ||
| Source: | Code function: | 0_2_00406232 | |
| Source: | Code function: | 0_2_004056F7 | |
| Source: | Code function: | 0_2_004026F8 | |
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | API call chain: | graph_0-3539 | ||
| Source: | API call chain: | graph_0-3541 | ||
| Source: | Process information queried: | Jump to behavior | ||
| Source: | Process token adjusted: | Jump to behavior | ||
HIPS / PFW / Operating System Protection Evasion | |
|---|
| Source: | Process created / APC Queued / Resumed: | Jump to behavior | ||
| Source: | Thread APC queued: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Code function: | 0_2_004031BB | |
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | 1 Windows Management Instrumentation | 1 DLL Side-Loading | 1 Access Token Manipulation | 1 Masquerading | OS Credential Dumping | 11 Security Software Discovery | Remote Services | 1 Archive Collected Data | 11 Encrypted Channel | Exfiltration Over Other Network Medium | 1 System Shutdown/Reboot |
| Credentials | Domains | Default Accounts | 2 PowerShell | Boot or Logon Initialization Scripts | 311 Process Injection | 21 Virtualization/Sandbox Evasion | LSASS Memory | 1 Process Discovery | Remote Desktop Protocol | 1 Clipboard Data | 3 Ingress Tool Transfer | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | 1 DLL Side-Loading | 1 Access Token Manipulation | Security Account Manager | 21 Virtualization/Sandbox Evasion | SMB/Windows Admin Shares | Data from Network Shared Drive | 3 Non-Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | 311 Process Injection | NTDS | 1 Application Window Discovery | Distributed Component Object Model | Input Capture | 14 Application Layer Protocol | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | Network Logon Script | 1 Software Packing | LSA Secrets | 3 File and Directory Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
| Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | 1 DLL Side-Loading | Cached Domain Credentials | 14 System Information Discovery | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 50% | ReversingLabs | Win32.Spyware.Snakekeylogger | ||
| 100% | Avira | TR/AVI.Agent.ennqy |
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 100% | Avira | TR/AVI.Agent.ennqy | ||
| 0% | ReversingLabs | |||
| 0% | ReversingLabs | |||
| 50% | ReversingLabs | Win32.Spyware.Snakekeylogger |
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | Avira URL Cloud | safe |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| drive.google.com | 172.217.19.174 | true | false | high | |
| drive.usercontent.google.com | 142.250.181.1 | true | false | high | |
| s-part-0035.t-0009.t-msedge.net | 13.107.246.63 | true | false | high |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 142.250.181.1 | drive.usercontent.google.com | United States | 15169 | GOOGLEUS | false | |
| 172.217.19.174 | drive.google.com | United States | 15169 | GOOGLEUS | false |
| Joe Sandbox version: | 41.0.0 Charoite |
| Analysis ID: | 1567517 |
| Start date and time: | 2024-12-03 16:39:45 +01:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 5m 47s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 10 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | beNxougDFV.exerenamed because original name is a hash value |
| Original Sample Name: | 3468b04eea8016136fe8dc5b259c22cf2088b3faa4b41f52f54ade1f0cb5078f.exe |
| Detection: | MAL |
| Classification: | mal100.troj.evad.winEXE@6/14@2/2 |
| EGA Information: |
|
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
- Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, ctldl.windowsupdate.com, azureedge-t-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
- Not all processes where analyzed, report is missing behavior information
- Report size getting too big, too many NtOpenKeyEx calls found.
- VT rate limit hit for: beNxougDFV.exe
| Time | Type | Description |
|---|---|---|
| 10:40:45 | API Interceptor | |
| 10:42:18 | API Interceptor |
⊘No context
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| s-part-0035.t-0009.t-msedge.net | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | ScreenConnect Tool | Browse |
| ||
| Get hash | malicious | ScreenConnect Tool | Browse |
| ||
| Get hash | malicious | ScreenConnect Tool | Browse |
| ||
| Get hash | malicious | Stealc, Vidar | Browse |
| ||
| Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
| Get hash | malicious | Quasar | Browse |
|
⊘No context
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 37f463bf4616ecd445d4a1937da06e19 | Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| |
| Get hash | malicious | Stealc, Vidar | Browse |
| ||
| Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
| Get hash | malicious | GuLoader, MassLogger RAT | Browse |
| ||
| Get hash | malicious | GuLoader, MassLogger RAT | Browse |
| ||
| Get hash | malicious | DarkCloud | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Remcos | Browse |
| ||
| Get hash | malicious | GuLoader, Snake Keylogger, VIP Keylogger | Browse |
|
⊘No context
| Process: | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | modified |
| Size (bytes): | 14744 |
| Entropy (8bit): | 4.992175361088568 |
| Encrypted: | false |
| SSDEEP: | 384:f1VoGIpN6KQkj2qkjh4iUxehQJKoxOdBMNXp5YYo0ib4J:f1V3IpNBQkj2Ph4iUxehIKoxOdBMNZiA |
| MD5: | A35685B2B980F4BD3C6FD278EA661412 |
| SHA1: | 59633ABADCBA9E0C0A4CD5AAE2DD4C15A3D9D062 |
| SHA-256: | 3E3592C4BA81DC975DF395058DAD01105B002B21FC794F9015A6E3810D1BF930 |
| SHA-512: | 70D130270CD7DB757958865C8F344872312372523628CB53BADE0D44A9727F9A3D51B18B41FB04C2552BCD18FAD6547B9FD0FA0B016583576A1F0F1A16CB52EC |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| Preview: |
| Process: | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 60 |
| Entropy (8bit): | 4.038920595031593 |
| Encrypted: | false |
| SSDEEP: | 3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX |
| MD5: | D17FE0A3F47BE24A6453E9EF58C94641 |
| SHA1: | 6AB83620379FC69F80C0242105DDFFD7D98D5D9D |
| SHA-256: | 96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 |
| SHA-512: | 5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82 |
| Malicious: | false |
| Reputation: | high, very likely benign file |
| Preview: |
| Process: | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 60 |
| Entropy (8bit): | 4.038920595031593 |
| Encrypted: | false |
| SSDEEP: | 3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX |
| MD5: | D17FE0A3F47BE24A6453E9EF58C94641 |
| SHA1: | 6AB83620379FC69F80C0242105DDFFD7D98D5D9D |
| SHA-256: | 96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 |
| SHA-512: | 5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82 |
