Edit tour
Windows
Analysis Report
crypted_UClient.exe
Overview
General Information
| Sample name: | crypted_UClient.exe |
| Analysis ID: | 1577565 |
| MD5: | c1bfa131bbdef5f2e438d5c8bbaef2ca |
| SHA1: | 23c1632a3b7a813c600f62e1db91bc8f5393f92e |
| SHA256: | 018a3230583fa89466619a1561b96a5402fea166f0ab3a94e0e0787de2a69843 |
| Tags: | 18521511316185215113209bulletproofexeRustyStealersigneduser-abus3reports |
| Infos: |   |
 | |
Detection
XWorm
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected XWorm
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Uses schtasks.exe or at.exe to add and modify task schedules
AV process strings found (often used to terminate AV products)
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to dynamically determine API calls
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found potential string decryption / allocating functions
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE / OLE file has an invalid certificate
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Startup Folder File Write
Sigma detected: Suspicious Schtasks From Env Var Folder
Stores files to the Windows start menu directory
Uses code obfuscation techniques (call, push, ret)
Yara signature match
Classification
- System is w10x64
crypted_UClient.exe (PID: 5632 cmdline: "C:\Users\ user\Deskt op\crypted _UClient.e xe" MD5: C1BFA131BBDEF5F2E438D5C8BBAEF2CA) 
schtasks.exe (PID: 5536 cmdline: "C:\Window s\System32 \schtasks. exe" /crea te /f /RL HIGHEST /s c minute / mo 1 /tn " UClient" / tr "C:\Use rs\user\Ap pData\Roam ing\UClien t.exe" MD5: 76CD6626DD8834BD4A42E6A565104DC2) 
conhost.exe (PID: 5588 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
- UClient.exe (PID: 4784 cmdline:
C:\Users\u ser\AppDat a\Roaming\ UClient.ex e MD5: C1BFA131BBDEF5F2E438D5C8BBAEF2CA)
- UClient.exe (PID: 3268 cmdline:
"C:\Users\ user\AppDa ta\Roaming \UClient.e xe" MD5: C1BFA131BBDEF5F2E438D5C8BBAEF2CA)
- UClient.exe (PID: 5192 cmdline:
"C:\Users\ user\AppDa ta\Roaming \UClient.e xe" MD5: C1BFA131BBDEF5F2E438D5C8BBAEF2CA)
- UClient.exe (PID: 6416 cmdline:
C:\Users\u ser\AppDat a\Roaming\ UClient.ex e MD5: C1BFA131BBDEF5F2E438D5C8BBAEF2CA)
- cleanup
| Name | Description | Attribution | Blogpost URLs | Link |
|---|---|---|---|---|
| XWorm | Malware with wide range of capabilities ranging from RAT to ransomware. | No Attribution |
{"C2 url": ["154.216.18.132"], "Port": 6767, "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe"}| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| Windows_Trojan_Donutloader_f40e3759 | unknown | unknown |
| |
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| MALWARE_Win_AsyncRAT | Detects AsyncRAT | ditekSHen |
| |
| Windows_Trojan_Donutloader_f40e3759 | unknown | unknown |
| |
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| Click to see the 17 entries | ||||
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| MALWARE_Win_AsyncRAT | Detects AsyncRAT | ditekSHen |
| |
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| MALWARE_Win_AsyncRAT | Detects AsyncRAT | ditekSHen |
| |
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| Click to see the 23 entries | ||||
System Summary |   |
|---|
| Source: | Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): | ||
| Source: | Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): | ||
| Source: | Author: Florian Roth (Nextron Systems): | ||
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2024-12-18T15:37:15.186590+0100 | 2853193 | 1 | Malware Command and Control Activity Detected | 192.168.2.6 | 50020 | 154.216.18.132 | 6767 | TCP |
Click to jump to signature section
Show All Signature Results
AV Detection | |
|---|
| Source: | Malware Configuration Extractor: | ||
| Source: | ReversingLabs: | ||
| Source: | ReversingLabs: | ||
| Source: | Integrated Neural Analysis Model: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
Networking | |
|---|
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | URLs: | ||
| Source: | TCP traffic: | ||
| Source: | ASN Name: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
System Summary | |
|---|
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Process Stats: | ||
| Source: | Code function: | 0_2_00007FF79D8FD660 | |
| Source: | Code function: | 6_2_00007FF718C6D660 | |
| Source: | Code function: | 0_2_00007FF79D8C89B2 | |
| Source: | Code function: | 0_2_00007FF79D8B13F2 | |
| Source: | Code function: | 0_2_00007FF79D8FFED0 | |
| Source: | Code function: | 0_2_00007FF79D8F92D0 | |
| Source: | Code function: | 0_2_00007FF79D8F26F0 | |
| Source: | Code function: | 0_2_00007FF79D900250 | |
| Source: | Code function: | 0_2_00007FF79D8FDA40 | |
| Source: | Code function: | 0_2_00007FF79D8C8DB1 | |
| Source: | Code function: | 0_2_00007FF79D8FF1E9 | |
| Source: | Code function: | 0_2_00007FF79D8F69E0 | |
| Source: | Code function: | 0_2_00007FF79D903E10 | |
| Source: | Code function: | 0_2_00007FF79D8F5120 | |
| Source: | Code function: | 0_2_00007FF79D8C8D51 | |
| Source: | Code function: | 0_2_00007FF79D8FB10B | |
| Source: | Code function: | 0_2_00007FF79D8F4420 | |
| Source: | Code function: | 0_2_00007FF79D902840 | |
| Source: | Code function: | 0_2_00007FF79D9017D9 | |
| Source: | Code function: | 0_2_00007FF79D904B3B | |
| Source: | Code function: | 0_2_00007FF79D906780 | |
| Source: | Code function: | 0_2_0000025191F6B7E7 | |
| Source: | Code function: | 0_2_0000025191F6BBB7 | |
| Source: | Code function: | 0_2_0000025191F6A8F3 | |
| Source: | Code function: | 0_2_0000025191F6BFEF | |
| Source: | Code function: | 0_2_0000025191F6F2E7 | |
| Source: | Code function: | 0_2_0000025191F6CA8F | |
| Source: | Code function: | 0_2_00007FFD345F75C2 | |
| Source: | Code function: | 0_2_00007FFD345F6816 | |
| Source: | Code function: | 0_2_00007FFD345F1541 | |
| Source: | Code function: | 0_2_00007FFD345F1975 | |
| Source: | Code function: | 6_2_00007FF718C389B2 | |
| Source: | Code function: | 6_2_00007FF718C213F2 | |
| Source: | Code function: | 6_2_00007FF718C6F1E9 | |
| Source: | Code function: | 6_2_00007FF718C669E0 | |
| Source: | Code function: | 6_2_00007FF718C73E10 | |
| Source: | Code function: | 6_2_00007FF718C65120 | |
| Source: | Code function: | 6_2_00007FF718C626F0 | |
| Source: | Code function: | 6_2_00007FF718C6FED0 | |
| Source: | Code function: | 6_2_00007FF718C692D0 | |
| Source: | Code function: | 6_2_00007FF718C70250 | |
| Source: | Code function: | 6_2_00007FF718C6DA40 | |
| Source: | Code function: | 6_2_00007FF718C717D9 | |
| Source: | Code function: | 6_2_00007FF718C76780 | |
| Source: | Code function: | 6_2_00007FF718C74B3B | |
| Source: | Code function: | 6_2_00007FF718C6B10B | |
| Source: | Code function: | 6_2_00007FF718C60CCF | |
| Source: | Code function: | 6_2_00007FF718C64420 | |
| Source: | Code function: | 6_2_00007FF718C72840 | |
| Source: | Code function: | 6_2_0000022BAF2CB7E7 | |
| Source: | Code function: | 6_2_0000022BAF2CBBB7 | |
| Source: | Code function: | 6_2_0000022BAF2CBFEF | |
