Edit tour
Windows
Analysis Report
5Ixz5yVfS7.exe
Overview
General Information
| Sample name: | 5Ixz5yVfS7.exerenamed because original name is a hash value |
| Original sample name: | 7b4eccf10cc4fa7263646f2fce4d7f8b.exe |
| Analysis ID: | 1583156 |
| MD5: | 7b4eccf10cc4fa7263646f2fce4d7f8b |
| SHA1: | 06111e9aa4ae84c68208e3800ad757f1eb80c227 |
| SHA256: | 752b44a9225f3423d045835f61cedc897696680e2caeead0d472f367da14e898 |
| Tags: | DCRatexeuser-abuse_ch |
| Infos: |   |
 | |
Detection
DCRat
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Antivirus detection for dropped file
Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected DCRat
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
AI detected suspicious sample
Machine Learning detection for dropped file
Machine Learning detection for sample
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to communicate with device drivers
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
File is packed with WinRar
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found evasive API chain (date check)
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Classification
- System is w10x64
5Ixz5yVfS7.exe (PID: 5504 cmdline: "C:\Users\ user\Deskt op\5Ixz5yV fS7.exe" MD5: 7B4ECCF10CC4FA7263646F2FCE4D7F8B) 
wscript.exe (PID: 5908 cmdline: "C:\Window s\System32 \WScript.e xe" "C:\Us ers\user\A ppData\Loc al\Temp\Co mponentfon tintoDll\N 5OHKOq3jR1 X.vbe" MD5: FF00E0480075B095948000BDC66E81F0) 
cmd.exe (PID: 5588 cmdline: C:\Windows \system32\ cmd.exe /c ""C:\User s\user\App Data\Local \Temp\Comp onentfonti ntoDll\H0D kZX.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 6720 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
Bridgecontainer.exe (PID: 5688 cmdline: "C:\Users\ user\AppDa ta\Local\T emp\Compon entfontint oDll\Bridg econtainer .exe" MD5: 21879480EBF05FF55A58FC933CB818A4)
- cleanup
| Name | Description | Attribution | Blogpost URLs | Link |
|---|---|---|---|---|
| DCRat | DCRat is a typical RAT that has been around since at least June 2019. | No Attribution |
{"SCRT": "{\"1\":\"%\",\"6\":\"!\",\"I\":\"#\",\"H\":\">\",\"S\":\"$\",\"3\":\",\",\"9\":\"<\",\"5\":\"*\",\"A\":\"|\",\"i\":\"(\",\"G\":\"`\",\"4\":\"@\",\"U\":\".\",\"k\":\"~\",\"y\":\";\",\"2\":\")\",\"L\":\"^\",\"W\":\"_\",\"o\":\"-\",\"h\":\"&\",\"0\":\" \"}", "PCRT": "{\"0\":\";\",\"=\":\"(\",\"y\":\")\",\"I\":\"&\",\"x\":\"_\",\"w\":\".\",\"e\":\"$\",\"S\":\"#\",\"M\":\"%\",\"i\":\"-\",\"f\":\"!\",\"p\":\"`\",\"l\":\" \",\"j\":\"<\",\"X\":\"*\",\"b\":\"|\",\"Q\":\">\",\"6\":\",\",\"D\":\"@\",\"c\":\"^\"}", "TAG": "", "MUTEX": "xuesos_pidorasovich_dcratovich", "LDTM": false, "DBG": false, "SST": 5, "SMST": 2, "BCS": 0, "AUR": 0, "ASCFG": {"searchpath": "%UsersFolder% - Fast"}, "AS": false, "ASO": false, "AD": false}| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_DCRat_3 | Yara detected DCRat | Joe Security | ||
| JoeSecurity_DCRat_3 | Yara detected DCRat | Joe Security | ||
| JoeSecurity_DCRat_3 | Yara detected DCRat | Joe Security | ||
| JoeSecurity_DCRat_1 | Yara detected DCRat | Joe Security | ||
| JoeSecurity_DCRat_3 | Yara detected DCRat | Joe Security | ||
| Click to see the 4 entries | ||||
System Summary |   |
|---|
| Source: | Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): | ||
| Source: | Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: | ||
| Source: | Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: | ||
| Source: | Author: Michael Haag: | ||
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2025-01-02T05:17:06.085876+0100 | 2034194 | 1 | A Network Trojan was detected | 192.168.2.5 | 49704 | 141.8.192.151 | 80 | TCP |
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2025-01-02T05:17:12.379192+0100 | 2850862 | 1 | Malware Command and Control Activity Detected | 141.8.192.151 | 80 | 192.168.2.5 | 49706 | TCP |
| 2025-01-02T05:18:27.514248+0100 | 2850862 | 1 | Malware Command and Control Activity Detected | 141.8.192.151 | 80 | 192.168.2.5 | 49987 | TCP |
| 2025-01-02T05:20:28.241324+0100 | 2850862 | 1 | Malware Command and Control Activity Detected | 141.8.192.151 | 80 | 192.168.2.5 | 50009 | TCP |
Click to jump to signature section
Show All Signature Results
AV Detection | |
|---|
| Source: | Avira: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira: | ||
| Source: | Avira: | ||
| Source: | Malware Configuration Extractor: | ||
| Source: | ReversingLabs: | ||
| Source: | ReversingLabs: | |||
| Source: | Virustotal: | Perma Link | ||
| Source: | Integrated Neural Analysis Model: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
| Source: | Code function: | 0_2_0059A5F4 | |
| Source: | Code function: | 0_2_005AB8E0 | |
| Source: | Code function: | 0_2_005BAAA8 | |
Networking | |
|---|
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | IP Address: | ||
| Source: | IP Address: | ||
| Source: | ASN Name: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
System Summary | |
|---|
| Source: | COM Object queried: | Jump to behavior | ||
| Source: | Process Stats: | ||
| Source: | Code function: | 0_2_0059718C | |
| Source: | Code function: | 0_2_0059857B | |
| Source: | Code function: | 0_2_0059407E | |
| Source: | Code function: | 0_2_005BD00E | |
| Source: | Code function: | 0_2_005A70BF | |
| Source: | Code function: | 0_2_005C1194 | |
| Source: | Code function: | 0_2_005B02F6 | |
| Source: | Code function: | 0_2_00593281 | |
| Source: | Code function: | 0_2_0059E2A0 | |
| Source: | Code function: | 0_2_005A6646 | |
| Source: | Code function: | 0_2_005B070E | |
| Source: | Code function: | 0_2_005B473A | |
| Source: | Code function: | 0_2_005A37C1 | |
| Source: | Code function: | 0_2_005927E8 | |
| Source: | Code function: | 0_2_0059E8A0 | |
| Source: | Code function: | 0_2_0059F968 | |
| Source: | Code function: | 0_2_005B4969 | |
| Source: | Code function: | 0_2_005A6A7B | |
| Source: | Code function: | 0_2_005A3A3C | |
| Source: | Code function: | 0_2_005B0B43 | |
| Source: | Code function: | 0_2_005BCB60 | |
| Source: | Code function: | 0_2_005A5C77 | |
| Source: | Code function: | 0_2_005A3D6D | |
| Source: | Code function: | 0_2_0059ED14 | |
| Source: | Code function: | 0_2_005AFDFA | |
| Source: | Code function: | 0_2_0059DE6C | |
| Source: | Code function: | 0_2_0059BE13 | |
| Source: | Code function: | 0_2_005B0F78 | |
| Source: | Code function: | 0_2_00595F3C | |
| Source: | Code function: | 5_2_00007FF848F133B0 | |
| Source: | Code function: | 5_2_00007FF848F1AEED | |
| Source: | Code function: | 5_2_00007FF848F1B075 | |
| Source: | Code function: | 5_2_00007FF848F1CF88 | |
| Source: | Code function: | 5_2_00007FF848F1B070 | |
| Source: | Code function: | 5_2_00007FF848F1C9D8 | |
| Source: | Code function: | 5_2_00007FF848F1A037 | |
| Source: | Code function: | 5_2_00007FF848F12C18 | |
| Source: | Code function: | 5_2_00007FF848F1A037 | |
| Source: | Code function: | 5_2_00007FF848F12C18 | |
| Source: | Static PE information: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Static PE information: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Security API names: | ||
| Source: | Binary or memory string: | ||
| Source: | Classification label: | ||
| Source: | Code function: | 0_2_00596EC9 | |
| Source: | Code function: | 0_2_005A9E1C | |
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Process created: | ||
| Source: | Command line argument: | 0_2_005AD5D4 | |
| Source: | Command line argument: | 0_2_005AD5D4 | |
| Source: | Command line argument: | 0_2_005AD5D4 | |
| Source: | Command line argument: | 0_2_005AD5D4 | |
| Source: | Static PE information: | ||
| Source: | Static file information: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | ReversingLabs: | ||
| Source: | Virustotal: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Key value queried: | Jump to behavior | ||
| Source: | Window detected: | ||
| Source: | Static file information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
Data Obfuscation | |
|---|
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | Code function: | 0_2_005AE2AA | |
| Source: | Code function: | 0_2_005AED59 | |
| Source: | Code function: | 5_2_00007FF848F1B139 | |
| Source: | Code function: | 5_2_00007FF848F12CC1 | |
| Source: | Code function: | 5_2_00007FF848F12CC1 | |
| Source: | Code function: | 5_2_00007FF848F12CC1 | |
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | High entropy of concatenated method names: | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
Malware Analysis System Evasion | |
|---|
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Window found: | Jump to behavior | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Evasive API call chain: | graph_0-23035 | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Last function: | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | Code function: | 0_2_0059A5F4 | |
| Source: | Code function: | 0_2_005AB8E0 | |
| Source: | Code function: | 0_2_005BAAA8 | |
| Source: | Code function: | 0_2_005ADD72 | |
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | API call chain: | graph_0-23370 | ||
| Source: | Process information queried: | Jump to behavior | ||
| Source: | Code function: | 0_2_005B866F | |
| Source: | Code function: | 0_2_005B753D | |
| Source: | Code function: | 0_2_005BB710 | |
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Code function: | 0_2_005AF063 | |
| Source: | Code function: | 0_2_005AF22B | |
| Source: | Code function: | 0_2_005B866F | |
| Source: | Code function: | 0_2_005AEF05 | |
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Code function: | 0_2_005AED5B | |
| Source: | Code function: | 0_2_005AA63C | |
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Code function: | 0_2_005AD5D4 | |
| Source: | Code function: | 0_2_0059ACF5 | |
| Source: | Key value queried: | Jump to behavior | ||
Stealing of Sensitive Information | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
Remote Access Functionality | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | 11 Scripting | Valid Accounts | 2 Command and Scripting Interpreter | 11 Scripting | 12 Process Injection | 1 Disable or Modify Tools | OS Credential Dumping | 1 System Time Discovery | Remote Services | 11 Archive Collected Data | 1 Encrypted Channel | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
| Credentials | Domains | Default Accounts | 1 Native API | 1 DLL Side-Loading | 1 DLL Side-Loading | 131 Virtualization/Sandbox Evasion | LSASS Memory | 221 Security Software Discovery | Remote Desktop Protocol | Data from Removable Media | 1 Ingress Tool Transfer | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | Logon Script (Windows) | 12 Process Injection | Security Account Manager | 2 Process Discovery | SMB/Windows Admin Shares | Data from Network Shared Drive | 2 Non-Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | 11 Deobfuscate/Decode Files or Information | NTDS | 131 Virtualization/Sandbox Evasion | Distributed Component Object Model | Input Capture | 12 Application Layer Protocol | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | Network Logon Script | 2 Obfuscated Files or Information | LSA Secrets | 1 Application Window Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
| Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | 21 Software Packing | Cached Domain Credentials | 2 File and Directory Discovery | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
| DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | 1 DLL Side-Loading | DCSync | 136 System Information Discovery | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 68% | ReversingLabs | ByteCode-MSIL.Backdoor.DCRat | ||
| 58% | Virustotal | Browse | ||
| 100% | Avira | VBS/Runner.VPG | ||
| 100% | Joe Sandbox ML |
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 100% | Avira | HEUR/AGEN.1323984 | ||
| 100% | Avira | VBS/Runner.VPG | ||
| 100% | Joe Sandbox ML | |||
| 79% | ReversingLabs | ByteCode-MSIL.Backdoor.DCRat |
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 100% | Avira URL Cloud | malware | ||
| 100% | Avira URL Cloud | malware | ||
| 100% | Avira URL Cloud | malware | ||
| 100% | Avira URL Cloud | malware |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| f1069581.xsph.ru | 141.8.192.151 | true | true | unknown |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| true |