| Malicious: | false |
| Reputation: | high, very likely benign file |
| Preview: |
| Process: | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 60 |
| Entropy (8bit): | 4.038920595031593 |
| Encrypted: | false |
| SSDEEP: | 3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX |
| MD5: | D17FE0A3F47BE24A6453E9EF58C94641 |
| SHA1: | 6AB83620379FC69F80C0242105DDFFD7D98D5D9D |
| SHA-256: | 96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 |
| SHA-512: | 5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82 |
| Malicious: | false |
| Preview: |
| Process: | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 60 |
| Entropy (8bit): | 4.038920595031593 |
| Encrypted: | false |
| SSDEEP: | 3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX |
| MD5: | D17FE0A3F47BE24A6453E9EF58C94641 |
| SHA1: | 6AB83620379FC69F80C0242105DDFFD7D98D5D9D |
| SHA-256: | 96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 |
| SHA-512: | 5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\beNxougDFV.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 4096 |
| Entropy (8bit): | 3.6614996787412575 |
| Encrypted: | false |
| SSDEEP: | 48:qYGZ0Gtq/oaPybCQ1hsIqXA1AfsgsfbLwGXwaEvRugYy/ImBmrm:wDAoyXAykgEUGAaGRuRm |
| MD5: | 245AC30568C8703531FC4E64B321BE16 |
| SHA1: | BADD01A31FC2B8CC050A1DC3489FC8F620C450F7 |
| SHA-256: | B91763928CE210BFC0A43B0AC1178D68CB95CFAD68439B25B55A53B7AA53B207 |
| SHA-512: | 9A81F2DE2CC41F6E35498B04B6327ADCFF268523F7B6A9EA9D5CFA1B2CF0425E59A121C99F0A0251C3380886CC058E88DE8A12B17E049D5FD5D7EEB0C956F083 |
| Malicious: | true |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\Desktop\beNxougDFV.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 4096 |
| Entropy (8bit): | 3.286321681873388 |
| Encrypted: | false |
| SSDEEP: | 48:qK64n2rZ4vuXXqQr1wH+zL/o0o/X/3MVyjlZSC15gaoFU:5P4ZxKQruHkJwvcVyV4FU |
| MD5: | 200E4D67E7A08D4C92F05E31442095FE |
| SHA1: | 1D0492FDFB7C0C8799AEA7982DA8B4EFEDE7581B |
| SHA-256: | 01D867E3A1F0AEC39A4FF02FE9FAFEFC78D6A12390A0DA8ECBF4E7DA5379E42E |
| SHA-512: | 620AB7A94E4EE965C159CC1A5F2ADC2CC6616CFB738EA191EAB404B249D21DD19134A314A21315F4EE2C0A75FD5062D1BF353BB75B877A61171F27F4A87CF995 |
| Malicious: | true |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\Desktop\beNxougDFV.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 335979 |
| Entropy (8bit): | 7.680216708925065 |
| Encrypted: | false |
| SSDEEP: | 6144:pFnU6YwkPOdnMEuUukgKRSTZT/r8HBMXP0wdzSJxQ26r6flmR:XnU6kPWnnufHTleesAGPQ26GI |
| MD5: | 22AB1C8AF9B0182D04C2132E8DA05E20 |
| SHA1: | 7F8CD8FADB2C237F9BCC49AF0069F393BF4EC00E |
| SHA-256: | FF30CB42A7D88083FF271CCA11B91EA49A068290574FA2A747FAAD2983C67B03 |
| SHA-512: | A93FAA646B40E03F93DC949E929F1EFF379297EF955707F54E497795CA761F7F6829EB4F6E9FE5957EE45E7751AD50D7A3B484F4913B6DF6572CAD24905EB4F9 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\beNxougDFV.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 53817 |
| Entropy (8bit): | 5.3212060511904475 |
| Encrypted: | false |
| SSDEEP: | 768:c3EX6pD/iqZmFsz70lMj3A/FS5oT1IQVzKqVUdSFGwRpuAjlp1zC5/wnR8wuRS:bKpmBF47EWA1TSiUdFGbzDSwgS |
| MD5: | BCA669516C5BD74FE622F79DF2A9262B |
| SHA1: | DEE0B74C6D95FFB819D47600D9943D8A9836E0EF |
| SHA-256: | FD76BAEB84CA420FA8F967D977808F09F1D73E758B8E6A134C605D6305B9B783 |
| SHA-512: | 4F7A9E77B711BC39E451D0756DF63A082F4A048DA545F1E781636AEC0281D54191F524BB74A8534EF4A7737EEB1BE0477F01C9EBC2543D5FD0CB3BE7981EEBD1 |
| Malicious: | true |
| Preview: |
| Process: | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 525906 |
| Entropy (8bit): | 7.6577197197827775 |
| Encrypted: | false |
| SSDEEP: | 12288:SpC1gNvzNkSObzXhVywoTWIuZ1n7JExZ0x1Odt3xD:eC1mxSzXYWIy1nm4MJ |
| MD5: | 8A678142D7D4BD32F67A17757CC896A0 |
| SHA1: | FA2CA787BBD87D95FBA79851E1ABA0000B9CFD8C |
| SHA-256: | 3468B04EEA8016136FE8DC5B259C22CF2088B3FAA4B41F52F54ADE1F0CB5078F |
| SHA-512: | 8A18BFED405CD281CA88C77E5B1282AA78374BD925DA48ED20BBAE944F15A7068EA84DF296A6F89AF71E12726BCED059DBE3BEEEDCCFC8D0EE7544B17169F397 |
| Malicious: | true |
| Antivirus: |
|
| Preview: |
| Process: | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 26 |
| Entropy (8bit): | 3.95006375643621 |
| Encrypted: | false |
| SSDEEP: | 3:ggPYV:rPYV |
| MD5: | 187F488E27DB4AF347237FE461A079AD |
| SHA1: | 6693BA299EC1881249D59262276A0D2CB21F8E64 |
| SHA-256: | 255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309 |
| SHA-512: | 89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E |
| Malicious: | true |
| Preview: |
| Process: | C:\Users\user\Desktop\beNxougDFV.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 134563 |
| Entropy (8bit): | 1.2420304589895552 |
| Encrypted: | false |
| SSDEEP: | 768:JTXI/LYa4cD2ujQzIsqIoMEJ8owrALEXMFrDwh0aHlC++KDTvfO/Ky:EnVS+r9brkwN/ |
| MD5: | E6066CC79780E021C55CDC3EF8FC82CC |
| SHA1: | FADDF02F672BEA8C3A766FB42F1FDC365934ED50 |
| SHA-256: | ED56062F4EA903C040602E4F50BB0F88A5E5DAC8F9F50A608D0495347C1003B8 |
| SHA-512: | 1F856CE5664BA5BC3914ACE73BDF0F0EBD419A5162890F9E7F66A9878DA9ACDDE9E24A42DDCE4ADAC7014F41F4C54977D9754DC867A9570B6A7BCAB757FC53F7 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\beNxougDFV.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 347357 |
| Entropy (8bit): | 1.2510537828861161 |
| Encrypted: | false |
| SSDEEP: | 768:7wNmQThgiCB7GJHZUFVJPaSenNvSIpJjRuermO9c3NMRzgJrawa1+VWzoIk33SnI:Agcs7GTR7EvgE |
| MD5: | 10C53FA2ADD5E04A7C257241470F8B30 |
| SHA1: | F280F7414C749DA2A84EAC4DF1AD18B623325CF8 |
| SHA-256: | E27733521BB45F4719C1FFFB5D0D9262E8BAA510C52E7EC880612464E5889685 |
| SHA-512: | CF23EA9FB2316C67A1AAA7DCEFD48728F9DBC17E2413867EBFEB443F2EE7CF0BCFCF00F2FAF094A56779FEAE27D14E7408D629E0DF4EF7A8D2CF4FAFA1EBF2D0 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\beNxougDFV.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 4242 |
| Entropy (8bit): | 1.1689000520156396 |
| Encrypted: | false |
| SSDEEP: | 24:3X9EQjC0f2xlR8XA8f+6mqZVN//sTqYiegGDXMTTO1zlvyQ:nbpexne/+UfNXsNiSCTOPvh |
| MD5: | 7F09DBB1E7A421C1C43B98C594A1F1EE |
| SHA1: | 5E541763EFD79D7005668B908BE438412E042CBD |
| SHA-256: | 20F7314F0A64579C20FFBAC8DE67F9D36FD4824F5C64DC01D89F5FF4908BCDC5 |
| SHA-512: | B901933CD173EDC42828FCC6CCA5B4A4BC29FD0F0ADD0AE08BE56BBF1D24781C542C8CE99142069287C976F6E8059D5ACD95FEA8D54427D9B02F74765352AAF5 |
| Malicious: | false |
| Preview: |
| File type: | |
| Entropy (8bit): | 7.6577197197827775 |
| TrID: |
|
| File name: | beNxougDFV.exe |
| File size: | 525'906 bytes |
| MD5: | 8a678142d7d4bd32f67a17757cc896a0 |
| SHA1: | fa2ca787bbd87d95fba79851e1aba0000b9cfd8c |
| SHA256: | 3468b04eea8016136fe8dc5b259c22cf2088b3faa4b41f52f54ade1f0cb5078f |