| Source: | Code function: | 6_2_0000022BAF2CF2E7 | |
| Source: | Code function: | 6_2_0000022BAF2CCA8F | |
| Source: | Code function: | 6_2_0000022BAF2CA8F3 | |
| Source: | Code function: | 6_2_00007FFD34620ADD | |
| Source: | Code function: | 6_2_00007FFD34621541 | |
| Source: | Code function: | 6_2_00007FFD34620D9D | |
| Source: | Code function: | 9_2_000002A2DA4CBBB7 | |
| Source: | Code function: | 9_2_000002A2DA4CB7E7 | |
| Source: | Code function: | 9_2_000002A2DA4CCA8F | |
| Source: | Code function: | 9_2_000002A2DA4CBFEF | |
| Source: | Code function: | 9_2_000002A2DA4CF2E7 | |
| Source: | Code function: | 9_2_000002A2DA4CA8F3 | |
| Source: | Code function: | 9_2_00007FFD34610ADD | |
| Source: | Code function: | 9_2_00007FFD34610D9D | |
| Source: | Code function: | 9_2_00007FFD34611541 | |
| Source: | Code function: | 10_2_000001A04B25BBB7 | |
| Source: | Code function: | 10_2_000001A04B25B7E7 | |
| Source: | Code function: | 10_2_000001A04B25F2E7 | |
| Source: | Code function: | 10_2_000001A04B25BFEF | |
| Source: | Code function: | 10_2_000001A04B25A8F3 | |
| Source: | Code function: | 10_2_000001A04B25CA8F | |
| Source: | Code function: | 10_2_00007FFD34610ADD | |
| Source: | Code function: | 10_2_00007FFD34610D9D | |
| Source: | Code function: | 10_2_00007FFD34611541 | |
| Source: | Static PE information: | ||
| Source: | Binary or memory string: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Classification label: | ||
| Source: | Code function: | 0_2_00007FF79D9017D9 | |
| Source: | File created: | Jump to behavior | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | Static PE information: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | ReversingLabs: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Key value queried: | Jump to behavior | ||
| Source: | LNK file: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
Data Obfuscation | |
|---|
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | Code function: | 0_2_00007FF79D8B13F2 | |
| Source: | Code function: | 0_2_0000025191F6016E | |
| Source: | Code function: | 6_2_0000022BAF2C016E | |
| Source: | Code function: | 9_2_000002A2DA4C016E | |
| Source: | Code function: | 10_2_000001A04B25016E | |
| Source: | File created: | Jump to dropped file | ||
Boot Survival | |
|---|
| Source: | Process created: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Registry value created or modified: | Jump to behavior | ||
| Source: | Registry value created or modified: | Jump to behavior | ||
| Source: | Code function: | 0_2_00007FF79D902840 | |
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
Malware Analysis System Evasion | |
|---|
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Last function: | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Code function: | 0_2_00007FF79D907244 | |
| Source: | Code function: | 0_2_00007FF79D8B13F2 | |
| Source: | Code function: | 0_2_00007FF79D8C89B2 | |
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Code function: | 0_2_00007FF79D907244 | |
| Source: | Code function: | 0_2_00007FF79D9073E8 | |
| Source: | Code function: | 6_2_00007FF718C77244 | |
| Source: | Code function: | 6_2_00007FF718C773E8 | |
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Code function: | 0_2_00007FF79D90711C | |
| Source: | Key value queried: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
Stealing of Sensitive Information | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
Remote Access Functionality | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | 11 Windows Management Instrumentation | 1 Scheduled Task/Job | 11 Process Injection | 1 Masquerading | OS Credential Dumping | 1 System Time Discovery | Remote Services | 11 Archive Collected Data | 1 Encrypted Channel | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
| Credentials | Domains | Default Accounts | 2 Command and Scripting Interpreter | 21 Registry Run Keys / Startup Folder | 1 Scheduled Task/Job | 1 Disable or Modify Tools | LSASS Memory | 241 Security Software Discovery | Remote Desktop Protocol | Data from Removable Media | 1 Non-Standard Port | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | 1 Scheduled Task/Job | 1 DLL Side-Loading | 21 Registry Run Keys / Startup Folder | 131 Virtualization/Sandbox Evasion | Security Account Manager | 131 Virtualization/Sandbox Evasion | SMB/Windows Admin Shares | Data from Network Shared Drive | 1 Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | 1 Native API | Login Hook | 1 DLL Side-Loading | 11 Process Injection | NTDS | 1 Application Window Discovery | Distributed Component Object Model | Input Capture | Protocol Impersonation | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | Network Logon Script | 11 Deobfuscate/Decode Files or Information | LSA Secrets | 1 File and Directory Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
| Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | 2 Obfuscated Files or Information | Cached Domain Credentials | 14 System Information Discovery | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
| DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | 2 Software Packing | DCSync | Remote System Discovery | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
| Network Trust Dependencies | Serverless | Drive-by Compromise | Container Orchestration Job | Scheduled Task/Job | Scheduled Task/Job | 1 DLL Side-Loading | Proc Filesystem | System Owner/User Discovery | Cloud Services | Credential API Hooking | Application Layer Protocol | Exfiltration Over Alternative Protocol | Defacement |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 21% | ReversingLabs | ByteCode-MSIL.Trojan.Generic |
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 21% | ReversingLabs | ByteCode-MSIL.Trojan.Generic |
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe |
⊘No contacted domains info
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| true |
| unknown |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false |
| unknown | ||
| false | high |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 154.216.18.132 | unknown | Seychelles | 135357 | SKHT-ASShenzhenKatherineHengTechnologyInformationCo | true |
| Joe Sandbox version: | 41.0.0 Charoite |
| Analysis ID: | 1577565 |
| Start date and time: | 2024-12-18 15:32:23 +01:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 8m 33s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 12 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | crypted_UClient.exe |
| Detection: | MAL |
| Classification: | mal100.troj.evad.winEXE@8/3@0/1 |
| EGA Information: |
|
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
- Excluded IPs from analysis (whitelisted): 13.107.246.63, 172.202.163.200
- Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, tile-service.weather.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
- Not all processes where analyzed, report is missing behavior information
- Report size exceeded maximum capacity and may have missing behavior information.