| unknown |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 141.8.192.151 | f1069581.xsph.ru | Russian Federation | 35278 | SPRINTHOSTRU | true |
| Joe Sandbox version: | 41.0.0 Charoite |
| Analysis ID: | 1583156 |
| Start date and time: | 2025-01-02 05:16:07 +01:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 7m 47s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 8 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | 5Ixz5yVfS7.exerenamed because original name is a hash value |
| Original Sample Name: | 7b4eccf10cc4fa7263646f2fce4d7f8b.exe |
| Detection: | MAL |
| Classification: | mal100.troj.evad.winEXE@9/3@1/1 |
| EGA Information: |
|
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
- Excluded IPs from analysis (whitelisted): 52.149.20.212, 13.107.246.45
- Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
- Execution Graph export aborted for target Bridgecontainer.exe, PID 5688 because it is empty
- Not all processes where analyzed, report is missing behavior information
- Report size exceeded maximum capacity and may have missing behavior information.
- Report size getting too big, too many NtAllocateVirtualMemory calls found.
- Report size getting too big, too many NtOpenKeyEx calls found.
- Report size getting too big, too many NtProtectVirtualMemory calls found.
- Report size getting too big, too many NtQueryValueKey calls found.
| Time | Type | Description |
|---|---|---|
| 23:17:05 | API Interceptor |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 141.8.192.151 | Get hash | malicious | Panda Stealer | Browse |
| |
| Get hash | malicious | Panda Stealer | Browse |
| ||
| Get hash | malicious | Azorult | Browse |
| ||
| Get hash | malicious | Phoenix Miner, ccminer | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Remcos | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Snake Keylogger | Browse |
|
⊘No context
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| SPRINTHOSTRU | Get hash | malicious | DCRat | Browse |
| |
| Get hash | malicious | LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc | Browse |
| ||
| Get hash | malicious | Clipboard Hijacker, Cryptbot | Browse |
| ||
| Get hash | malicious | Clipboard Hijacker, Cryptbot | Browse |
| ||
| Get hash | malicious | Cryptbot | Browse |
| ||
| Get hash | malicious | Clipboard Hijacker, Cryptbot | Browse |
| ||
| Get hash | malicious | Clipboard Hijacker, Cryptbot | Browse |
| ||
| Get hash | malicious | Clipboard Hijacker, Cryptbot | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, Stealc | Browse |
|
⊘No context
⊘No context
| Process: | C:\Users\user\Desktop\5Ixz5yVfS7.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 847872 |
| Entropy (8bit): | 6.081704750510667 |
| Encrypted: | false |
| SSDEEP: | 12288:q82QUxESNOxxm8y5MahZvz0sPlgEjhoiXhQVOyYimx6d/FYt5fXyIs7xFPEEB:LU2xxm8eFjhoiRQROImS/7xFPd |
| MD5: | 21879480EBF05FF55A58FC933CB818A4 |
| SHA1: | 24E6E72AC0E45DC8B66502CBB154A695BCC6A36E |
| SHA-256: | 3C9BCD2B3DFAEDBB4F5D3A449917AC4A8CEE2F06E6FDAFF5FA2EC9CA6A56AE59 |
| SHA-512: | A055FF6A5CD853761BA3445C7D4DC40528859EB486CBD09AAED87573AC73449CDC9B07C94324B94257F2DE43373BBF1B190B9CE9C242966E9C9F8D6E90F4D61B |
| Malicious: | true |
| Antivirus: |
|
| Reputation: | low |
| Preview: |
| Process: | C:\Users\user\Desktop\5Ixz5yVfS7.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 49 |
| Entropy (8bit): | 4.19870825257941 |
| Encrypted: | false |
| SSDEEP: | 3:5IlTVKdKqBVX0di:5IX7qBudi |
| MD5: | DB4D25A773EE938F539451FD566C88A9 |
| SHA1: | C97BA1C8EC9617FFBD995395EF142E0A3C89AEA2 |
| SHA-256: | 056F774D8D53A657C2F4FDCE7AB0F582771F76E831A3F8890AFE5DC083B7596F |
| SHA-512: | 5A99DDD8965D6CE1436ACF5371CABE4BB41DE830324B5FCE92FC74C7312C98DCB2CF1DD3C0D2B328E62B481BC34CA942D563B8B7D781ED7598FF7BA42ACC549F |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Users\user\Desktop\5Ixz5yVfS7.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 207 |
| Entropy (8bit): | 5.792659830467576 |
| Encrypted: | false |
| SSDEEP: | 6:GLwqK+NkLzWbHK/818nZNDd3RL1wQJRQdmQ/7Hif1:GiMCzWLKG4d3XBJbW7M |
| MD5: | E115EF6D0CA1F43393A02610609CDB14 |
| SHA1: | 09DA58489CA5BF69FB1C597B96D08997CC4EAFBC |
| SHA-256: | 43C90790C5676FA543398A25C1485A8D5C08AF1A8411BBE0E8810785EE44AD29 |
| SHA-512: | 3B4C9BD9B92F7B078519523798839E03AC7A9CA0D8AB480E9BABDFA3C7141B0A75A6E4FA956D875D7CAF8B26CFD368D45F1C4F635AA7FD67F05923BFFE25550E |
| Malicious: | true |
| Antivirus: |
|
| Reputation: | low |
| Preview: |
| File type: | |
| Entropy (8bit): | 6.373996791003091 |
| TrID: |
|
| File name: | 5Ixz5yVfS7.exe |
| File size: | 1'164'920 bytes |
| MD5: | 7b4eccf10cc4fa7263646f2fce4d7f8b |
| SHA1: | 06111e9aa4ae84c68208e3800ad757f1eb80c227 |
| SHA256: | 752b44a9225f3423d045835f61cedc897696680e2caeead0d472f367da14e898 |
| SHA512: | f5a38968e235a8750eb5b18e4202bbb275d51e35a0461955720507adcb902b5f8a6d6b59b940f96df66800278fff3cd14e388811d57766d0dfc24f603879fb93 |
| SSDEEP: | 24576:U2G/nvxW3Ww0tNU2xxm8eFjhoiRQROImS/7xFPdp:UbA30NU+UtEj/9FD |
| TLSH: | 01455A027E44CE12F4191633C6FF492447B4AC552AA6E72B7EBA376D55223937C0CACB |
| File Content Preview: | MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b`..&...&...&.....h.+.....j.......k.>.....^.$...._..0...._..5...._....../y..,.../y..#...&...*...._......._..'...._f.'...._..'.. |
 | |
| Icon Hash: | 1515d4d4442f2d2d |
| Entrypoint: | 0x41ec40 |
| Entrypoint Section: | .text |
| Digitally signed: | false |
| Imagebase: | 0x400000 |
| Subsystem: | windows gui |
| Image File Characteristics: | EXECUTABLE_IMAGE, 32BIT_MACHINE |
| DLL Characteristics: | DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x5FC684D7 [Tue Dec 1 18:00:55 2020 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 5 |
| OS Version Minor: | 1 |
| File Version Major: | 5 |
| File Version Minor: | 1 |
| Subsystem Version Major: | 5 |
| Subsystem Version Minor: | 1 |
| Import Hash: | fcf1390e9ce472c7270447fc5c61a0c1 |
| Instruction |
|---|
| call 00007FDD48E3CC49h |
| jmp 00007FDD48E3C65Dh |
| cmp ecx, dword ptr [0043E668h] |
| jne 00007FDD48E3C7D5h |
| ret |
| jmp 00007FDD48E3CDCEh |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| push ebp |
| mov ebp, esp |
| push esi |
| push dword ptr [ebp+08h] |
| mov esi, ecx |
| call 00007FDD48E2F567h |
| mov dword ptr [esi], 00435580h |
| mov eax, esi |
| pop esi |
| pop ebp |
| retn 0004h |
| and dword ptr [ecx+04h], 00000000h |
| mov eax, ecx |
| and dword ptr [ecx+08h], 00000000h |
| mov dword ptr [ecx+04h], 00435588h |
| mov dword ptr [ecx], 00435580h |
| ret |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| lea eax, dword ptr [ecx+04h] |
| mov dword ptr [ecx], 00435568h |
| push eax |
| call 00007FDD48E3F96Dh |
| pop ecx |
| ret |
| push ebp |
| mov ebp, esp |
| sub esp, 0Ch |
| lea ecx, dword ptr [ebp-0Ch] |
| call 00007FDD48E2F4FEh |
| push 0043B704h |
| lea eax, dword ptr [ebp-0Ch] |
| push eax |
| call 00007FDD48E3F082h |
| int3 |
| push ebp |
| mov ebp, esp |
| sub esp, 0Ch |
| lea ecx, dword ptr [ebp-0Ch] |
| call 00007FDD48E3C774h |
| push 0043B91Ch |
| lea eax, dword ptr [ebp-0Ch] |
| push eax |
| call 00007FDD48E3F065h |
| int3 |
| jmp 00007FDD48E410B3h |
| jmp dword ptr [00433260h] |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| push 00421EB0h |
| push dword ptr fs:[00000000h] |
| Programming Language: |
|
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x3c820 | 0x34 | .rdata |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0x3c854 | 0x3c | .rdata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x63000 | 0xdfd0 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x71000 | 0x2268 | .reloc |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0x3aac0 | 0x54 | .rdata |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x35508 | 0x40 | .rdata |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x33000 | 0x260 | .rdata |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x3bdc4 | 0x120 | .rdata |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x310ea | 0x31200 | c5bf61bbedb6ad471e9dc6266398e965 | False | 0.583959526081425 | data | 6.708075396341128 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .rdata | 0x33000 | 0xa612 | 0xa800 | 7980b588d5b28128a2f3c36cabe2ce98 | False | 0.45284598214285715 | data | 5.221742709250668 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .data | 0x3e000 | 0x23728 | 0x1000 | 201530c9e56f172adf2473053298d48f | False | 0.36767578125 | data | 3.7088186669877685 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .didat | 0x62000 | 0x188 | 0x200 | c5d41d8f254f69e567595ab94266cfdc | False | 0.4453125 | data | 3.2982538067961342 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .rsrc | 0x63000 | 0xdfd0 | 0xe000 | f6c0f34fae6331b50a7ad2efc4bfefdb | False | 0.6370326450892857 | data | 6.6367506404157535 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .reloc | 0x71000 | 0x2268 | 0x2400 | c7a942b723cb29d9c02f7c611b544b50 | False | 0.7681206597222222 | data | 6.5548620101740545 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| PNG | 0x63650 | 0xb45 | PNG image data, 93 x 302, 8-bit/color RGB, non-interlaced | English | United States | 1.0027729636048528 |
| PNG | 0x64198 | 0x15a9 | PNG image data, 186 x 604, 8-bit/color RGB, non-interlaced | English | United States | 0.9363390441839495 |
| RT_ICON | 0x65748 | 0x568 | Device independent bitmap graphic, 16 x 32 x 8, image size 256, resolution 2834 x 2834 px/m, 256 important colors | English | United States | 0.47832369942196534 |
| RT_ICON | 0x65cb0 | 0x8a8 | Device independent bitmap graphic, 32 x 64 x 8, image size 1024, resolution 2834 x 2834 px/m, 256 important colors | English | United States | 0.5410649819494585 |
| RT_ICON | 0x66558 | 0xea8 | Device independent bitmap graphic, 48 x 96 x 8, image size 2304, resolution 2834 x 2834 px/m, 256 important colors | English | United States | 0.4933368869936034 |
| RT_ICON | 0x67400 | 0x468 | Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2834 x 2834 px/m | English | United States | 0.5390070921985816 |
| RT_ICON | 0x67868 | 0x10a8 | Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2834 x 2834 px/m | English | United States | 0.41393058161350843 |
| RT_ICON | 0x68910 | 0x25a8 | Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2834 x 2834 px/m | English | United States | 0.3479253112033195 |
| RT_ICON | 0x6aeb8 | 0x3d71 | PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced | English | United States | 0.9809269502193401 |
| RT_DIALOG | 0x6f588 | 0x286 | data | English | United States | 0.5092879256965944 |
| RT_DIALOG | 0x6f358 | 0x13a | data | English | United States | 0.60828025477707 |
| RT_DIALOG | 0x6f498 | 0xec | data | English | United States | 0.6991525423728814 |
| RT_DIALOG | 0x6f228 | 0x12e | data | English | United States | 0.5927152317880795 |
| RT_DIALOG | 0x6eef0 | 0x338 | data | English | United States | 0.45145631067961167 |
| RT_DIALOG | 0x6ec98 | 0x252 | data | English | United States | 0.5757575757575758 |
| RT_STRING | 0x6ff68 | 0x1e2 | data | English | United States | 0.3900414937759336 |
| RT_STRING | 0x70150 | 0x1cc | data | English | United States | 0.4282608695652174 |
| RT_STRING | 0x70320 | 0x1b8 | data | English | United States | 0.45681818181818185 |
| RT_STRING | 0x704d8 | 0x146 | data | English | United States | 0.5153374233128835 |
| RT_STRING | 0x70620 | 0x446 | data | English | United States | 0.340036563071298 |
| RT_STRING | 0x70a68 | 0x166 | data | English | United States | 0.49162011173184356 |
| RT_STRING | 0x70bd0 | 0x152 | data | English | United States | 0.5059171597633136 |
| RT_STRING | 0x70d28 | 0x10a | data | English | United States | 0.49624060150375937 |
| RT_STRING | 0x70e38 | 0xbc | data | English | United States | 0.6329787234042553 |
| RT_STRING | 0x70ef8 | 0xd6 | data | English | United States | 0.5747663551401869 |
| RT_GROUP_ICON | 0x6ec30 | 0x68 | data | English | United States | 0.7019230769230769 |
| RT_MANIFEST | 0x6f810 | 0x753 | XML 1.0 document, ASCII text, with CRLF line terminators | English | United States | 0.3957333333333333 |
| DLL | Import |
|---|---|