| SHA512: | 8a18bfed405cd281ca88c77e5b1282aa78374bd925da48ed20bbae944f15a7068ea84df296a6f89af71e12726bced059dbe3beeedccfc8d0ee7544b17169f397 |
| SSDEEP: | 12288:SpC1gNvzNkSObzXhVywoTWIuZ1n7JExZ0x1Odt3xD:eC1mxSzXYWIy1nm4MJ |
| TLSH: | 43B41262F79490E2C83A06B176A3CC312961792E47B162BF279437EE1466373490FE5F |
| File Content Preview: | MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(...F...F...F.*.....F...G.v.F.*.....F...v...F...@...F.Rich..F.........................PE..L...#.uY.................`......... |
 | |
| Icon Hash: | 246445471b4f0f1f |
| Entrypoint: | 0x4031bb |
| Entrypoint Section: | .text |
| Digitally signed: | false |
| Imagebase: | 0x400000 |
| Subsystem: | windows gui |
| Image File Characteristics: | RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE |
| DLL Characteristics: | DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x59759523 [Mon Jul 24 06:35:15 2017 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 4 |
| OS Version Minor: | 0 |
| File Version Major: | 4 |
| File Version Minor: | 0 |
| Subsystem Version Major: | 4 |
| Subsystem Version Minor: | 0 |
| Import Hash: | 3abe302b6d9a1256e6a915429af4ffd2 |
| Instruction |
|---|
| sub esp, 00000184h |
| push ebx |
| push esi |
| push edi |
| xor ebx, ebx |
| push 00008001h |
| mov dword ptr [esp+18h], ebx |
| mov dword ptr [esp+10h], 00409198h |
| mov dword ptr [esp+20h], ebx |
| mov byte ptr [esp+14h], 00000020h |
| call dword ptr [004070A0h] |
| call dword ptr [0040709Ch] |
| and eax, BFFFFFFFh |
| cmp ax, 00000006h |
| mov dword ptr [0042370Ch], eax |
| je 00007F2FCCAF13C3h |
| push ebx |
| call 00007F2FCCAF447Ah |
| cmp eax, ebx |
| je 00007F2FCCAF13B9h |
| push 00000C00h |
| call eax |
| mov esi, 00407298h |
| push esi |
| call 00007F2FCCAF43F6h |
| push esi |
| call dword ptr [00407098h] |
| lea esi, dword ptr [esi+eax+01h] |
| cmp byte ptr [esi], bl |
| jne 00007F2FCCAF139Dh |
| push 0000000Ah |
| call 00007F2FCCAF444Eh |
| push 00000008h |
| call 00007F2FCCAF4447h |
| push 00000006h |
| mov dword ptr [00423704h], eax |
| call 00007F2FCCAF443Bh |
| cmp eax, ebx |
| je 00007F2FCCAF13C1h |
| push 0000001Eh |
| call eax |
| test eax, eax |
| je 00007F2FCCAF13B9h |
| or byte ptr [0042370Fh], 00000040h |
| push ebp |
| call dword ptr [00407044h] |
| push ebx |
| call dword ptr [00407288h] |
| mov dword ptr [004237D8h], eax |
| push ebx |
| lea eax, dword ptr [esp+38h] |
| push 00000160h |
| push eax |
| push ebx |
| push 0041ECC8h |
| call dword ptr [00407178h] |
| push 00409188h |
| Programming Language: |
|
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0x7428 | 0xa0 | .rdata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x33000 | 0x15788 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x7000 | 0x298 | .rdata |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x5ed2 | 0x6000 | 9112619c91f32f6f8e4096e108712ebe | False | 0.6629638671875 | data | 6.442176588686321 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .rdata | 0x7000 | 0x1248 | 0x1400 | 1c9a524313c13059919ecf8195d205be | False | 0.4275390625 | data | 5.007650149182371 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .data | 0x9000 | 0x1a818 | 0x400 | 458aeaedc3eabb1f26ec1bbd666017ae | False | 0.6396484375 | data | 5.13585559284969 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .ndata | 0x24000 | 0xf000 | 0x0 | d41d8cd98f00b204e9800998ecf8427e | False | 0 | empty | 0.0 | IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .rsrc | 0x33000 | 0x15788 | 0x15800 | 40497017b2a1d5e01ad2b917ac12d1eb | False | 0.2589821039244186 | data | 4.486367209516884 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| RT_ICON | 0x332c8 | 0x10828 | Device independent bitmap graphic, 128 x 256 x 32, image size 67584 | English | United States | 0.21990713356204897 |
| RT_ICON | 0x43af0 | 0x25a8 | Device independent bitmap graphic, 48 x 96 x 32, image size 9600 | English | United States | 0.35072614107883815 |
| RT_ICON | 0x46098 | 0x10a8 | Device independent bitmap graphic, 32 x 64 x 32, image size 4224 | English | United States | 0.39094746716697937 |
| RT_ICON | 0x47140 | 0x988 | Device independent bitmap graphic, 24 x 48 x 32, image size 2400 | English | United States | 0.48811475409836064 |
| RT_ICON | 0x47ac8 | 0x468 | Device independent bitmap graphic, 16 x 32 x 32, image size 1088 | English | United States | 0.5523049645390071 |
| RT_DIALOG | 0x47f30 | 0x100 | data | English | United States | 0.5234375 |
| RT_DIALOG | 0x48030 | 0x11c | data | English | United States | 0.6056338028169014 |
| RT_DIALOG | 0x48150 | 0xc4 | data | English | United States | 0.5918367346938775 |
| RT_DIALOG | 0x48218 | 0x60 | data | English | United States | 0.7291666666666666 |
| RT_GROUP_ICON | 0x48278 | 0x4c | data | English | United States | 0.8157894736842105 |
| RT_VERSION | 0x482c8 | 0x180 | data | English | United States | 0.5859375 |
| RT_MANIFEST | 0x48448 | 0x33e | XML 1.0 document, ASCII text, with very long lines (830), with no line terminators | English | United States | 0.5542168674698795 |
| DLL | Import |
|---|---|
| KERNEL32.dll | GetTempPathA, GetFileSize, GetModuleFileNameA, GetCurrentProcess, CopyFileA, ExitProcess, SetEnvironmentVariableA, Sleep, GetTickCount, GetCommandLineA, lstrlenA, GetVersion, SetErrorMode, lstrcpynA, GetDiskFreeSpaceA, GlobalUnlock, GetWindowsDirectoryA, SetCurrentDirectoryA, GetLastError, CreateDirectoryA, CreateProcessA, RemoveDirectoryA, CreateFileA, GetTempFileNameA, ReadFile, WriteFile, lstrcpyA, MoveFileExA, lstrcatA, GetSystemDirectoryA, GetProcAddress, GetExitCodeProcess, WaitForSingleObject, CompareFileTime, SetFileAttributesA, GetFileAttributesA, GetShortPathNameA, MoveFileA, GetFullPathNameA, SetFileTime, SearchPathA, CloseHandle, lstrcmpiA, CreateThread, GlobalLock, lstrcmpA, FindFirstFileA, FindNextFileA, DeleteFileA, SetFilePointer, GetPrivateProfileStringA, FindClose, MultiByteToWideChar, FreeLibrary, MulDiv, WritePrivateProfileStringA, LoadLibraryExA, GetModuleHandleA, GlobalAlloc, GlobalFree, ExpandEnvironmentStringsA |
| USER32.dll | ScreenToClient, GetSystemMenu, SetClassLongA, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongA, SetCursor, LoadCursorA, CheckDlgButton, GetMessagePos, LoadBitmapA, CallWindowProcA, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, PostQuitMessage, GetWindowRect, EnableMenuItem, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxIndirectA, CharPrevA, DispatchMessageA, PeekMessageA, ReleaseDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, DrawTextA, EndDialog, RegisterClassA, SystemParametersInfoA, CreateWindowExA, GetClassInfoA, DialogBoxParamA, CharNextA, ExitWindowsEx, GetDC, CreateDialogParamA, SetTimer, GetDlgItem, SetWindowLongA, SetForegroundWindow, LoadImageA, IsWindow, SendMessageTimeoutA, FindWindowExA, OpenClipboard, TrackPopupMenu, AppendMenuA, EndPaint, DestroyWindow, wsprintfA, ShowWindow, SetWindowTextA |