- Report size exceeded maximum capacity and may have missing disassembly code.
- Report size getting too big, too many NtOpenKeyEx calls found.
- Report size getting too big, too many NtProtectVirtualMemory calls found.
- Report size getting too big, too many NtQueryValueKey calls found.
- VT rate limit hit for: crypted_UClient.exe
| Time | Type | Description |
|---|---|---|
| 09:34:16 | API Interceptor | |
| 15:34:18 | Task Scheduler | |
| 15:34:19 | Autostart | |
| 15:34:27 | Autostart | |
| 15:34:37 | Autostart |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 154.216.18.132 | Get hash | malicious | Remcos | Browse |
⊘No context
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| SKHT-ASShenzhenKatherineHengTechnologyInformationCo | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Remcos | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | WinSearchAbuse | Browse |
| ||
| Get hash | malicious | Remcos, GuLoader | Browse |
| ||
| Get hash | malicious | Xmrig | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
|
⊘No context
⊘No context
| Process: | C:\Users\user\AppData\Roaming\UClient.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 654 |
| Entropy (8bit): | 5.380476433908377 |
| Encrypted: | false |
| SSDEEP: | 12:Q3La/KDLI4MWuPXcp1OKbbDLI4MWuPOKfSSI6Khap+92n4MNQp3/VXM5gXu9tv:ML9E4KQwKDE4KGKZI6Kh6+84xp3/VclT |
| MD5: | 30E4BDFC34907D0E4D11152CAEBE27FA |
| SHA1: | 825402D6B151041BA01C5117387228EC9B7168BF |
| SHA-256: | A7B8F7FFB4822570DB1423D61ED74D7F4B538CE73521CC8745BC6B131C18BE63 |
| SHA-512: | 89FBCBCDB0BE5AD7A95685CF9AA4330D5B0250440E67DC40C6642260E024F52A402E9381F534A9824D2541B98B02094178A15BF2320148432EDB0D09B5F972BA |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| Preview: |
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UClient.lnk
Download File
| Process: | C:\Users\user\Desktop\crypted_UClient.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 767 |
| Entropy (8bit): | 5.073490850007125 |
| Encrypted: | false |
| SSDEEP: | 12:81M24qypnu8ChmRLll2lXIsY//YXaLXIXjAe+HFqj1b1bmV:81WTDdL+lXUokYzAeZpbxm |
| MD5: | 756F9F9CDE6FF9CFBBD5C360871D9592 |
| SHA1: | 12E50E70D8ACC6BF8FC94A9FFA8B49BEA830EE46 |
| SHA-256: | BD8C74FB5AA65A29AF6B3506673A337D4B7D64BB84B375F245888D482DFDA4BB |
| SHA-512: | 20F004CA01E193E6DA2994B36DE214EB6AD9CF0B2A2B76E33A6913B73F2F10B9DBB40A9EF76829D81C83FD08DBFCB5CB4714F53A370C0EE0E25D6637D1A437D4 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Users\user\Desktop\crypted_UClient.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 543144 |
| Entropy (8bit): | 5.982481344403472 |
| Encrypted: | false |
| SSDEEP: | 12288:8MMXYaLZ9hiNb1zg/omm0CyYofToRqM5b:8MMoaLZ9INJzComyyY8ToYE |
| MD5: | C1BFA131BBDEF5F2E438D5C8BBAEF2CA |
| SHA1: | 23C1632A3B7A813C600F62E1DB91BC8F5393F92E |
| SHA-256: | 018A3230583FA89466619A1561B96A5402FEA166F0AB3A94E0E0787DE2A69843 |
| SHA-512: | 71B8167276694799C1B9889CEDE47C99DEE01327B4A90B754ED153F497040E7F021DEFBE2AC40C3D7D24AAD9145EA12F90F451E2285B07D27BF30962EDCA335C |
| Malicious: | true |
| Antivirus: |
|
| Reputation: | low |
| Preview: |
| File type: | |
| Entropy (8bit): | 5.982481344403472 |
| TrID: |
|
| File name: | crypted_UClient.exe |
| File size: | 543'144 bytes |
| MD5: | c1bfa131bbdef5f2e438d5c8bbaef2ca |
| SHA1: | 23c1632a3b7a813c600f62e1db91bc8f5393f92e |
| SHA256: | 018a3230583fa89466619a1561b96a5402fea166f0ab3a94e0e0787de2a69843 |
| SHA512: | 71b8167276694799c1b9889cede47c99dee01327b4a90b754ed153f497040e7f021defbe2ac40c3d7d24aad9145ea12f90f451e2285b07d27bf30962edca335c |
| SSDEEP: | 12288:8MMXYaLZ9hiNb1zg/omm0CyYofToRqM5b:8MMoaLZ9INJzComyyY8ToYE |
| TLSH: | 09C42827F2400453C96DD079C70E11A7432EFAFB0712FBBAB16552613EA2E6C6E2D395 |
| File Content Preview: | MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s."X..qX..qX..qQj0qR..qI..pZ..qI..p[..qI..pQ..qI..pN..qX..q...qX..qT..q...pY..qRichX..q........................PE..d....g`g... |
 | |
| Icon Hash: | e9d266251b25d473 |
| Entrypoint: | 0x140056e30 |
| Entrypoint Section: | .text |
| Digitally signed: | true |
| Imagebase: | 0x140000000 |
| Subsystem: | windows gui |
| Image File Characteristics: | EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE |
| DLL Characteristics: | HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x6760679D [Mon Dec 16 17:47:09 2024 UTC] |
| TLS Callbacks: | 0x4004e470, 0x1 |
| CLR (.Net) Version: | |
| OS Version Major: | 6 |
| OS Version Minor: | 0 |
| File Version Major: | 6 |
| File Version Minor: | 0 |
| Subsystem Version Major: | 6 |
| Subsystem Version Minor: | 0 |
| Import Hash: | a8e772fb4810a3d8507cc8f937a90eab |
| Signature Valid: | false |
| Signature Issuer: | CN=Oracle Corporation |
| Signature Validation Error: | A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider |
| Error Number: | -2146762487 |
| Not Before, Not After |
|
| Subject Chain |
|
| Version: | 3 |
| Thumbprint MD5: | C7920E2A1E74DCE62F9A2F3D8C28D792 |
| Thumbprint SHA-1: | 5806A1DCF4D287570843AD18CA00CBEA9EECA47E |
| Thumbprint SHA-256: | C940D371C9C30E1036E59133AC60D834A758CE8653777CDA115926655EDF9737 |
| Serial: | 00BBB9EB2F158018FC459BB0E55AF457 |
| Instruction |
|---|
| dec eax |
| sub esp, 28h |
| call 00007F9208B297E8h |
| dec eax |
| add esp, 28h |
| jmp 00007F9208B29377h |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| nop word ptr [eax+eax+00000000h] |
| dec eax |
| sub esp, 10h |
| dec esp |
| mov dword ptr [esp], edx |
| dec esp |
| mov dword ptr [esp+08h], ebx |
| dec ebp |
| xor ebx, ebx |
| dec esp |
| lea edx, dword ptr [esp+18h] |
| dec esp |
| sub edx, eax |
| dec ebp |
| cmovb edx, ebx |
| dec esp |
| mov ebx, dword ptr [00000010h] |
| dec ebp |
| cmp edx, ebx |
| jnc 00007F9208B29518h |
| inc cx |
| and edx, 8D4DF000h |
| wait |
| add al, dh |
| Programming Language: |
|
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0x81e3c | 0xdc | .rdata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x85000 | 0x15ac | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x84000 | 0xfcc | .pdata |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x84400 | 0x5a8 | .pdata |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x87000 | 0x328 | .reloc |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0x7f8c0 | 0x54 | .rdata |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0x7f980 | 0x28 | .rdata |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x7f780 | 0x140 | .rdata |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x59000 | 0x2e8 | .rdata |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x579e6 | 0x57a00 | 18d460025cbc00b62e1424bda2adfa55 | False | 0.3762621478245364 | data | 5.599603254209463 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .rdata | 0x59000 | 0x29952 | 0x29a00 | 3c19be7509167c57297560acd143d5ef | False | 0.5468867304804805 | data | 4.933389142769402 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .data | 0x83000 | 0x2e0 | 0x200 | c0ea16c9dd291d996228ca9b1c0bf7d9 | False | 0.208984375 | Matlab v4 mat-file (little endian) , text, rows 0, columns 0 | 1.5570059233000273 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .pdata | 0x84000 | 0xfcc | 0x1000 | 9842561b1e7ccfa08ce163ad7d91be4e | False | 0.49853515625 | data | 5.325946826058646 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .rsrc | 0x85000 | 0x15ac | 0x1600 | 267941f788229ea51a52351cd560b75a | False | 0.3918678977272727 | data | 3.7249803112951874 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .reloc | 0x87000 | 0x328 | 0x400 | c0a5ccd8c6475c101cfa965f9cd195a3 | False | 0.5546875 | data | 4.794919331963851 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| RT_ICON | 0x850e8 | 0x10a8 | Device independent bitmap graphic, 32 x 64 x 32, image size 4224 | English | United States | 0.38625703564727953 |
| RT_GROUP_ICON | 0x86190 | 0x14 | data | English | United States | 1.1 |
| RT_VERSION | 0x861a4 | 0x408 | data | English | United States | 0.437984496124031 |
| DLL | Import |
|---|---|
| api-ms-win-core-synch-l1-2-0.dll | WaitOnAddress, WakeByAddressAll, WakeByAddressSingle |