| KERNEL32.dll | GetLastError, SetLastError, FormatMessageW, GetCurrentProcess, DeviceIoControl, SetFileTime, CloseHandle, CreateDirectoryW, RemoveDirectoryW, CreateFileW, DeleteFileW, CreateHardLinkW, GetShortPathNameW, GetLongPathNameW, MoveFileW, GetFileType, GetStdHandle, WriteFile, ReadFile, FlushFileBuffers, SetEndOfFile, SetFilePointer, SetFileAttributesW, GetFileAttributesW, FindClose, FindFirstFileW, FindNextFileW, GetVersionExW, GetCurrentDirectoryW, GetFullPathNameW, FoldStringW, GetModuleFileNameW, GetModuleHandleW, FindResourceW, FreeLibrary, GetProcAddress, GetCurrentProcessId, ExitProcess, SetThreadExecutionState, Sleep, LoadLibraryW, GetSystemDirectoryW, CompareStringW, AllocConsole, FreeConsole, AttachConsole, WriteConsoleW, GetProcessAffinityMask, CreateThread, SetThreadPriority, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, SetEvent, ResetEvent, ReleaseSemaphore, WaitForSingleObject, CreateEventW, CreateSemaphoreW, GetSystemTime, SystemTimeToTzSpecificLocalTime, TzSpecificLocalTimeToSystemTime, SystemTimeToFileTime, FileTimeToLocalFileTime, LocalFileTimeToFileTime, FileTimeToSystemTime, GetCPInfo, IsDBCSLeadByte, MultiByteToWideChar, WideCharToMultiByte, GlobalAlloc, LockResource, GlobalLock, GlobalUnlock, GlobalFree, LoadResource, SizeofResource, SetCurrentDirectoryW, GetExitCodeProcess, GetLocalTime, GetTickCount, MapViewOfFile, UnmapViewOfFile, CreateFileMappingW, OpenFileMappingW, GetCommandLineW, SetEnvironmentVariableW, ExpandEnvironmentStringsW, GetTempPathW, MoveFileExW, GetLocaleInfoW, GetTimeFormatW, GetDateFormatW, GetNumberFormatW, SetFilePointerEx, GetConsoleMode, GetConsoleCP, HeapSize, SetStdHandle, GetProcessHeap, RaiseException, GetSystemInfo, VirtualProtect, VirtualQuery, LoadLibraryExA, IsProcessorFeaturePresent, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, TerminateProcess, RtlUnwind, EncodePointer, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, QueryPerformanceFrequency, GetModuleHandleExW, GetModuleFileNameA, GetACP, HeapFree, HeapAlloc, HeapReAlloc, GetStringTypeW, LCMapStringW, FindFirstFileExA, FindNextFileA, IsValidCodePage, GetOEMCP, GetCommandLineA, GetEnvironmentStringsW, FreeEnvironmentStringsW, DecodePointer |
| gdiplus.dll | GdiplusShutdown, GdiplusStartup, GdipCreateHBITMAPFromBitmap, GdipCreateBitmapFromStreamICM, GdipCreateBitmapFromStream, GdipDisposeImage, GdipCloneImage, GdipFree, GdipAlloc |
| Language of compilation system | Country where language is spoken | Map |
|---|---|---|
| English | United States |  |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | SID | Signature | Severity | Source IP | Source Port | Dest IP | Dest Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2025-01-02T05:17:06.085876+0100 | 2034194 | ET MALWARE DCRAT Activity (GET) | 1 | 192.168.2.5 | 49704 | 141.8.192.151 | 80 | TCP |
| 2025-01-02T05:17:12.379192+0100 | 2850862 | ETPRO MALWARE DCRat Initial Checkin Server Response M4 | 1 | 141.8.192.151 | 80 | 192.168.2.5 | 49706 | TCP |
| 2025-01-02T05:18:27.514248+0100 | 2850862 | ETPRO MALWARE DCRat Initial Checkin Server Response M4 | 1 | 141.8.192.151 | 80 | 192.168.2.5 | 49987 | TCP |
| 2025-01-02T05:20:28.241324+0100 | 2850862 | ETPRO MALWARE DCRat Initial Checkin Server Response M4 | 1 | 141.8.192.151 | 80 | 192.168.2.5 | 50009 | TCP |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Jan 2, 2025 05:17:05.233977079 CET | 49704 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:05.238905907 CET | 80 | 49704 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:17:05.239003897 CET | 49704 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:05.239795923 CET | 49704 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:05.244545937 CET | 80 | 49704 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:17:06.085664988 CET | 80 | 49704 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:17:06.085701942 CET | 80 | 49704 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:17:06.085712910 CET | 80 | 49704 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:17:06.085875988 CET | 49704 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:06.171778917 CET | 80 | 49704 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:17:06.224571943 CET | 49704 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:06.470499039 CET | 49704 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:06.472033024 CET | 49705 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:06.475528955 CET | 80 | 49704 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:17:06.475543976 CET | 80 | 49704 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:17:06.476861000 CET | 80 | 49705 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:17:06.476927042 CET | 49705 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:06.477078915 CET | 49705 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:06.481928110 CET | 80 | 49705 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:17:06.688663960 CET | 80 | 49704 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:17:06.740102053 CET | 49704 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:07.152820110 CET | 80 | 49705 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:17:07.158070087 CET | 49704 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:07.158274889 CET | 49705 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:07.163094997 CET | 80 | 49705 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:17:07.163186073 CET | 80 | 49705 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:17:07.163198948 CET | 80 | 49704 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:17:07.163254976 CET | 49704 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:07.370100021 CET | 80 | 49705 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:17:07.411956072 CET | 49705 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:11.693825006 CET | 49705 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:11.695013046 CET | 49706 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:11.698951960 CET | 80 | 49705 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:17:11.699055910 CET | 49705 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:11.699820042 CET | 80 | 49706 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:17:11.699892044 CET | 49706 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:11.700022936 CET | 49706 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:11.704792976 CET | 80 | 49706 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:17:11.704936981 CET | 80 | 49706 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:17:12.373090982 CET | 80 | 49706 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:17:12.374084949 CET | 49706 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:12.379192114 CET | 80 | 49706 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:17:12.379266024 CET | 49706 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:17.382556915 CET | 49724 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:17.387518883 CET | 80 | 49724 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:17:17.388425112 CET | 49724 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:17.388451099 CET | 49724 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:17.393256903 CET | 80 | 49724 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:17:17.393362999 CET | 80 | 49724 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:17:18.150692940 CET | 80 | 49724 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:17:18.193223953 CET | 49724 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:23.162602901 CET | 49724 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:23.163744926 CET | 49757 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:23.167761087 CET | 80 | 49724 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:17:23.167819977 CET | 49724 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:23.168606997 CET | 80 | 49757 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:17:23.168684006 CET | 49757 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:23.168836117 CET | 49757 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:23.173619986 CET | 80 | 49757 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:17:23.173795938 CET | 80 | 49757 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:17:23.844237089 CET | 80 | 49757 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:17:23.896502018 CET | 49757 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:27.707722902 CET | 80 | 49757 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:17:27.707778931 CET | 49757 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:28.851953983 CET | 49798 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:28.856796026 CET | 80 | 49798 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:17:28.856857061 CET | 49798 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:28.857894897 CET | 49798 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:28.862782955 CET | 80 | 49798 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:17:28.862843037 CET | 80 | 49798 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:17:29.604166031 CET | 80 | 49798 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:17:29.646370888 CET | 49798 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:34.615767002 CET | 49798 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:34.616636992 CET | 49829 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:34.620912075 CET | 80 | 49798 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:17:34.620981932 CET | 49798 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:34.621494055 CET | 80 | 49829 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:17:34.621665955 CET | 49829 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:34.621783972 CET | 49829 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:34.626555920 CET | 80 | 49829 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:17:34.626683950 CET | 80 | 49829 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:17:35.325664043 CET | 80 | 49829 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:17:35.380732059 CET | 49829 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:40.336118937 CET | 49829 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:40.336908102 CET | 49867 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:40.341705084 CET | 80 | 49867 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:17:40.341772079 CET | 49867 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:40.341936111 CET | 49867 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:40.342961073 CET | 80 | 49829 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:17:40.343015909 CET | 49829 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:40.346776962 CET | 80 | 49867 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:17:40.346834898 CET | 80 | 49867 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:17:41.044749022 CET | 80 | 49867 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:17:41.099486113 CET | 49867 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:46.053141117 CET | 49867 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:46.053872108 CET | 49906 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:46.058341980 CET | 80 | 49867 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:17:46.058691025 CET | 80 | 49906 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:17:46.058741093 CET | 49867 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:46.058767080 CET | 49906 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:46.058950901 CET | 49906 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:46.063796043 CET | 80 | 49906 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:17:46.063880920 CET | 80 | 49906 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:17:46.779894114 CET | 80 | 49906 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:17:46.833868980 CET | 49906 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:51.790357113 CET | 49906 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:51.794353008 CET | 49940 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:51.795392036 CET | 80 | 49906 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:17:51.795447111 CET | 49906 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:51.799221992 CET | 80 | 49940 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:17:51.799293995 