| GDI32.dll | SelectObject, SetBkMode, CreateFontIndirectA, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor |
| SHELL32.dll | SHGetSpecialFolderLocation, ShellExecuteExA, SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, SHFileOperationA |
| ADVAPI32.dll | AdjustTokenPrivileges, RegCreateKeyExA, RegOpenKeyExA, SetFileSecurityA, OpenProcessToken, LookupPrivilegeValueA, RegEnumValueA, RegDeleteKeyA, RegDeleteValueA, RegCloseKey, RegSetValueExA, RegQueryValueExA, RegEnumKeyA |
| COMCTL32.dll | ImageList_Create, ImageList_AddMasked, ImageList_Destroy |
| ole32.dll | OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance |
| Language of compilation system | Country where language is spoken | Map |
|---|---|---|
| English | United States |  |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | SID | Signature | Severity | Source IP | Source Port | Dest IP | Dest Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2024-12-03T16:42:16.487474+0100 | 2803270 | ETPRO MALWARE Common Downloader Header Pattern UHCa | 2 | 192.168.2.10 | 49893 | 172.217.19.174 | 443 | TCP |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Dec 3, 2024 16:42:13.743913889 CET | 49893 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:13.743974924 CET | 443 | 49893 | 172.217.19.174 | 192.168.2.10 |
| Dec 3, 2024 16:42:13.744086981 CET | 49893 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:13.819861889 CET | 49893 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:13.819906950 CET | 443 | 49893 | 172.217.19.174 | 192.168.2.10 |
| Dec 3, 2024 16:42:15.580040932 CET | 443 | 49893 | 172.217.19.174 | 192.168.2.10 |
| Dec 3, 2024 16:42:15.580146074 CET | 49893 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:15.580926895 CET | 443 | 49893 | 172.217.19.174 | 192.168.2.10 |
| Dec 3, 2024 16:42:15.580996037 CET | 49893 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:15.650480986 CET | 49893 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:15.650521994 CET | 443 | 49893 | 172.217.19.174 | 192.168.2.10 |
| Dec 3, 2024 16:42:15.650881052 CET | 443 | 49893 | 172.217.19.174 | 192.168.2.10 |
| Dec 3, 2024 16:42:15.650938988 CET | 49893 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:15.653364897 CET | 49893 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:15.695347071 CET | 443 | 49893 | 172.217.19.174 | 192.168.2.10 |
| Dec 3, 2024 16:42:16.487474918 CET | 443 | 49893 | 172.217.19.174 | 192.168.2.10 |
| Dec 3, 2024 16:42:16.487632036 CET | 49893 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:16.487663031 CET | 443 | 49893 | 172.217.19.174 | 192.168.2.10 |
| Dec 3, 2024 16:42:16.487715960 CET | 49893 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:16.487793922 CET | 49893 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:16.487835884 CET | 443 | 49893 | 172.217.19.174 | 192.168.2.10 |
| Dec 3, 2024 16:42:16.487884998 CET | 49893 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:16.646388054 CET | 49902 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:16.646445036 CET | 443 | 49902 | 142.250.181.1 | 192.168.2.10 |
| Dec 3, 2024 16:42:16.646509886 CET | 49902 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:16.646851063 CET | 49902 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:16.646863937 CET | 443 | 49902 | 142.250.181.1 | 192.168.2.10 |
| Dec 3, 2024 16:42:18.401163101 CET | 443 | 49902 | 142.250.181.1 | 192.168.2.10 |
| Dec 3, 2024 16:42:18.401262999 CET | 49902 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:18.410043001 CET | 49902 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:18.410057068 CET | 443 | 49902 | 142.250.181.1 | 192.168.2.10 |
| Dec 3, 2024 16:42:18.410424948 CET | 443 | 49902 | 142.250.181.1 | 192.168.2.10 |
| Dec 3, 2024 16:42:18.410480976 CET | 49902 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:18.411174059 CET | 49902 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:18.451333046 CET | 443 | 49902 | 142.250.181.1 | 192.168.2.10 |
| Dec 3, 2024 16:42:19.356295109 CET | 443 | 49902 | 142.250.181.1 | 192.168.2.10 |
| Dec 3, 2024 16:42:19.356383085 CET | 49902 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:19.356411934 CET | 443 | 49902 | 142.250.181.1 | 192.168.2.10 |
| Dec 3, 2024 16:42:19.356461048 CET | 49902 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:19.357038021 CET | 443 | 49902 | 142.250.181.1 | 192.168.2.10 |
| Dec 3, 2024 16:42:19.357101917 CET | 49902 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:19.357412100 CET | 443 | 49902 | 142.250.181.1 | 192.168.2.10 |
| Dec 3, 2024 16:42:19.357455015 CET | 443 | 49902 | 142.250.181.1 | 192.168.2.10 |
| Dec 3, 2024 16:42:19.357484102 CET | 49902 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:19.357501030 CET | 49902 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:19.362224102 CET | 49902 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:19.362241983 CET | 443 | 49902 | 142.250.181.1 | 192.168.2.10 |
| Dec 3, 2024 16:42:19.480753899 CET | 49908 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:19.480797052 CET | 443 | 49908 | 172.217.19.174 | 192.168.2.10 |
| Dec 3, 2024 16:42:19.480923891 CET | 49908 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:19.481185913 CET | 49908 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:19.481199026 CET | 443 | 49908 | 172.217.19.174 | 192.168.2.10 |
| Dec 3, 2024 16:42:21.271667957 CET | 443 | 49908 | 172.217.19.174 | 192.168.2.10 |
| Dec 3, 2024 16:42:21.271790981 CET | 49908 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:21.272459030 CET | 443 | 49908 | 172.217.19.174 | 192.168.2.10 |
| Dec 3, 2024 16:42:21.272532940 CET | 49908 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:21.274442911 CET | 49908 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:21.274456024 CET | 443 | 49908 | 172.217.19.174 | 192.168.2.10 |
| Dec 3, 2024 16:42:21.274709940 CET | 443 | 49908 | 172.217.19.174 | 192.168.2.10 |
| Dec 3, 2024 16:42:21.274769068 CET | 49908 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:21.275171995 CET | 49908 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:21.319329977 CET | 443 | 49908 | 172.217.19.174 | 192.168.2.10 |
| Dec 3, 2024 16:42:22.214061022 CET | 443 | 49908 | 172.217.19.174 | 192.168.2.10 |
| Dec 3, 2024 16:42:22.214164972 CET | 49908 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:22.214194059 CET | 443 | 49908 | 172.217.19.174 | 192.168.2.10 |