| kernel32.dll | AddVectoredExceptionHandler, GetLastError, VirtualProtect, VirtualAlloc, SetThreadStackGuarantee, HeapReAlloc, HeapFree, GetProcessHeap, GetCurrentThread, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, LoadLibraryExA, IsDebuggerPresent, UnhandledExceptionFilter, GetEnvironmentVariableW, WideCharToMultiByte, RtlVirtualUnwind, ReleaseMutex, CreateMutexA, GetCurrentProcessId, GetCurrentProcess, WaitForSingleObjectEx, RtlLookupFunctionEntry, RtlCaptureContext, GetCurrentDirectoryW, GetConsoleMode, HeapAlloc, FormatMessageW, GetModuleHandleW, lstrlenW, SetLastError, GetModuleHandleA, WriteConsoleW, MultiByteToWideChar, GetStdHandle, CloseHandle, SetUnhandledExceptionFilter, LoadLibraryA, WaitForSingleObject, GetProcAddress, QueryPerformanceCounter, IsProcessorFeaturePresent |
| ntdll.dll | NtWriteFile, RtlNtStatusToDosError |
| oleaut32.dll | SysFreeString, SysStringLen |
| VCRUNTIME140.dll | _CxxThrowException, memcpy, __CxxFrameHandler3, memset, __current_exception_context, __current_exception, __C_specific_handler, memmove, memcmp |
| api-ms-win-crt-runtime-l1-1-0.dll | _crt_atexit, terminate, _register_onexit_function, _initialize_onexit_table, _set_app_type, _register_thread_local_exe_atexit_callback, _c_exit, _cexit, __p___argv, __p___argc, _configure_narrow_argv, _exit, exit, _initterm_e, _initterm, _get_initial_narrow_environment, _initialize_narrow_environment, _seh_filter_exe |
| api-ms-win-crt-math-l1-1-0.dll | __setusermatherr |
| api-ms-win-crt-stdio-l1-1-0.dll | __p__commode, _set_fmode |
| api-ms-win-crt-locale-l1-1-0.dll | _configthreadlocale |
| api-ms-win-crt-heap-l1-1-0.dll | _set_new_mode, free |
| Language of compilation system | Country where language is spoken | Map |
|---|---|---|
| English | United States |  |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | SID | Signature | Severity | Source IP | Source Port | Dest IP | Dest Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2024-12-18T15:35:55.609660+0100 | 2855924 | ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound | 1 | 192.168.2.6 | 50004 | 154.216.18.132 | 6767 | TCP |
| 2024-12-18T15:37:15.186590+0100 | 2853193 | ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound | 1 | 192.168.2.6 | 50020 | 154.216.18.132 | 6767 | TCP |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Dec 18, 2024 15:34:18.377679110 CET | 49840 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:34:18.497420073 CET | 6767 | 49840 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:34:18.497517109 CET | 49840 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:34:18.951984882 CET | 49840 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:34:19.071897984 CET | 6767 | 49840 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:34:20.725959063 CET | 6767 | 49840 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:34:20.726190090 CET | 49840 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:34:23.451023102 CET | 49840 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:34:23.522866964 CET | 49854 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:34:23.570698977 CET | 6767 | 49840 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:34:23.642718077 CET | 6767 | 49854 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:34:23.643019915 CET | 49854 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:34:23.772650957 CET | 49854 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:34:23.921797991 CET | 6767 | 49854 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:34:25.865477085 CET | 6767 | 49854 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:34:25.865561962 CET | 49854 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:34:27.932538986 CET | 49854 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:34:27.933437109 CET | 49866 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:34:28.052208900 CET | 6767 | 49854 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:34:28.053088903 CET | 6767 | 49866 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:34:28.053236961 CET | 49866 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:34:28.104224920 CET | 49866 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:34:28.224098921 CET | 6767 | 49866 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:34:30.288136959 CET | 6767 | 49866 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:34:30.289166927 CET | 49866 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:34:32.307537079 CET | 49866 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:34:32.309509993 CET | 49877 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:34:32.427148104 CET | 6767 | 49866 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:34:32.429227114 CET | 6767 | 49877 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:34:32.429361105 CET | 49877 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:34:32.446204901 CET | 49877 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:34:32.566168070 CET | 6767 | 49877 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:34:34.663634062 CET | 6767 | 49877 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:34:34.663707018 CET | 49877 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:34:36.479621887 CET | 49877 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:34:36.480601072 CET | 49886 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:34:36.599749088 CET | 6767 | 49877 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:34:36.600433111 CET | 6767 | 49886 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:34:36.600588083 CET | 49886 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:34:36.681471109 CET | 49886 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:34:36.801232100 CET | 6767 | 49886 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:34:38.874389887 CET | 6767 | 49886 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:34:38.874458075 CET | 49886 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:34:40.180221081 CET | 49886 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:34:40.181632042 CET | 49892 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:34:40.299777031 CET | 6767 | 49886 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:34:40.301110983 CET | 6767 | 49892 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:34:40.301187992 CET | 49892 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:34:40.577064037 CET | 49892 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:34:40.696876049 CET | 6767 | 49892 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:34:42.539823055 CET | 6767 | 49892 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:34:42.539889097 CET | 49892 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:34:43.698488951 CET | 49892 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:34:43.699948072 CET | 49903 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:34:43.817954063 CET | 6767 | 49892 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:34:43.819416046 CET | 6767 | 49903 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:34:43.819482088 CET | 49903 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:34:44.074517965 CET | 49903 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:34:44.194636106 CET | 6767 | 49903 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:34:46.039170980 CET | 6767 | 49903 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:34:46.039236069 CET | 49903 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:34:49.260852098 CET | 49903 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:34:49.261755943 CET | 49914 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:34:49.380460978 CET | 6767 | 49903 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:34:49.381350994 CET | 6767 | 49914 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:34:49.381449938 CET | 49914 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:34:49.574949026 CET | 49914 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:34:49.694952011 CET | 6767 | 49914 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:34:51.664756060 CET | 6767 | 49914 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:34:51.664835930 CET | 49914 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:34:53.449863911 CET | 49914 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:34:53.451450109 CET | 49923 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:34:53.569478989 CET | 6767 | 49914 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:34:53.571187973 CET | 6767 | 49923 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:34:53.571291924 CET | 49923 