CET | 49940 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:51.802097082 CET | 49940 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:51.806927919 CET | 80 | 49940 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:17:51.807018995 CET | 80 | 49940 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:17:52.626235008 CET | 80 | 49940 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:17:52.677648067 CET | 49940 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:57.631391048 CET | 49940 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:57.632100105 CET | 49981 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:57.636607885 CET | 80 | 49940 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:17:57.636781931 CET | 49940 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:57.636838913 CET | 80 | 49981 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:17:57.636909962 CET | 49981 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:57.637072086 CET | 49981 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:17:57.641824007 CET | 80 | 49981 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:17:57.641946077 CET | 80 | 49981 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:17:58.308748007 CET | 80 | 49981 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:17:58.349513054 CET | 49981 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:03.324995041 CET | 49981 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:03.330312967 CET | 80 | 49981 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:18:03.330425024 CET | 49981 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:03.339905024 CET | 49987 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:03.344702005 CET | 80 | 49987 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:18:03.344778061 CET | 49987 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:03.347429037 CET | 49987 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:03.352237940 CET | 80 | 49987 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:18:03.352308989 CET | 80 | 49987 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:18:04.023752928 CET | 80 | 49987 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:18:04.068264961 CET | 49987 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:09.038755894 CET | 49988 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:09.044624090 CET | 80 | 49988 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:18:09.044702053 CET | 49988 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:09.044888973 CET | 49988 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:09.050617933 CET | 80 | 49988 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:18:09.050743103 CET | 80 | 49988 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:18:09.719713926 CET | 80 | 49988 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:18:09.771528006 CET | 49988 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:14.725260019 CET | 49988 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:14.726139069 CET | 49989 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:14.730546951 CET | 80 | 49988 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:18:14.730626106 CET | 49988 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:14.731023073 CET | 80 | 49989 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:18:14.731091022 CET | 49989 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:14.732865095 CET | 49989 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:14.737687111 CET | 80 | 49989 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:18:14.737838984 CET | 80 | 49989 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:18:15.414184093 CET | 80 | 49989 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:18:15.458894014 CET | 49989 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:20.428272009 CET | 49989 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:20.428970098 CET | 49990 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:20.433471918 CET | 80 | 49989 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:18:20.433811903 CET | 80 | 49990 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:18:20.433882952 CET | 49989 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:20.433912039 CET | 49990 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:20.434029102 CET | 49990 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:20.438772917 CET | 80 | 49990 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:18:20.439260006 CET | 80 | 49990 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:18:21.116899014 CET | 80 | 49990 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:18:21.162035942 CET | 49990 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:26.131515026 CET | 49990 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:26.132267952 CET | 49991 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:26.136699915 CET | 80 | 49990 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:18:26.136774063 CET | 49990 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:26.137156963 CET | 80 | 49991 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:18:26.137217045 CET | 49991 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:26.137350082 CET | 49991 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:26.147505045 CET | 80 | 49991 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:18:26.147515059 CET | 80 | 49991 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:18:26.821595907 CET | 80 | 49991 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:18:26.865168095 CET | 49991 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:27.514247894 CET | 80 | 49987 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:18:27.514319897 CET | 49987 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:27.516639948 CET | 80 | 49991 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:18:27.516714096 CET | 49991 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:31.834419012 CET | 49991 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:31.835221052 CET | 49992 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:31.839303970 CET | 80 | 49991 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:18:31.840044975 CET | 80 | 49992 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:18:31.840128899 CET | 49992 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:31.840255022 CET | 49992 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:31.845052004 CET | 80 | 49992 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:18:31.845175982 CET | 80 | 49992 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:18:32.523602962 CET | 80 | 49992 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:18:32.568279982 CET | 49992 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:33.098392963 CET | 49757 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:33.098392963 CET | 49987 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:33.099611998 CET | 49992 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:33.102401018 CET | 49993 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:33.104667902 CET | 80 | 49992 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:18:33.107255936 CET | 80 | 49993 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:18:33.110532045 CET | 49992 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:33.110537052 CET | 49993 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:33.110641956 CET | 49993 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:33.115403891 CET | 80 | 49993 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:18:33.804224014 CET | 80 | 49993 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:18:33.805701017 CET | 49994 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:33.805702925 CET | 49993 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:33.810616970 CET | 80 | 49994 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:18:33.810807943 CET | 80 | 49993 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:18:33.813453913 CET | 49994 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:33.813460112 CET | 49993 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:33.813539028 CET | 49994 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:33.818331003 CET | 80 | 49994 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:18:33.818489075 CET | 80 | 49994 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:18:34.520953894 CET | 80 | 49994 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:18:34.568286896 CET | 49994 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:37.537672997 CET | 49994 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:37.542406082 CET | 49995 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:37.542917967 CET | 80 | 49994 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:18:37.545677900 CET | 49994 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:37.547221899 CET | 80 | 49995 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:18:37.547410965 CET | 49995 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:37.547410965 CET | 49995 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:37.552215099 CET | 80 | 49995 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:18:37.552373886 CET | 80 | 49995 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:18:38.231367111 CET | 80 | 49995 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:18:38.271409035 CET | 49995 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:43.242418051 CET | 49996 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:43.247472048 CET | 80 | 49996 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:18:43.247692108 CET | 49996 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:43.247786045 CET | 49996 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:43.252676964 CET | 80 | 49996 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:18:43.252687931 CET | 80 | 49996 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:18:43.971126080 CET | 80 | 49996 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:18:44.021537066 CET | 49996 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:48.990896940 CET | 49996 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:48.991708040 CET | 49997 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:48.996016979 CET | 80 | 49996 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:18:48.996125937 CET | 49996 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:48.996581078 CET | 80 | 49997 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:18:48.996645927 CET | 49997 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:48.996751070 CET | 49997 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:49.001590967 CET | 80 | 49997 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:18:49.001601934 CET | 80 | 49997 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:18:49.680490017 CET | 80 | 49997 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:18:49.880836964 CET | 49997 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:54.694226027 CET | 49997 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:54.695478916 CET | 49998 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:54.699523926 CET | 80 | 49997 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:18:54.699582100 CET | 49997 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:54.700381994 CET | 80 | 49998 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:18:54.700460911 CET | 49998 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:54.700608015 CET | 49998 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:18:54.705375910 CET | 80 | 49998 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:18:54.705503941 CET | 80 | 49998 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:18:55.375226021 CET | 80 | 49998 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:18:55.429694891 CET | 49998 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:00.382989883 CET | 49998 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:00.385833025 CET | 49999 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:00.388227940 CET | 80 | 49998 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:19:00.388288975 