| Dec 3, 2024 16:42:22.214253902 CET | 49908 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:22.214319944 CET | 49908 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:22.214361906 CET | 443 | 49908 | 172.217.19.174 | 192.168.2.10 |
| Dec 3, 2024 16:42:22.214416027 CET | 49908 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:22.225106001 CET | 49914 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:22.225152969 CET | 443 | 49914 | 142.250.181.1 | 192.168.2.10 |
| Dec 3, 2024 16:42:22.225246906 CET | 49914 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:22.225491047 CET | 49914 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:22.225506067 CET | 443 | 49914 | 142.250.181.1 | 192.168.2.10 |
| Dec 3, 2024 16:42:23.973012924 CET | 443 | 49914 | 142.250.181.1 | 192.168.2.10 |
| Dec 3, 2024 16:42:23.973237038 CET | 49914 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:23.973839045 CET | 49914 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:23.973846912 CET | 443 | 49914 | 142.250.181.1 | 192.168.2.10 |
| Dec 3, 2024 16:42:23.973999977 CET | 49914 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:23.974005938 CET | 443 | 49914 | 142.250.181.1 | 192.168.2.10 |
| Dec 3, 2024 16:42:24.964241982 CET | 443 | 49914 | 142.250.181.1 | 192.168.2.10 |
| Dec 3, 2024 16:42:24.964346886 CET | 49914 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:24.964621067 CET | 443 | 49914 | 142.250.181.1 | 192.168.2.10 |
| Dec 3, 2024 16:42:24.964679956 CET | 49914 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:24.965007067 CET | 49914 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:24.965049982 CET | 443 | 49914 | 142.250.181.1 | 192.168.2.10 |
| Dec 3, 2024 16:42:24.965097904 CET | 49914 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:25.089994907 CET | 49923 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:25.090025902 CET | 443 | 49923 | 172.217.19.174 | 192.168.2.10 |
| Dec 3, 2024 16:42:25.090106964 CET | 49923 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:25.090347052 CET | 49923 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:25.090362072 CET | 443 | 49923 | 172.217.19.174 | 192.168.2.10 |
| Dec 3, 2024 16:42:26.837862015 CET | 443 | 49923 | 172.217.19.174 | 192.168.2.10 |
| Dec 3, 2024 16:42:26.837935925 CET | 49923 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:26.838644028 CET | 443 | 49923 | 172.217.19.174 | 192.168.2.10 |
| Dec 3, 2024 16:42:26.838689089 CET | 49923 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:26.840437889 CET | 49923 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:26.840450048 CET | 443 | 49923 | 172.217.19.174 | 192.168.2.10 |
| Dec 3, 2024 16:42:26.840703011 CET | 443 | 49923 | 172.217.19.174 | 192.168.2.10 |
| Dec 3, 2024 16:42:26.840745926 CET | 49923 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:26.841135979 CET | 49923 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:26.883336067 CET | 443 | 49923 | 172.217.19.174 | 192.168.2.10 |
| Dec 3, 2024 16:42:27.761795044 CET | 443 | 49923 | 172.217.19.174 | 192.168.2.10 |
| Dec 3, 2024 16:42:27.761852980 CET | 49923 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:27.761877060 CET | 443 | 49923 | 172.217.19.174 | 192.168.2.10 |
| Dec 3, 2024 16:42:27.761971951 CET | 49923 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:27.762013912 CET | 49923 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:27.762053013 CET | 443 | 49923 | 172.217.19.174 | 192.168.2.10 |
| Dec 3, 2024 16:42:27.762160063 CET | 49923 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:27.773058891 CET | 49930 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:27.773099899 CET | 443 | 49930 | 142.250.181.1 | 192.168.2.10 |
| Dec 3, 2024 16:42:27.773233891 CET | 49930 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:27.773472071 CET | 49930 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:27.773485899 CET | 443 | 49930 | 142.250.181.1 | 192.168.2.10 |
| Dec 3, 2024 16:42:29.562369108 CET | 443 | 49930 | 142.250.181.1 | 192.168.2.10 |
| Dec 3, 2024 16:42:29.562464952 CET | 49930 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:29.564086914 CET | 49930 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:29.564095974 CET | 443 | 49930 | 142.250.181.1 | 192.168.2.10 |
| Dec 3, 2024 16:42:29.564340115 CET | 443 | 49930 | 142.250.181.1 | 192.168.2.10 |
| Dec 3, 2024 16:42:29.564419985 CET | 49930 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:29.564703941 CET | 49930 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:29.607331038 CET | 443 | 49930 | 142.250.181.1 | 192.168.2.10 |
| Dec 3, 2024 16:42:30.595010996 CET | 443 | 49930 | 142.250.181.1 | 192.168.2.10 |
| Dec 3, 2024 16:42:30.595079899 CET | 49930 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:30.595716953 CET | 443 | 49930 | 142.250.181.1 | 192.168.2.10 |
| Dec 3, 2024 16:42:30.595813990 CET | 49930 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:30.595851898 CET | 49930 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:30.595912933 CET | 443 | 49930 | 142.250.181.1 | 192.168.2.10 |
| Dec 3, 2024 16:42:30.595983028 CET | 443 | 49930 | 142.250.181.1 | 192.168.2.10 |
| Dec 3, 2024 16:42:30.595989943 CET | 49930 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:30.596028090 CET | 49930 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:30.714859962 CET | 49937 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:30.714895964 CET | 443 | 49937 | 172.217.19.174 | 192.168.2.10 |
| Dec 3, 2024 16:42:30.715001106 CET | 49937 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:30.715272903 CET | 49937 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:30.715285063 CET | 443 | 49937 | 172.217.19.174 | 192.168.2.10 |
| Dec 3, 2024 16:42:32.505728006 CET | 443 | 49937 | 172.217.19.174 | 192.168.2.10 |
| Dec 3, 2024 16:42:32.505841017 CET | 49937 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:32.506509066 CET | 443 | 49937 | 172.217.19.174 | 192.168.2.10 |
| Dec 3, 2024 16:42:32.506618977 CET | 49937 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:32.508311033 CET | 49937 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:32.508323908 CET | 443 | 49937 | 172.217.19.174 | 192.168.2.10 |
| Dec 3, 2024 16:42:32.508567095 CET | 443 | 49937 | 172.217.19.174 | 192.168.2.10 |
| Dec 3, 2024 16:42:32.508625031 CET | 49937 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:32.509305000 CET | 49937 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:32.555330038 CET | 443 | 49937 | 172.217.19.174 | 192.168.2.10 |
| Dec 3, 2024 16:42:33.454410076 CET | 443 | 49937 | 172.217.19.174 | 192.168.2.10 |