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:34:53.826046944 CET | 49923 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:34:53.945749998 CET | 6767 | 49923 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:35:07.098383904 CET | 49923 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:35:07.218607903 CET | 6767 | 49923 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:35:07.680728912 CET | 6767 | 49923 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:35:07.680872917 CET | 49923 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:35:07.916906118 CET | 49923 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:35:07.917567968 CET | 49956 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:35:08.036637068 CET | 6767 | 49923 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:35:08.037184000 CET | 6767 | 49956 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:35:08.037250042 CET | 49956 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:35:08.278867960 CET | 49956 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:35:08.398586988 CET | 6767 | 49956 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:35:19.873038054 CET | 49956 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:35:19.992697001 CET | 6767 | 49956 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:35:22.180871010 CET | 6767 | 49956 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:35:22.181025982 CET | 49956 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:35:22.323694944 CET | 49956 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:35:22.324409008 CET | 49976 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:35:22.443849087 CET | 6767 | 49956 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:35:22.444468021 CET | 6767 | 49976 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:35:22.444571018 CET | 49976 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:35:24.681260109 CET | 6767 | 49976 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:35:24.681344986 CET | 49976 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:35:24.967051029 CET | 49976 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:35:25.087577105 CET | 6767 | 49976 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:35:25.358561993 CET | 49979 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:35:25.478575945 CET | 6767 | 49979 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:35:25.478698969 CET | 49979 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:35:25.794753075 CET | 49979 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:35:25.914338112 CET | 6767 | 49979 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:35:27.725534916 CET | 6767 | 49979 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:35:27.725671053 CET | 49979 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:35:27.776089907 CET | 49979 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:35:27.777704000 CET | 49984 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:35:27.895567894 CET | 6767 | 49979 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:35:27.897383928 CET | 6767 | 49984 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:35:27.897630930 CET | 49984 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:35:28.264012098 CET | 49984 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:35:28.383601904 CET | 6767 | 49984 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:35:30.117178917 CET | 6767 | 49984 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:35:30.117278099 CET | 49984 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:35:30.119679928 CET | 49984 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:35:30.121182919 CET | 49990 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:35:30.239384890 CET | 6767 | 49984 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:35:30.241092920 CET | 6767 | 49990 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:35:30.241177082 CET | 49990 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:35:30.373555899 CET | 49990 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:35:30.493263006 CET | 6767 | 49990 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:35:32.475733995 CET | 6767 | 49990 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:35:32.476066113 CET | 49990 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:35:36.198124886 CET | 49990 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:35:36.206829071 CET | 50000 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:35:36.318483114 CET | 6767 | 49990 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:35:36.327359915 CET | 6767 | 50000 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:35:36.330665112 CET | 50000 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:35:36.385890007 CET | 50000 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:35:36.506289005 CET | 6767 | 50000 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:35:38.291667938 CET | 50000 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:35:38.411817074 CET | 6767 | 50000 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:35:38.558907986 CET | 6767 | 50000 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:35:38.559021950 CET | 50000 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:35:43.416522980 CET | 50000 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:35:43.420130968 CET | 50002 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:35:43.536570072 CET | 6767 | 50000 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:35:43.542372942 CET | 6767 | 50002 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:35:43.542471886 CET | 50002 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:35:43.571397066 CET | 50002 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:35:43.691632032 CET | 6767 | 50002 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:35:44.635478973 CET | 50002 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:35:44.755059004 CET | 6767 | 50002 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:35:45.757842064 CET | 6767 | 50002 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:35:45.760287046 CET | 50002 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:35:49.651743889 CET | 50002 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:35:49.690571070 CET | 50003 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:35:49.772639990 CET | 6767 | 50002 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:35:49.810252905 CET | 6767 | 50003 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:35:49.816968918 CET | 50003 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:35:50.026246071 CET | 50003 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:35:50.145783901 CET | 6767 | 50003 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:35:51.245192051 CET | 50003 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:35:51.365607023 CET | 6767 | 50003 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:35:52.039841890 CET | 6767 | 50003 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:35:52.040008068 CET | 50003 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:35:55.310476065 CET | 50003 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:35:55.318779945 CET | 50004 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:35:55.430140972 CET | 6767 | 50003 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:35:55.438585997 CET | 6767 | 50004 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:35:55.438684940 CET | 50004 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:35:55.490000963 CET | 50004 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:35:55.609596014 CET | 6767 | 50004 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:35:55.609659910 CET | 50004 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:35:55.729307890 CET | 6767 | 50004 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:35:57.307588100 CET | 50004 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:35:57.427383900 CET | 6767 | 50004 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:35:57.696374893 CET | 6767 | 50004 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:35:57.697222948 CET | 50004 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:00.620471001 CET | 50004 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:00.626435995 