CET | 49998 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:00.390743017 CET | 80 | 49999 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:19:00.390814066 CET | 49999 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:00.390961885 CET | 49999 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:00.395817041 CET | 80 | 49999 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:19:00.395920038 CET | 80 | 49999 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:19:01.070681095 CET | 80 | 49999 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:19:01.148768902 CET | 49999 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:06.084414005 CET | 49999 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:06.085462093 CET | 50000 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:06.089673042 CET | 80 | 49999 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:19:06.090338945 CET | 80 | 50000 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:19:06.090445995 CET | 50000 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:06.090451956 CET | 49999 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:06.090580940 CET | 50000 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:06.095343113 CET | 80 | 50000 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:19:06.095493078 CET | 80 | 50000 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:19:06.764190912 CET | 80 | 50000 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:19:06.819330931 CET | 50000 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:08.269165039 CET | 80 | 49995 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:19:08.269226074 CET | 49995 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:11.772573948 CET | 50000 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:11.777709961 CET | 80 | 50000 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:19:11.777741909 CET | 50001 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:11.778559923 CET | 50000 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:11.782622099 CET | 80 | 50001 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:19:11.782746077 CET | 50001 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:11.782843113 CET | 50001 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:11.787575006 CET | 80 | 50001 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:19:11.787797928 CET | 80 | 50001 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:19:12.467449903 CET | 80 | 50001 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:19:12.532505035 CET | 50001 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:17.475987911 CET | 50001 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:17.475996017 CET | 50002 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:17.480900049 CET | 80 | 50002 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:19:17.481183052 CET | 80 | 50001 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:19:17.482533932 CET | 50001 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:17.482556105 CET | 50002 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:17.482655048 CET | 50002 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:17.487508059 CET | 80 | 50002 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:19:17.487623930 CET | 80 | 50002 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:19:18.167092085 CET | 80 | 50002 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:19:18.302711964 CET | 50002 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:23.178520918 CET | 50002 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:23.182145119 CET | 50003 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:23.183743954 CET | 80 | 50002 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:19:23.187011957 CET | 80 | 50003 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:19:23.187046051 CET | 50002 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:23.188725948 CET | 50003 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:23.188725948 CET | 50003 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:23.193566084 CET | 80 | 50003 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:19:23.193659067 CET | 80 | 50003 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:19:23.864540100 CET | 80 | 50003 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:19:23.944565058 CET | 50003 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:28.667292118 CET | 80 | 50003 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:19:28.667355061 CET | 50003 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:28.870651007 CET | 50003 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:28.871552944 CET | 50004 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:28.875502110 CET | 80 | 50003 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:19:28.876426935 CET | 80 | 50004 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:19:28.876497984 CET | 50004 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:28.876593113 CET | 50004 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:28.881438971 CET | 80 | 50004 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:19:28.881481886 CET | 80 | 50004 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:19:29.556889057 CET | 80 | 50004 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:19:29.646676064 CET | 50004 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:34.568869114 CET | 50004 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:34.569804907 CET | 50005 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:34.574973106 CET | 80 | 50004 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:19:34.575038910 CET | 50004 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:34.575273037 CET | 80 | 50005 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:19:34.575337887 CET | 50005 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:34.575462103 CET | 50005 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:34.580261946 CET | 80 | 50005 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:19:34.580404997 CET | 80 | 50005 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:19:35.258728027 CET | 80 | 50005 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:19:35.304754972 CET | 50005 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:40.272161961 CET | 50005 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:40.273236036 CET | 50006 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:40.277216911 CET | 80 | 50005 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:19:40.277272940 CET | 50005 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:40.278064013 CET | 80 | 50006 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:19:40.278132915 CET | 50006 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:40.278254986 CET | 50006 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:40.283068895 CET | 80 | 50006 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:19:40.283174038 CET | 80 | 50006 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:19:40.994932890 CET | 80 | 50006 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:19:41.037110090 CET | 50006 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:46.008609056 CET | 50007 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:46.008611917 CET | 50006 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:46.013457060 CET | 80 | 50007 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:19:46.013612986 CET | 80 | 50006 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:19:46.016623974 CET | 50007 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:46.016624928 CET | 50006 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:46.020806074 CET | 50007 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:46.025609970 CET | 80 | 50007 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:19:46.025820971 CET | 80 | 50007 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:19:46.698717117 CET | 80 | 50007 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:19:46.740225077 CET | 50007 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:51.713660002 CET | 50007 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:51.716598988 CET | 50008 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:51.719600916 CET | 80 | 50007 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:19:51.720948935 CET | 50007 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:51.723069906 CET | 80 | 50008 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:19:51.724667072 CET | 50008 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:51.728722095 CET | 50008 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:51.735100985 CET | 80 | 50008 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:19:51.735110044 CET | 80 | 50008 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:19:52.417803049 CET | 80 | 50008 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:19:52.458988905 CET | 50008 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:57.428304911 CET | 50008 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:57.429107904 CET | 50009 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:57.433409929 CET | 80 | 50008 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:19:57.433511972 CET | 50008 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:57.433917999 CET | 80 | 50009 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:19:57.436765909 CET | 50009 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:57.436964989 CET | 50009 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:19:57.441792011 CET | 80 | 50009 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:19:57.441880941 CET | 80 | 50009 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:19:58.234035015 CET | 80 | 50009 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:19:58.287111998 CET | 50009 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:20:03.241563082 CET | 50010 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:20:03.246535063 CET | 80 | 50010 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:20:03.246608019 CET | 50010 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:20:03.246721029 CET | 50010 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:20:03.251573086 CET | 80 | 50010 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:20:03.251624107 CET | 80 | 50010 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:20:03.934907913 CET | 80 | 50010 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:20:04.052845955 CET | 50010 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:20:08.944169998 CET | 50010 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:20:08.944966078 CET | 50011 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:20:08.951277971 CET | 80 | 50010 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:20:08.951351881 CET | 50010 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:20:08.951922894 CET | 80 | 50011 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:20:08.951989889 CET | 50011 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:20:08.952136040 CET | 50011 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:20:08.959196091 CET | 80 | 50011 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:20:08.959763050 CET | 80 | 50011 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:20:09.626683950 CET | 80 | 50011 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:20:09.626995087 CET | 50011 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:20:09.632150888 CET | 80 | 50011 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:20:09.634627104 CET | 50011 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:20:14.632574081 CET | 50012 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:20:14.637471914 CET | 80 | 50012 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:20:14.637541056 CET | 50012 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:20:14.637654066 CET | 50012 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:20:14.642483950 CET | 80 | 50012 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:20:14.642625093 CET | 80 | 50012 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:20:15.312179089 CET | 80 | 