| Dec 3, 2024 16:42:33.454489946 CET | 49937 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:33.454648972 CET | 49937 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:33.454696894 CET | 443 | 49937 | 172.217.19.174 | 192.168.2.10 |
| Dec 3, 2024 16:42:33.454747915 CET | 49937 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:33.470314980 CET | 49945 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:33.470360994 CET | 443 | 49945 | 142.250.181.1 | 192.168.2.10 |
| Dec 3, 2024 16:42:33.470434904 CET | 49945 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:33.470664978 CET | 49945 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:33.470674992 CET | 443 | 49945 | 142.250.181.1 | 192.168.2.10 |
| Dec 3, 2024 16:42:35.258517027 CET | 443 | 49945 | 142.250.181.1 | 192.168.2.10 |
| Dec 3, 2024 16:42:35.258599043 CET | 49945 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:35.259006977 CET | 49945 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:35.259012938 CET | 443 | 49945 | 142.250.181.1 | 192.168.2.10 |
| Dec 3, 2024 16:42:35.259192944 CET | 49945 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:35.259197950 CET | 443 | 49945 | 142.250.181.1 | 192.168.2.10 |
| Dec 3, 2024 16:42:36.236358881 CET | 443 | 49945 | 142.250.181.1 | 192.168.2.10 |
| Dec 3, 2024 16:42:36.236423969 CET | 49945 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:36.236437082 CET | 443 | 49945 | 142.250.181.1 | 192.168.2.10 |
| Dec 3, 2024 16:42:36.236479044 CET | 49945 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:36.237232924 CET | 443 | 49945 | 142.250.181.1 | 192.168.2.10 |
| Dec 3, 2024 16:42:36.237278938 CET | 49945 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:36.237287998 CET | 443 | 49945 | 142.250.181.1 | 192.168.2.10 |
| Dec 3, 2024 16:42:36.237308979 CET | 443 | 49945 | 142.250.181.1 | 192.168.2.10 |
| Dec 3, 2024 16:42:36.237329006 CET | 49945 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:36.237359047 CET | 49945 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:36.274185896 CET | 49945 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:36.274199009 CET | 443 | 49945 | 142.250.181.1 | 192.168.2.10 |
| Dec 3, 2024 16:42:36.438224077 CET | 49952 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:36.438277960 CET | 443 | 49952 | 172.217.19.174 | 192.168.2.10 |
| Dec 3, 2024 16:42:36.438373089 CET | 49952 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:36.438606024 CET | 49952 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:36.438621044 CET | 443 | 49952 | 172.217.19.174 | 192.168.2.10 |
| Dec 3, 2024 16:42:38.223736048 CET | 443 | 49952 | 172.217.19.174 | 192.168.2.10 |
| Dec 3, 2024 16:42:38.223906994 CET | 49952 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:38.224543095 CET | 443 | 49952 | 172.217.19.174 | 192.168.2.10 |
| Dec 3, 2024 16:42:38.224611998 CET | 49952 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:38.226509094 CET | 49952 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:38.226515055 CET | 443 | 49952 | 172.217.19.174 | 192.168.2.10 |
| Dec 3, 2024 16:42:38.226775885 CET | 443 | 49952 | 172.217.19.174 | 192.168.2.10 |
| Dec 3, 2024 16:42:38.226840019 CET | 49952 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:38.227241993 CET | 49952 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:38.271327972 CET | 443 | 49952 | 172.217.19.174 | 192.168.2.10 |
| Dec 3, 2024 16:42:39.151551008 CET | 443 | 49952 | 172.217.19.174 | 192.168.2.10 |
| Dec 3, 2024 16:42:39.151851892 CET | 49952 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:39.151870966 CET | 443 | 49952 | 172.217.19.174 | 192.168.2.10 |
| Dec 3, 2024 16:42:39.151917934 CET | 49952 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:39.152789116 CET | 443 | 49952 | 172.217.19.174 | 192.168.2.10 |
| Dec 3, 2024 16:42:39.152836084 CET | 443 | 49952 | 172.217.19.174 | 192.168.2.10 |
| Dec 3, 2024 16:42:39.152971029 CET | 49952 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:39.247704029 CET | 49952 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:39.247734070 CET | 443 | 49952 | 172.217.19.174 | 192.168.2.10 |
| Dec 3, 2024 16:42:39.284292936 CET | 49960 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:39.284332991 CET | 443 | 49960 | 142.250.181.1 | 192.168.2.10 |
| Dec 3, 2024 16:42:39.284574032 CET | 49960 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:39.284809113 CET | 49960 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:39.284837961 CET | 443 | 49960 | 142.250.181.1 | 192.168.2.10 |
| Dec 3, 2024 16:42:41.039474010 CET | 443 | 49960 | 142.250.181.1 | 192.168.2.10 |
| Dec 3, 2024 16:42:41.039649010 CET | 49960 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:41.040152073 CET | 49960 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:41.040157080 CET | 443 | 49960 | 142.250.181.1 | 192.168.2.10 |
| Dec 3, 2024 16:42:41.040319920 CET | 49960 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:41.040323973 CET | 443 | 49960 | 142.250.181.1 | 192.168.2.10 |
| Dec 3, 2024 16:42:42.005429029 CET | 443 | 49960 | 142.250.181.1 | 192.168.2.10 |
| Dec 3, 2024 16:42:42.005496979 CET | 49960 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:42.006074905 CET | 443 | 49960 | 142.250.181.1 | 192.168.2.10 |
| Dec 3, 2024 16:42:42.006119967 CET | 49960 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:42.006150961 CET | 49960 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:42.006232977 CET | 443 | 49960 | 142.250.181.1 | 192.168.2.10 |
| Dec 3, 2024 16:42:42.006278038 CET | 49960 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:42.006297112 CET | 443 | 49960 | 142.250.181.1 | 192.168.2.10 |
| Dec 3, 2024 16:42:42.006364107 CET | 49960 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:42.137152910 CET | 49966 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:42.137192965 CET | 443 | 49966 | 172.217.19.174 | 192.168.2.10 |
| Dec 3, 2024 16:42:42.137314081 CET | 49966 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:42.137885094 CET | 49966 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:42.137898922 CET | 443 | 49966 | 172.217.19.174 | 192.168.2.10 |
| Dec 3, 2024 16:42:43.882951021 CET | 443 | 49966 | 172.217.19.174 | 192.168.2.10 |
| Dec 3, 2024 16:42:43.883050919 CET | 49966 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:43.917790890 CET | 49966 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:43.917804003 CET | 443 | 49966 | 172.217.19.174 | 192.168.2.10 |
| Dec 3, 2024 16:42:43.917989969 CET | 49966 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:43.917995930 CET | 443 | 49966 | 172.217.19.174 | 192.168.2.10 |