CET | 50005 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:00.740029097 CET | 6767 | 50004 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:36:00.746196032 CET | 6767 | 50005 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:36:00.746264935 CET | 50005 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:00.786055088 CET | 50005 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:00.905742884 CET | 6767 | 50005 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:36:01.369769096 CET | 50005 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:01.489403009 CET | 6767 | 50005 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:36:01.489458084 CET | 50005 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:01.610841036 CET | 6767 | 50005 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:36:02.976962090 CET | 6767 | 50005 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:36:02.977044106 CET | 50005 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:06.557087898 CET | 50005 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:06.562412977 CET | 50006 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:06.677205086 CET | 6767 | 50005 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:36:06.682045937 CET | 6767 | 50006 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:36:06.682121992 CET | 50006 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:06.728024006 CET | 50006 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:06.847803116 CET | 6767 | 50006 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:36:07.057173967 CET | 50006 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:07.177052021 CET | 6767 | 50006 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:36:07.177109003 CET | 50006 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:07.298517942 CET | 6767 | 50006 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:36:08.914794922 CET | 6767 | 50006 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:36:08.914861917 CET | 50006 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:12.153434992 CET | 50006 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:12.161462069 CET | 50007 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:12.273111105 CET | 6767 | 50006 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:36:12.281296968 CET | 6767 | 50007 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:36:12.281526089 CET | 50007 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:12.448368073 CET | 50007 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:12.570337057 CET | 6767 | 50007 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:36:12.791830063 CET | 50007 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:12.911631107 CET | 6767 | 50007 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:36:14.509917021 CET | 6767 | 50007 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:36:14.510034084 CET | 50007 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:14.511544943 CET | 50007 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:14.511544943 CET | 50008 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:14.633972883 CET | 6767 | 50007 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:36:14.633991957 CET | 6767 | 50008 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:36:14.634218931 CET | 50008 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:14.705612898 CET | 50008 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:14.825490952 CET | 6767 | 50008 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:36:14.885267019 CET | 50008 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:15.005418062 CET | 6767 | 50008 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:36:15.041661978 CET | 50008 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:15.162569046 CET | 6767 | 50008 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:36:15.592147112 CET | 50008 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:15.711932898 CET | 6767 | 50008 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:36:16.135116100 CET | 50008 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:16.256041050 CET | 6767 | 50008 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:36:16.852710962 CET | 6767 | 50008 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:36:16.852790117 CET | 50008 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:20.697434902 CET | 50008 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:20.699078083 CET | 50009 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:20.817462921 CET | 6767 | 50008 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:36:20.819046021 CET | 6767 | 50009 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:36:20.819242954 CET | 50009 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:20.876785994 CET | 50009 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:20.996531963 CET | 6767 | 50009 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:36:23.071871996 CET | 6767 | 50009 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:36:23.071955919 CET | 50009 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:25.917503119 CET | 50009 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:25.925112009 CET | 50010 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:26.037072897 CET | 6767 | 50009 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:36:26.045360088 CET | 6767 | 50010 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:36:26.045825958 CET | 50010 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:26.126307964 CET | 50010 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:26.245985031 CET | 6767 | 50010 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:36:28.275042057 CET | 6767 | 50010 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:36:28.275579929 CET | 50010 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:31.306838989 CET | 50010 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:31.310734987 CET | 50011 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:31.426282883 CET | 6767 | 50010 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:36:31.430244923 CET | 6767 | 50011 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:36:31.430315971 CET | 50011 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:31.470278978 CET | 50011 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:31.590105057 CET | 6767 | 50011 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:36:31.590162039 CET | 50011 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:31.711983919 CET | 6767 | 50011 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:36:33.649290085 CET | 6767 | 50011 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:36:33.649379015 CET | 50011 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:36.588056087 CET | 50011 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:36.602932930 CET | 50012 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:36.707781076 CET | 6767 | 50011 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:36:36.723330021 CET | 6767 | 50012 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:36:36.723407030 CET | 50012 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:36.763053894 CET | 50012 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:36.884030104 CET | 6767 | 50012 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:36:36.884089947 CET | 50012 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:37.003882885 CET | 6767 | 50012 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:36:37.003946066 CET | 50012 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:37.322232008 CET | 50012 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:37.398243904 CET | 6767 | 50012 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:36:37.441921949 CET | 6767 | 50012 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:36:38.947593927 CET | 6767 | 50012 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:36:38.947664022 CET | 50012 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:42.010869026 CET | 50012 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:42.010874033 CET | 50013 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:42.130681992 CET | 6767 | 50012 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:36:42.130775928 