50012 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:20:15.368599892 CET | 50012 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:20:20.321343899 CET | 50012 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:20:20.322398901 CET | 50013 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:20:20.327174902 CET | 80 | 50012 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:20:20.327245951 CET | 50012 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:20:20.327279091 CET | 80 | 50013 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:20:20.327351093 CET | 50013 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:20:20.328696966 CET | 50013 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:20:20.333872080 CET | 80 | 50013 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:20:20.333884954 CET | 80 | 50013 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:20:21.045594931 CET | 80 | 50013 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:20:21.102829933 CET | 50013 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:20:26.053216934 CET | 50013 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:20:26.056658983 CET | 50014 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:20:26.058249950 CET | 80 | 50013 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:20:26.060760975 CET | 50013 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:20:26.061507940 CET | 80 | 50014 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:20:26.064809084 CET | 50014 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:20:26.064923048 CET | 50014 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:20:26.069724083 CET | 80 | 50014 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:20:26.069828987 CET | 80 | 50014 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:20:26.739919901 CET | 80 | 50014 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:20:26.880975962 CET | 50014 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:20:28.241323948 CET | 80 | 50009 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:20:28.244739056 CET | 50009 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:20:31.756300926 CET | 50014 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:20:31.757056952 CET | 50015 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:20:31.761467934 CET | 80 | 50014 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:20:31.761703014 CET | 50014 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:20:31.761857033 CET | 80 | 50015 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:20:31.762007952 CET | 50015 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:20:31.762175083 CET | 50015 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:20:31.766957045 CET | 80 | 50015 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:20:31.767162085 CET | 80 | 50015 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:20:32.641308069 CET | 80 | 50015 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:20:32.693408012 CET | 50015 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:20:33.321157932 CET | 80 | 50015 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:20:33.321214914 CET | 50015 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:20:37.647686958 CET | 50016 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:20:37.647689104 CET | 50015 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:20:37.652584076 CET | 80 | 50015 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:20:37.652632952 CET | 80 | 50016 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:20:37.653152943 CET | 50016 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:20:37.653153896 CET | 50016 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:20:37.658025980 CET | 80 | 50016 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:20:37.658145905 CET | 80 | 50016 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:20:38.330703974 CET | 80 | 50016 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:20:38.380896091 CET | 50016 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:20:43.334649086 CET | 50016 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:20:43.335633993 CET | 50017 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:20:43.339840889 CET | 80 | 50016 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:20:43.339922905 CET | 50016 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:20:43.340482950 CET | 80 | 50017 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:20:43.340549946 CET | 50017 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:20:43.340688944 CET | 50017 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:20:43.345396042 CET | 80 | 50017 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:20:43.345662117 CET | 80 | 50017 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:20:44.018168926 CET | 80 | 50017 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:20:44.068521023 CET | 50017 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:20:49.022124052 CET | 50017 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:20:49.023134947 CET | 50018 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:20:49.027232885 CET | 80 | 50017 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:20:49.027292013 CET | 50017 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:20:49.027985096 CET | 80 | 50018 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:20:49.028059959 CET | 50018 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:20:49.028161049 CET | 50018 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:20:49.032963991 CET | 80 | 50018 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:20:49.033056974 CET | 80 | 50018 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:20:49.704236031 CET | 80 | 50018 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:20:49.756802082 CET | 50018 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:20:54.709974051 CET | 50018 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:20:54.711282015 CET | 50019 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:20:54.715234041 CET | 80 | 50018 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:20:54.715306997 CET | 50018 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:20:54.716084957 CET | 80 | 50019 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:20:54.716160059 CET | 50019 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:20:54.717807055 CET | 50019 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:20:54.722625017 CET | 80 | 50019 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:20:54.722749949 CET | 80 | 50019 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:20:55.391807079 CET | 80 | 50019 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:20:55.443429947 CET | 50019 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:21:00.397105932 CET | 50019 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:21:00.398108959 CET | 50020 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:21:00.402496099 CET | 80 | 50019 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:21:00.402549028 CET | 50019 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:21:00.403453112 CET | 80 | 50020 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:21:00.403523922 CET | 50020 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:21:00.403615952 CET | 50020 | 80 | 192.168.2.5 | 141.8.192.151 |
| Jan 2, 2025 05:21:00.408854008 CET | 80 | 50020 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:21:00.409409046 CET | 80 | 50020 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:21:01.080615997 CET | 80 | 50020 | 141.8.192.151 | 192.168.2.5 |
| Jan 2, 2025 05:21:01.193423033 CET | 50020 | 80 | 192.168.2.5 | 141.8.192.151 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Jan 2, 2025 05:17:05.174551964 CET | 51241 | 53 | 192.168.2.5 | 1.1.1.1 |
| Jan 2, 2025 05:17:05.214426994 CET | 53 | 51241 | 1.1.1.1 | 192.168.2.5 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Jan 2, 2025 05:17:05.174551964 CET | 192.168.2.5 | 1.1.1.1 | 0x5486 | Standard query (0) | A (IP address) | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Jan 2, 2025 05:17:05.214426994 CET | 1.1.1.1 | 192.168.2.5 | 0x5486 | No error (0) | 141.8.192.151 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.5 | 49704 | 141.8.192.151 | 80 | 5688 | C:\Users\user\AppData\Local\Temp\ComponentfontintoDll\Bridgecontainer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Jan 2, 2025 05:17:05.239795923 CET | 556 | OUT | |
| Jan 2, 2025 05:17:06.085664988 CET | 1236 | IN | |
| Jan 2, 2025 05:17:06.085701942 CET | 224 | IN | |
| Jan 2, 2025 05:17:06.085712910 CET | 224 | IN | |
| Jan 2, 2025 05:17:06.171778917 CET | 876 | IN | |
| Jan 2, 2025 05:17:06.470499039 CET | 2229 | OUT | |
| Jan 2, 2025 05:17:06.688663960 CET | 264 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.5 | 49705 | 141.8.192.151 | 80 | 5688 | C:\Users\user\AppData\Local\Temp\ComponentfontintoDll\Bridgecontainer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Jan 2, 2025 05:17:06.477078915 CET | 827 | OUT | |
| Jan 2, 2025 05:17:07.152820110 CET | 158 | IN | |
| Jan 2, 2025 05:17:07.158274889 CET | 1428 | OUT | |
| Jan 2, 2025 05:17:07.370100021 CET | 158 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 2 | 192.168.2.5 | 49706 | 141.8.192.151 | 80 | 5688 | C:\Users\user\AppData\Local\Temp\ComponentfontintoDll\Bridgecontainer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Jan 2, 2025 05:17:11.700022936 CET | 2233 | OUT | |
| Jan 2, 2025 05:17:12.373090982 CET | 264 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 3 | 192.168.2.5 | 49724 | 141.8.192.151 | 80 | 5688 | C:\Users\user\AppData\Local\Temp\ComponentfontintoDll\Bridgecontainer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Jan 2, 2025 05:17:17.388451099 CET | 2257 | OUT | |
| Jan 2, 2025 05:17:18.150692940 CET | 264 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 4 | 192.168.2.5 | 49757 | 141.8.192.151 | 80 | 5688 | C:\Users\user\AppData\Local\Temp\ComponentfontintoDll\Bridgecontainer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Jan 2, 2025 05:17:23.168836117 CET | 2233 | OUT | |
| Jan 2, 2025 05:17:23.844237089 CET | 264 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 5 | 192.168.2.5 | 49798 | 141.8.192.151 | 80 | 5688 | C:\Users\user\AppData\Local\Temp\ComponentfontintoDll\Bridgecontainer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Jan 2, 2025 05:17:28.857894897 CET | 2257 | OUT | |
| Jan 2, 2025 05:17:29.604166031 CET | 264 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 6 | 192.168.2.5 | 49829 | 141.8.192.151 | 80 | 5688 | C:\Users\user\AppData\Local\Temp\ComponentfontintoDll\Bridgecontainer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Jan 2, 2025 05:17:34.621783972 CET | 2257 | OUT | |
| Jan 2, 2025 05:17:35.325664043 CET | 264 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 7 | 192.168.2.5 | 49867 | 141.8.192.151 | 80 | 5688 | C:\Users\user\AppData\Local\Temp\ComponentfontintoDll\Bridgecontainer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Jan 2, 2025 05:17:40.341936111 CET | 2233 | OUT | |
| Jan 2, 2025 05:17:41.044749022 CET | 264 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 8 | 192.168.2.5 | 49906 | 141.8.192.151 | 80 | 5688 | C:\Users\user\AppData\Local\Temp\ComponentfontintoDll\Bridgecontainer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Jan 2, 2025 05:17:46.058950901 CET | 2206 | OUT | |
| Jan 2, 2025 05:17:46.779894114 CET | 264 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 9 | 192.168.2.5 | 49940 | 141.8.192.151 | 80 | 5688 | C:\Users\user\AppData\Local\Temp\ComponentfontintoDll\Bridgecontainer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Jan 2, 2025 05:17:51.802097082 CET | 2233 | OUT | |
| Jan 2, 2025 05:17:52.626235008 CET | 264 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 10 | 192.168.2.5 | 49981 | 141.8.192.151 | 80 | 5688 | C:\Users\user\AppData\Local\Temp\ComponentfontintoDll\Bridgecontainer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Jan 2, 2025 05:17:57.637072086 CET | 2257 | OUT | |