| Dec 3, 2024 16:42:44.794728041 CET | 443 | 49966 | 172.217.19.174 | 192.168.2.10 |
| Dec 3, 2024 16:42:44.794922113 CET | 49966 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:44.794936895 CET | 443 | 49966 | 172.217.19.174 | 192.168.2.10 |
| Dec 3, 2024 16:42:44.795099020 CET | 49966 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:44.795169115 CET | 49966 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:44.795212030 CET | 443 | 49966 | 172.217.19.174 | 192.168.2.10 |
| Dec 3, 2024 16:42:44.795269966 CET | 49966 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:44.805253029 CET | 49973 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:44.805313110 CET | 443 | 49973 | 142.250.181.1 | 192.168.2.10 |
| Dec 3, 2024 16:42:44.805382967 CET | 49973 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:44.805634975 CET | 49973 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:44.805650949 CET | 443 | 49973 | 142.250.181.1 | 192.168.2.10 |
| Dec 3, 2024 16:42:46.592784882 CET | 443 | 49973 | 142.250.181.1 | 192.168.2.10 |
| Dec 3, 2024 16:42:46.592879057 CET | 49973 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:46.711179972 CET | 49973 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:46.711205006 CET | 443 | 49973 | 142.250.181.1 | 192.168.2.10 |
| Dec 3, 2024 16:42:46.711612940 CET | 443 | 49973 | 142.250.181.1 | 192.168.2.10 |
| Dec 3, 2024 16:42:46.711677074 CET | 49973 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:46.711997986 CET | 49973 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:46.759336948 CET | 443 | 49973 | 142.250.181.1 | 192.168.2.10 |
| Dec 3, 2024 16:42:47.645054102 CET | 443 | 49973 | 142.250.181.1 | 192.168.2.10 |
| Dec 3, 2024 16:42:47.645226002 CET | 49973 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:47.645524979 CET | 443 | 49973 | 142.250.181.1 | 192.168.2.10 |
| Dec 3, 2024 16:42:47.645610094 CET | 49973 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:47.645697117 CET | 443 | 49973 | 142.250.181.1 | 192.168.2.10 |
| Dec 3, 2024 16:42:47.645742893 CET | 443 | 49973 | 142.250.181.1 | 192.168.2.10 |
| Dec 3, 2024 16:42:47.645806074 CET | 49973 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:47.646049023 CET | 49973 | 443 | 192.168.2.10 | 142.250.181.1 |
| Dec 3, 2024 16:42:47.646064997 CET | 443 | 49973 | 142.250.181.1 | 192.168.2.10 |
| Dec 3, 2024 16:42:47.779171944 CET | 49977 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:47.779217958 CET | 443 | 49977 | 172.217.19.174 | 192.168.2.10 |
| Dec 3, 2024 16:42:47.779331923 CET | 49977 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:47.779577017 CET | 49977 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:47.779596090 CET | 443 | 49977 | 172.217.19.174 | 192.168.2.10 |
| Dec 3, 2024 16:42:49.518132925 CET | 443 | 49977 | 172.217.19.174 | 192.168.2.10 |
| Dec 3, 2024 16:42:49.518199921 CET | 49977 | 443 | 192.168.2.10 | 172.217.19.174 |
| Dec 3, 2024 16:42:49.518918037 CET | 443 | 49977 | 172.217.19.174 | 192.168.2.10 |
| Dec 3, 2024 16:42:49.519015074 CET | 49977 | 443 | 192.168.2.10 | 172.217.19.174 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Dec 3, 2024 16:42:13.599230051 CET | 55590 | 53 | 192.168.2.10 | 1.1.1.1 |
| Dec 3, 2024 16:42:13.737643957 CET | 53 | 55590 | 1.1.1.1 | 192.168.2.10 |
| Dec 3, 2024 16:42:16.503334999 CET | 60134 | 53 | 192.168.2.10 | 1.1.1.1 |
| Dec 3, 2024 16:42:16.645306110 CET | 53 | 60134 | 1.1.1.1 | 192.168.2.10 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Dec 3, 2024 16:42:13.599230051 CET | 192.168.2.10 | 1.1.1.1 | 0xbb89 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Dec 3, 2024 16:42:16.503334999 CET | 192.168.2.10 | 1.1.1.1 | 0x4ce5 | Standard query (0) | A (IP address) | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Dec 3, 2024 16:40:40.116894960 CET | 1.1.1.1 | 192.168.2.10 | 0x6151 | No error (0) | s-part-0035.t-0009.t-msedge.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Dec 3, 2024 16:40:40.116894960 CET | 1.1.1.1 | 192.168.2.10 | 0x6151 | No error (0) | 13.107.246.63 | A (IP address) | IN (0x0001) | false | ||
| Dec 3, 2024 16:42:13.737643957 CET | 1.1.1.1 | 192.168.2.10 | 0xbb89 | No error (0) | 172.217.19.174 | A (IP address) | IN (0x0001) | false | ||
| Dec 3, 2024 16:42:16.645306110 CET | 1.1.1.1 | 192.168.2.10 | 0x4ce5 | No error (0) | 142.250.181.1 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.10 | 49893 | 172.217.19.174 | 443 | 7252 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-03 15:42:15 UTC | 216 | OUT | |
| 2024-12-03 15:42:16 UTC | 1920 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.10 | 49902 | 142.250.181.1 | 443 | 7252 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-03 15:42:18 UTC | 258 | OUT | |
| 2024-12-03 15:42:19 UTC | 2229 | IN | |
| 2024-12-03 15:42:19 UTC | 1652 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 2 | 192.168.2.10 | 49908 | 172.217.19.174 | 443 | 7252 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-03 15:42:21 UTC | 418 | OUT | |
| 2024-12-03 15:42:22 UTC | 1920 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 3 | 192.168.2.10 | 49914 | 142.250.181.1 | 443 | 7252 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-03 15:42:23 UTC | 460 | OUT | |
| 2024-12-03 15:42:24 UTC | 1854 | IN | |
| 2024-12-03 15:42:24 UTC | 1652 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 4 | 192.168.2.10 | 49923 | 172.217.19.174 | 443 | 7252 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-03 15:42:26 UTC | 418 | OUT | |
| 2024-12-03 15:42:27 UTC | 1920 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 5 | 192.168.2.10 | 49930 | 142.250.181.1 | 443 | 7252 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-03 15:42:29 UTC | 460 | OUT | |
| 2024-12-03 15:42:30 UTC | 1854 | IN | |
| 2024-12-03 15:42:30 UTC | 1652 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 6 | 192.168.2.10 | 49937 | 172.217.19.174 | 443 | 7252 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-03 15:42:32 UTC | 418 | OUT | |
| 2024-12-03 15:42:33 UTC | 1920 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 7 | 192.168.2.10 | 49945 | 142.250.181.1 | 443 | 7252 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-03 15:42:35 UTC | 460 | OUT | |
| 2024-12-03 15:42:36 UTC | 1854 | IN | |
| 2024-12-03 15:42:36 UTC | 1652 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 8 | 192.168.2.10 | 49952 | 172.217.19.174 | 443 | 7252 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-03 15:42:38 UTC | 418 | OUT | |
| 2024-12-03 15:42:39 UTC | 1920 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 9 | 192.168.2.10 | 49960 | 142.250.181.1 | 443 | 7252 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-03 15:42:41 UTC | 460 | OUT | |