CET | 6767 | 50013 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:36:42.131103039 CET | 50013 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:42.196151018 CET | 50013 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:42.315793037 CET | 6767 | 50013 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:36:44.368904114 CET | 6767 | 50013 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:36:44.370325089 CET | 50013 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:47.619299889 CET | 50013 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:47.623543978 CET | 50014 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:47.738838911 CET | 6767 | 50013 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:36:47.743019104 CET | 6767 | 50014 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:36:47.749496937 CET | 50014 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:48.009700060 CET | 50014 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:48.129394054 CET | 6767 | 50014 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:36:48.137037039 CET | 50014 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:48.257746935 CET | 6767 | 50014 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:36:49.978694916 CET | 6767 | 50014 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:36:49.979115963 CET | 50014 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:53.166220903 CET | 50014 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:53.170531034 CET | 50015 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:53.286288023 CET | 6767 | 50014 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:36:53.290282965 CET | 6767 | 50015 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:36:53.290349007 CET | 50015 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:53.351938963 CET | 50015 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:53.471749067 CET | 6767 | 50015 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:36:53.471806049 CET | 50015 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:53.591331005 CET | 6767 | 50015 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:36:55.510206938 CET | 6767 | 50015 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:36:55.510422945 CET | 50015 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:58.416141987 CET | 50015 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:58.424300909 CET | 50016 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:58.535773039 CET | 6767 | 50015 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:36:58.544487953 CET | 6767 | 50016 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:36:58.544615030 CET | 50016 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:58.714112043 CET | 50016 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:36:58.834526062 CET | 6767 | 50016 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:37:00.789385080 CET | 6767 | 50016 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:37:00.789457083 CET | 50016 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:37:03.775341988 CET | 50016 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:37:03.780886889 CET | 50017 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:37:03.895153046 CET | 6767 | 50016 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:37:03.900798082 CET | 6767 | 50017 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:37:03.902270079 CET | 50017 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:37:04.054075956 CET | 50017 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:37:04.173782110 CET | 6767 | 50017 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:37:04.291508913 CET | 50017 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:37:04.411519051 CET | 6767 | 50017 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:37:06.119595051 CET | 6767 | 50017 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:37:06.121289015 CET | 50017 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:37:09.228848934 CET | 50017 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:37:09.234253883 CET | 50018 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:37:09.348639011 CET | 6767 | 50017 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:37:09.354115963 CET | 6767 | 50018 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:37:09.354187012 CET | 50018 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:37:09.386980057 CET | 50018 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:37:09.506587029 CET | 6767 | 50018 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:37:11.603842020 CET | 6767 | 50018 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:37:11.603920937 CET | 50018 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:37:14.525481939 CET | 50018 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:37:14.531521082 CET | 50020 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:37:14.645524979 CET | 6767 | 50018 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:37:14.650950909 CET | 6767 | 50020 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:37:14.652237892 CET | 50020 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:37:14.817257881 CET | 50020 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:37:14.938275099 CET | 6767 | 50020 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:37:14.947338104 CET | 50020 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:37:15.067013025 CET | 6767 | 50020 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:37:15.067075014 CET | 50020 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:37:15.186539888 CET | 6767 | 50020 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:37:15.186589956 CET | 50020 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:37:15.306550980 CET | 6767 | 50020 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:37:15.306608915 CET | 50020 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:37:15.427903891 CET | 6767 | 50020 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:37:16.931704044 CET | 6767 | 50020 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:37:16.931765079 CET | 50020 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:37:20.291089058 CET | 50020 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:37:20.292484999 CET | 50021 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:37:20.410974979 CET | 6767 | 50020 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:37:20.412317038 CET | 6767 | 50021 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:37:20.412518978 CET | 50021 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:37:20.532336950 CET | 50021 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:37:20.652033091 CET | 6767 | 50021 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:37:20.652199030 CET | 50021 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:37:20.771960974 CET | 6767 | 50021 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:37:20.963010073 CET | 50021 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:37:21.083066940 CET | 6767 | 50021 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:37:22.541194916 CET | 50021 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:37:22.638467073 CET | 6767 | 50021 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:37:22.638813972 CET | 50021 | 6767 | 192.168.2.6 | 154.216.18.132 |
| Dec 18, 2024 15:37:22.661305904 CET | 6767 | 50021 | 154.216.18.132 | 192.168.2.6 |
| Dec 18, 2024 15:37:22.758302927 CET | 6767 | 50021 | 154.216.18.132 | 192.168.2.6 |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
| Target ID: | 0 |
| Start time: | 09:33:15 |
| Start date: | 18/12/2024 |
| Path: | C:\Users\user\Desktop\crypted_UClient.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff79d8b0000 |
| File size: | 543'144 bytes |
| MD5 hash: | C1BFA131BBDEF5F2E438D5C8BBAEF2CA |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Reputation: | low |
| Has exited: | false |
| Target ID: | 4 |
| Start time: | 09:34:15 |
| Start date: | 18/12/2024 |
| Path: | C:\Windows\System32\schtasks.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff61f2b0000 |
| File size: | 235'008 bytes |
| MD5 hash: | 76CD6626DD8834BD4A42E6A565104DC2 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 5 |
| Start time: | 09:34:15 |
| Start date: | 18/12/2024 |