| Jan 2, 2025 05:17:58.308748007 CET | 264 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 11 | 192.168.2.5 | 49987 | 141.8.192.151 | 80 | 5688 | C:\Users\user\AppData\Local\Temp\ComponentfontintoDll\Bridgecontainer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Jan 2, 2025 05:18:03.347429037 CET | 2233 | OUT | |
| Jan 2, 2025 05:18:04.023752928 CET | 264 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 12 | 192.168.2.5 | 49988 | 141.8.192.151 | 80 | 5688 | C:\Users\user\AppData\Local\Temp\ComponentfontintoDll\Bridgecontainer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Jan 2, 2025 05:18:09.044888973 CET | 2257 | OUT | |
| Jan 2, 2025 05:18:09.719713926 CET | 264 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 13 | 192.168.2.5 | 49989 | 141.8.192.151 | 80 | 5688 | C:\Users\user\AppData\Local\Temp\ComponentfontintoDll\Bridgecontainer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Jan 2, 2025 05:18:14.732865095 CET | 2233 | OUT | |
| Jan 2, 2025 05:18:15.414184093 CET | 264 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 14 | 192.168.2.5 | 49990 | 141.8.192.151 | 80 | 5688 | C:\Users\user\AppData\Local\Temp\ComponentfontintoDll\Bridgecontainer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Jan 2, 2025 05:18:20.434029102 CET | 2257 | OUT | |
| Jan 2, 2025 05:18:21.116899014 CET | 264 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 15 | 192.168.2.5 | 49991 | 141.8.192.151 | 80 | 5688 | C:\Users\user\AppData\Local\Temp\ComponentfontintoDll\Bridgecontainer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Jan 2, 2025 05:18:26.137350082 CET | 2233 | OUT | |
| Jan 2, 2025 05:18:26.821595907 CET | 264 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 16 | 192.168.2.5 | 49992 | 141.8.192.151 | 80 | 5688 | C:\Users\user\AppData\Local\Temp\ComponentfontintoDll\Bridgecontainer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Jan 2, 2025 05:18:31.840255022 CET | 2206 | OUT | |
| Jan 2, 2025 05:18:32.523602962 CET | 264 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 17 | 192.168.2.5 | 49993 | 141.8.192.151 | 80 | 5688 | C:\Users\user\AppData\Local\Temp\ComponentfontintoDll\Bridgecontainer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Jan 2, 2025 05:18:33.110641956 CET | 827 | OUT | |
| Jan 2, 2025 05:18:33.804224014 CET | 158 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 18 | 192.168.2.5 | 49994 | 141.8.192.151 | 80 | 5688 | C:\Users\user\AppData\Local\Temp\ComponentfontintoDll\Bridgecontainer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Jan 2, 2025 05:18:33.813539028 CET | 1452 | OUT | |
| Jan 2, 2025 05:18:34.520953894 CET | 158 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 19 | 192.168.2.5 | 49995 | 141.8.192.151 | 80 | 5688 | C:\Users\user\AppData\Local\Temp\ComponentfontintoDll\Bridgecontainer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Jan 2, 2025 05:18:37.547410965 CET | 2233 | OUT | |
| Jan 2, 2025 05:18:38.231367111 CET | 264 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 20 | 192.168.2.5 | 49996 | 141.8.192.151 | 80 | 5688 | C:\Users\user\AppData\Local\Temp\ComponentfontintoDll\Bridgecontainer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Jan 2, 2025 05:18:43.247786045 CET | 2257 | OUT | |
| Jan 2, 2025 05:18:43.971126080 CET | 264 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 21 | 192.168.2.5 | 49997 | 141.8.192.151 | 80 | 5688 | C:\Users\user\AppData\Local\Temp\ComponentfontintoDll\Bridgecontainer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Jan 2, 2025 05:18:48.996751070 CET | 2257 | OUT | |
| Jan 2, 2025 05:18:49.680490017 CET | 264 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 22 | 192.168.2.5 | 49998 | 141.8.192.151 | 80 | 5688 | C:\Users\user\AppData\Local\Temp\ComponentfontintoDll\Bridgecontainer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Jan 2, 2025 05:18:54.700608015 CET | 2233 | OUT | |
| Jan 2, 2025 05:18:55.375226021 CET | 264 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 23 | 192.168.2.5 | 49999 | 141.8.192.151 | 80 | 5688 | C:\Users\user\AppData\Local\Temp\ComponentfontintoDll\Bridgecontainer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Jan 2, 2025 05:19:00.390961885 CET | 2233 | OUT | |
| Jan 2, 2025 05:19:01.070681095 CET | 264 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 24 | 192.168.2.5 | 50000 | 141.8.192.151 | 80 | 5688 | C:\Users\user\AppData\Local\Temp\ComponentfontintoDll\Bridgecontainer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Jan 2, 2025 05:19:06.090580940 CET | 2257 | OUT | |
| Jan 2, 2025 05:19:06.764190912 CET | 264 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 25 | 192.168.2.5 | 50001 | 141.8.192.151 | 80 | 5688 | C:\Users\user\AppData\Local\Temp\ComponentfontintoDll\Bridgecontainer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Jan 2, 2025 05:19:11.782843113 CET | 2257 | OUT | |
| Jan 2, 2025 05:19:12.467449903 CET | 264 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 26 | 192.168.2.5 | 50002 | 141.8.192.151 | 80 | 5688 | C:\Users\user\AppData\Local\Temp\ComponentfontintoDll\Bridgecontainer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Jan 2, 2025 05:19:17.482655048 CET | 2257 | OUT | |
| Jan 2, 2025 05:19:18.167092085 CET | 264 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 27 | 192.168.2.5 | 50003 | 141.8.192.151 | 80 | 5688 | C:\Users\user\AppData\Local\Temp\ComponentfontintoDll\Bridgecontainer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Jan 2, 2025 05:19:23.188725948 CET | 2230 | OUT | |
| Jan 2, 2025 05:19:23.864540100 CET | 264 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 28 | 192.168.2.5 | 50004 | 141.8.192.151 | 80 | 5688 | C:\Users\user\AppData\Local\Temp\ComponentfontintoDll\Bridgecontainer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Jan 2, 2025 05:19:28.876593113 CET | 2233 | OUT | |
| Jan 2, 2025 05:19:29.556889057 CET | 264 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 29 | 192.168.2.5 | 50005 | 141.8.192.151 | 80 | 5688 | C:\Users\user\AppData\Local\Temp\ComponentfontintoDll\Bridgecontainer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Jan 2, 2025 05:19:34.575462103 CET | 2257 | OUT | |
| Jan 2, 2025 05:19:35.258728027 CET | 264 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 30 | 192.168.2.5 | 50006 | 141.8.192.151 | 80 | 5688 | C:\Users\user\AppData\Local\Temp\ComponentfontintoDll\Bridgecontainer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Jan 2, 2025 05:19:40.278254986 CET | 2257 | OUT | |
| Jan 2, 2025 05:19:40.994932890 CET | 264 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 31 | 192.168.2.5 | 50007 | 141.8.192.151 | 80 | 5688 | C:\Users\user\AppData\Local\Temp\ComponentfontintoDll\Bridgecontainer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Jan 2, 2025 05:19:46.020806074 CET | 2257 | OUT | |
| Jan 2, 2025 05:19:46.698717117 CET | 264 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 32 | 192.168.2.5 | 50008 | 141.8.192.151 | 80 | 5688 | C:\Users\user\AppData\Local\Temp\ComponentfontintoDll\Bridgecontainer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Jan 2, 2025 05:19:51.728722095 CET | 2257 | OUT | |
| Jan 2, 2025 05:19:52.417803049 CET | 264 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 33 | 192.168.2.5 | 50009 | 141.8.192.151 | 80 | 5688 | C:\Users\user\AppData\Local\Temp\ComponentfontintoDll\Bridgecontainer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Jan 2, 2025 05:19:57.436964989 CET | 2233 | OUT | |
| Jan 2, 2025 05:19:58.234035015 CET | 264 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 34 | 192.168.2.5 | 50010 | 141.8.192.151 | 80 | 5688 | C:\Users\user\AppData\Local\Temp\ComponentfontintoDll\Bridgecontainer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Jan 2, 2025 05:20:03.246721029 CET | 2257 | OUT | |
| Jan 2, 2025 05:20:03.934907913 CET | 264 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 35 | 192.168.2.5 | 50011 | 141.8.192.151 | 80 | 5688 | C:\Users\user\AppData\Local\Temp\ComponentfontintoDll\Bridgecontainer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Jan 2, 2025 05:20:08.952136040 CET | 2206 | OUT | |
| Jan 2, 2025 05:20:09.626683950 CET | 264 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 36 | 192.168.2.5 | 50012 | 141.8.192.151 | 80 | 5688 | C:\Users\user\AppData\Local\Temp\ComponentfontintoDll\Bridgecontainer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Jan 2, 2025 05:20:14.637654066 CET | 2257 | OUT | |
| Jan 2, 2025 05:20:15.312179089 CET | 264 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 37 | 192.168.2.5 | 50013 | 141.8.192.151 | 80 | 5688 | C:\Users\user\AppData\Local\Temp\ComponentfontintoDll\Bridgecontainer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Jan 2, 2025 05:20:20.328696966 CET | 2257 | OUT | |
| Jan 2, 2025 05:20:21.045594931 CET | 264 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 38 | 192.168.2.5 | 50014 | 141.8.192.151 | 80 | 5688 | C:\Users\user\AppData\Local\Temp\ComponentfontintoDll\Bridgecontainer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Jan 2, 2025 05:20:26.064923048 CET | 2257 | OUT | |
| Jan 2, 2025 05:20:26.739919901 CET | 264 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 39 | 192.168.2.5 | 50015 | 141.8.192.151 | 80 | 5688 | C:\Users\user\AppData\Local\Temp\ComponentfontintoDll\Bridgecontainer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Jan 2, 2025 05:20:31.762175083 CET | 2257 | OUT | |
| Jan 2, 2025 05:20:32.641308069 CET | 264 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 40 | 192.168.2.5 | 50016 | 141.8.192.151 | 80 | 5688 | C:\Users\user\AppData\Local\Temp\ComponentfontintoDll\Bridgecontainer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Jan 2, 2025 05:20:37.653153896 CET | 2257 | OUT | |
| Jan 2, 2025 05:20:38.330703974 CET | 264 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 41 | 192.168.2.5 | 50017 | 141.8.192.151 | 80 | 5688 | C:\Users\user\AppData\Local\Temp\ComponentfontintoDll\Bridgecontainer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Jan 2, 2025 05:20:43.340688944 CET | 2233 | OUT | |
| Jan 2, 2025 05:20:44.018168926 CET | 264 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 42 | 192.168.2.5 | 50018 | 141.8.192.151 | 80 | 5688 | C:\Users\user\AppData\Local\Temp\ComponentfontintoDll\Bridgecontainer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Jan 2, 2025 05:20:49.028161049 CET | 2257 | OUT | |
| Jan 2, 2025 05:20:49.704236031 CET | 264 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 43 | 192.168.2.5 | 50019 | 141.8.192.151 | 80 | 5688 | C:\Users\user\AppData\Local\Temp\ComponentfontintoDll\Bridgecontainer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Jan 2, 2025 05:20:54.717807055 CET | 2233 | OUT | |
| Jan 2, 2025 05:20:55.391807079 CET | 264 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 44 | 192.168.2.5 | 50020 | 141.8.192.151 | 80 | 5688 | C:\Users\user\AppData\Local\Temp\ComponentfontintoDll\Bridgecontainer.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Jan 2, 2025 05:21:00.403615952 CET | 2230 | OUT | |
| Jan 2, 2025 05:21:01.080615997 CET | 264 | IN |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
| Target ID: | 0 |
| Start time: | 23:16:53 |
| Start date: | 01/01/2025 |
| Path: | C:\Users\user\Desktop\5Ixz5yVfS7.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x590000 |
| File size: | 1'164'920 bytes |
| MD5 hash: | 7B4ECCF10CC4FA7263646F2FCE4D7F8B |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | low |
| Has exited: | true |
| Target ID: | 2 |
| Start time: | 23:16:54 |
| Start date: | 01/01/2025 |
| Path: | C:\Windows\SysWOW64\wscript.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x460000 |
| File size: | 147'456 bytes |
| MD5 hash: | FF00E0480075B095948000BDC66E81F0 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 3 |
| Start time: | 23:17:00 |
| Start date: | 01/01/2025 |
| Path: | C:\Windows\SysWOW64\cmd.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x790000 |
| File size: | 236'544 bytes |
| MD5 hash: | D0FCE3AFA6AA1D58CE9FA336CC2B675B |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | false |
| Target ID: | 4 |
| Start time: | 23:17:00 |
| Start date: | 01/01/2025 |
| Path: | C:\Windows\System32\conhost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff6d64d0000 |
| File size: | 862'208 bytes |
| MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | false |
| Target ID: | 5 |
| Start time: | 23:17:00 |