| 2024-12-03 15:42:42 UTC | 1854 | IN | |
| 2024-12-03 15:42:42 UTC | 1652 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 10 | 192.168.2.10 | 49966 | 172.217.19.174 | 443 | 7252 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-03 15:42:43 UTC | 418 | OUT | |
| 2024-12-03 15:42:44 UTC | 1920 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 11 | 192.168.2.10 | 49973 | 142.250.181.1 | 443 | 7252 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-03 15:42:46 UTC | 460 | OUT | |
| 2024-12-03 15:42:47 UTC | 1854 | IN | |
| 2024-12-03 15:42:47 UTC | 1652 | IN |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
| Target ID: | 0 |
| Start time: | 10:40:42 |
| Start date: | 03/12/2024 |
| Path: | C:\Users\user\Desktop\beNxougDFV.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x400000 |
| File size: | 525'906 bytes |
| MD5 hash: | 8A678142D7D4BD32F67A17757CC896A0 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | low |
| Has exited: | true |
| Target ID: | 2 |
| Start time: | 10:40:45 |
| Start date: | 03/12/2024 |
| Path: | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0xc0000 |
| File size: | 433'152 bytes |
| MD5 hash: | C32CA4ACFCC635EC1EA6ED8A34DF5FAC |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 3 |
| Start time: | 10:40:45 |
| Start date: | 03/12/2024 |
| Path: | C:\Windows\System32\conhost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff620390000 |
| File size: | 862'208 bytes |
| MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 7 |
| Start time: | 10:41:56 |
| Start date: | 03/12/2024 |
| Path: | C:\Windows\SysWOW64\msiexec.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x990000 |
| File size: | 59'904 bytes |
| MD5 hash: | 9D09DC1EDA745A5F87553048E57620CF |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Reputation: | high |
| Has exited: | false |
Execution Graph
| Execution Coverage: | 20.7% |
| Dynamic/Decrypted Code Coverage: | 0% |
| Signature Coverage: | 21.9% |
| Total number of Nodes: | 1290 |
| Total number of Limit Nodes: | 31 |
Graph
Function 004031BB Relevance: 91.4, APIs: 33, Strings: 19, Instructions: 368stringcomfileCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405194 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282windowclipboardmemoryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004056F7 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 159filestringCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004065BB Relevance: 5.4, APIs: 4, Instructions: 382COMMON
Download Yara Rule
Control-flow Graph
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00403B1C Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 346windowstringCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040377F Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 215stringregistryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405F51 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 199stringCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401759 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 147stringtimeCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405056 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73stringwindowCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00406259 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405E16 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004055CE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004069F0 Relevance: 5.2, APIs: 4, Instructions: 236COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00406BF1 Relevance: 5.2, APIs: 4, Instructions: 208COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00406907 Relevance: 5.2, APIs: 4, Instructions: 205COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040640C Relevance: 5.2, APIs: 4, Instructions: 198COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040685A Relevance: 5.2, APIs: 4, Instructions: 180COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00406978 Relevance: 5.2, APIs: 4, Instructions: 170COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004068C4 Relevance: 5.2, APIs: 4, Instructions: 168COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401B5D Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405AC8 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405AA3 Relevance: 3.0, APIs: 2, Instructions: 13COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405599 Relevance: 3.0, APIs: 2, Instructions: 9COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405B40 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405B6F Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040159D Relevance: 1.5, APIs: 1, Instructions: 18COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040403C Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00403173 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405611 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404025 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404012 Relevance: 1.5, APIs: 1, Instructions: 4COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401EDB Relevance: 1.3, APIs: 1, Instructions: 37COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004049D3 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404460 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 274stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004026F8 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404139 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 202windowstringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405B9E Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 129memorystringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404057 Relevance: 12.1, APIs: 8, Instructions: 61COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404921 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00402C61 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404817 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401D95 Relevance: 7.5, APIs: 5, Instructions: 43COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401D3B Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401C04 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004059B5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004058C7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00402CE4 Relevance: 6.0, APIs: 4, Instructions: 33COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404FCA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040590E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405A2D Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|