| Path: | C:\Windows\System32\conhost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff66e660000 |
| File size: | 862'208 bytes |
| MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 6 |
| Start time: | 09:34:18 |
| Start date: | 18/12/2024 |
| Path: | C:\Users\user\AppData\Roaming\UClient.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff718c20000 |
| File size: | 543'144 bytes |
| MD5 hash: | C1BFA131BBDEF5F2E438D5C8BBAEF2CA |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Antivirus matches: |
|
| Reputation: | low |
| Has exited: | true |
| Target ID: | 9 |
| Start time: | 09:34:27 |
| Start date: | 18/12/2024 |
| Path: | C:\Users\user\AppData\Roaming\UClient.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff718c20000 |
| File size: | 543'144 bytes |
| MD5 hash: | C1BFA131BBDEF5F2E438D5C8BBAEF2CA |
| Has elevated privileges: | false |
| Has administrator privileges: | false |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Reputation: | low |
| Has exited: | true |
| Target ID: | 10 |
| Start time: | 09:34:36 |
| Start date: | 18/12/2024 |
| Path: | C:\Users\user\AppData\Roaming\UClient.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff718c20000 |
| File size: | 543'144 bytes |
| MD5 hash: | C1BFA131BBDEF5F2E438D5C8BBAEF2CA |
| Has elevated privileges: | false |
| Has administrator privileges: | false |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Reputation: | low |
| Has exited: | true |
| Target ID: | 11 |
| Start time: | 09:37:00 |
| Start date: | 18/12/2024 |
| Path: | C:\Users\user\AppData\Roaming\UClient.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff718c20000 |
| File size: | 543'144 bytes |
| MD5 hash: | C1BFA131BBDEF5F2E438D5C8BBAEF2CA |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | low |
| Has exited: | false |
Execution Graph
| Execution Coverage: | 56.4% |
| Dynamic/Decrypted Code Coverage: | 11.9% |
| Signature Coverage: | 49.5% |
| Total number of Nodes: | 734 |
| Total number of Limit Nodes: | 6 |
Graph
Function 00007FF79D8C8DB1 Relevance: 54.6, APIs: 9, Strings: 11, Instructions: 19632memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00007FFD345F6816 Relevance: .5, Instructions: 470COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD345F75C2 Relevance: .5, Instructions: 456COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0000025191F6BBB7 Relevance: .4, Instructions: 409COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00007FFD345F1541 Relevance: .2, Instructions: 193COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0000025191F6CFE7 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 104libraryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Control-flow Graph
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD345F71D6 Relevance: .3, Instructions: 329COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD345F0330 Relevance: .3, Instructions: 292COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD345F89E5 Relevance: .3, Instructions: 283COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD345F8A25 Relevance: .3, Instructions: 273COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD345F0198 Relevance: .3, Instructions: 259COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD345F8A70 Relevance: .2, Instructions: 250COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD345F7FAD Relevance: .2, Instructions: 211COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD345F1234 Relevance: .2, Instructions: 200COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD345F2348 Relevance: .2, Instructions: 199COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD345F3D0C Relevance: .2, Instructions: 195COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD345F2078 Relevance: .2, Instructions: 193COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD345F0CB2 Relevance: .2, Instructions: 192COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD345F0358 Relevance: .2, Instructions: 184COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD345F12A5 Relevance: .2, Instructions: 161COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD345F833D Relevance: .2, Instructions: 160COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD345F0882 Relevance: .2, Instructions: 155COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD345F02E8 Relevance: .1, Instructions: 146COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD345F8521 Relevance: .1, Instructions: 142COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD345F87EE Relevance: .1, Instructions: 141COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD345F00C0 Relevance: .1, Instructions: 139COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD345F0328 Relevance: .1, Instructions: 133COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD345F1F3D Relevance: .1, Instructions: 131COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD345F81D9 Relevance: .1, Instructions: 126COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD345F0FDC Relevance: .1, Instructions: 123COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD345F1113 Relevance: .1, Instructions: 115COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD345F2D35 Relevance: .1, Instructions: 106COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD345F09F8 Relevance: .1, Instructions: 106COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD345F9781 Relevance: .1, Instructions: 102COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD345F0ADD Relevance: .1, Instructions: 95COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD345F0711 Relevance: .1, Instructions: 94COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD345F9561 Relevance: .1, Instructions: 92COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD345F968D Relevance: .1, Instructions: 90COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD345F0B7E Relevance: .1, Instructions: 90COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD345F0D9D Relevance: .1, Instructions: 84COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD345F0730 Relevance: .1, Instructions: 80COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD345F0368 Relevance: .1, Instructions: 78COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD345F7D20 Relevance: .1, Instructions: 68COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD345F0300 Relevance: .1, Instructions: 58COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD345F16F9 Relevance: .1, Instructions: 57COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD345F177D Relevance: .1, Instructions: 52COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD345F1790 Relevance: .0, Instructions: 45COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD345F1E99 Relevance: .0, Instructions: 44COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD345F8853 Relevance: .0, Instructions: 40COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD345F0B29 Relevance: .0, Instructions: 32COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD345F96FD Relevance: .0, Instructions: 29COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD345F0EE9 Relevance: .0, Instructions: 27COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD345F0F97 Relevance: .0, Instructions: 26COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD345F0800 Relevance: .0, Instructions: 26COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD345F1202 Relevance: .0, Instructions: 19COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD345F2FE3 Relevance: .0, Instructions: 18COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD345F2EB4 Relevance: .0, Instructions: 16COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD345F2E85 Relevance: .0, Instructions: 16COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD345F2F56 Relevance: .0, Instructions: 16COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD345F1EDD Relevance: .0, Instructions: 16COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD345F2FB4 Relevance: .0, Instructions: 16COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD345F2F85 Relevance: .0, Instructions: 16COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD345F036D Relevance: .0, Instructions: 10COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FFD345F1E60 Relevance: .0, Instructions: 7COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|