| Start date: | 01/01/2025 |
| Path: | C:\Users\user\AppData\Local\Temp\ComponentfontintoDll\Bridgecontainer.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x850000 |
| File size: | 847'872 bytes |
| MD5 hash: | 21879480EBF05FF55A58FC933CB818A4 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Antivirus matches: |
|
| Reputation: | low |
| Has exited: | false |
Execution Graph
| Execution Coverage: | 9.9% |
| Dynamic/Decrypted Code Coverage: | 0% |
| Signature Coverage: | 9.3% |
| Total number of Nodes: | 1517 |
| Total number of Limit Nodes: | 35 |
Graph
Function 005AD5D4 Relevance: 42.2, APIs: 17, Strings: 7, Instructions: 197filesleeptimeCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005A9E1C Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 100memorywindowCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0059A5F4 Relevance: 7.6, APIs: 5, Instructions: 107fileCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0059857B Relevance: 3.9, APIs: 2, Instructions: 947COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005A00CF Relevance: 98.3, APIs: 22, Strings: 34, Instructions: 317libraryfileloaderCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005ABDF5 Relevance: 31.9, APIs: 14, Strings: 4, Instructions: 429windowCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005ACB5A Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 97windowCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005AAC74 Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0059984E Relevance: 6.1, APIs: 4, Instructions: 57fileCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005BA4F4 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00599F2F Relevance: 4.6, APIs: 3, Instructions: 107fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0059A207 Relevance: 4.6, APIs: 3, Instructions: 56COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005BA72C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005BA56F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memoryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005BB350 Relevance: 3.2, APIs: 2, Instructions: 168COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005A2C42 Relevance: 3.1, APIs: 2, Instructions: 112COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00591385 Relevance: 3.1, APIs: 2, Instructions: 97COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00591380 Relevance: 3.1, APIs: 2, Instructions: 95COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0059971E Relevance: 3.1, APIs: 2, Instructions: 86fileCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00599D62 Relevance: 3.1, APIs: 2, Instructions: 82timeCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005BA458 Relevance: 3.1, APIs: 2, Instructions: 65libraryloaderCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00599B59 Relevance: 3.1, APIs: 2, Instructions: 57COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00599E40 Relevance: 3.1, APIs: 2, Instructions: 54COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005B8606 Relevance: 3.0, APIs: 2, Instructions: 44memoryCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005A0908 Relevance: 3.0, APIs: 2, Instructions: 33COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0059A444 Relevance: 3.0, APIs: 2, Instructions: 30COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005AD573 Relevance: 3.0, APIs: 2, Instructions: 29COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0059A12D Relevance: 3.0, APIs: 2, Instructions: 28fileCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005AA39D Relevance: 3.0, APIs: 2, Instructions: 27COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0059A194 Relevance: 3.0, APIs: 2, Instructions: 26COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005A0085 Relevance: 3.0, APIs: 2, Instructions: 25libraryCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005A9B0F Relevance: 3.0, APIs: 2, Instructions: 24windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005B215C Relevance: 3.0, APIs: 2, Instructions: 19COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005912E6 Relevance: 3.0, APIs: 2, Instructions: 11COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005919A6 Relevance: 1.8, APIs: 1, Instructions: 310COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00593B3D Relevance: 1.7, APIs: 1, Instructions: 176COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0059837F Relevance: 1.6, APIs: 1, Instructions: 110COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00591E00 Relevance: 1.6, APIs: 1, Instructions: 76COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005AA7C3 Relevance: 1.6, APIs: 1, Instructions: 71COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005992E6 Relevance: 1.6, APIs: 1, Instructions: 55COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0059AA88 Relevance: 1.5, APIs: 1, Instructions: 40COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00595BD7 Relevance: 1.5, APIs: 1, Instructions: 32COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005B8518 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0059A4C6 Relevance: 1.5, APIs: 1, Instructions: 27COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005A067C Relevance: 1.5, APIs: 1, Instructions: 21threadCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005A9D7B Relevance: 1.5, APIs: 1, Instructions: 17memoryCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00599989 Relevance: 1.5, APIs: 1, Instructions: 15COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005AD41A Relevance: 1.5, APIs: 1, Instructions: 13windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005AD8DE Relevance: 1.5, APIs: 1, Instructions: 10COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005AD8CA Relevance: 1.5, APIs: 1, Instructions: 10COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005AD8C0 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005AD8FC Relevance: 1.5, APIs: 1, Instructions: 10COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005AD8F2 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005AD8E8 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005AD891 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005AD8B6 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005AD8AC Relevance: 1.5, APIs: 1, Instructions: 10COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005AD942 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005AD910 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005AD906 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005AD92E Relevance: 1.5, APIs: 1, Instructions: 10COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005AD924 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005ADAD9 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005ADACF Relevance: 1.5, APIs: 1, Instructions: 10COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005ADB01 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005ADBDE Relevance: 1.5, APIs: 1, Instructions: 10COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005ADBC3 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005ADBFC Relevance: 1.5, APIs: 1, Instructions: 10COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005ADBE8 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005ADC5D Relevance: 1.5, APIs: 1, Instructions: 10COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005ADC53 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005ADC24 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005AD8D9 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005AD95B Relevance: 1.5, APIs: 1, Instructions: 9COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005AD951 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005AD979 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005AD96F Relevance: 1.5, APIs: 1, Instructions: 9COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005AD965 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005AD91F Relevance: 1.5, APIs: 1, Instructions: 9COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005AD93D Relevance: 1.5, APIs: 1, Instructions: 9COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005AD997 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005AD98D Relevance: 1.5, APIs: 1, Instructions: 9COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005AD983 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005ADACA Relevance: 1.5, APIs: 1, Instructions: 9COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005ADAC0 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005ADAFC Relevance: 1.5, APIs: 1, Instructions: 9COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005ADAF2 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005ADAE8 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005ADAA5 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005ADBF7 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005ADC4E Relevance: 1.5, APIs: 1, Instructions: 9COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005ADC44 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005ADC1F Relevance: 1.5, APIs: 1, Instructions: 9COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005ADC15 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005ADC0B Relevance: 1.5, APIs: 1, Instructions: 9COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005AA322 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005996D0 Relevance: 1.3, APIs: 1, Instructions: 30COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005AB8E0 Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 286timewindowfileCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0059718C Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 296fileCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005BD00E Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005AA63C Relevance: 3.0, APIs: 2, Instructions: 46COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00596EC9 Relevance: 3.0, APIs: 2, Instructions: 17windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0059407E Relevance: 1.6, Strings: 1, Instructions: 332COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0059ACF5 Relevance: 1.5, APIs: 1, Instructions: 28COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005AF063 Relevance: 1.5, APIs: 1, Instructions: 3COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005BB710 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005A5C77 Relevance: .8, Instructions: 800COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005A70BF Relevance: .8, Instructions: 773COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0059ED14 Relevance: .7, Instructions: 694COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005A6A7B Relevance: .5, Instructions: 509COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0059BE13 Relevance: .4, Instructions: 449COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005B0B43 Relevance: .3, Instructions: 345COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005B0F78 Relevance: .3, Instructions: 341COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005B070E Relevance: .3, Instructions: 331COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005A6646 Relevance: .3, Instructions: 325COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005B02F6 Relevance: .3, Instructions: 323COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0059E2A0 Relevance: .3, Instructions: 318COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005A3A3C Relevance: .3, Instructions: 263COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005B4969 Relevance: .2, Instructions: 237COMMONLIBRARYCODE
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005A3D6D Relevance: .2, Instructions: 232COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005B473A Relevance: .2, Instructions: 214COMMONLIBRARYCODE
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0059DE6C Relevance: .2, Instructions: 190COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0059E8A0 Relevance: .2, Instructions: 154COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0059F968 Relevance: .1, Instructions: 131COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005A37C1 Relevance: .1, Instructions: 112COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00595F3C Relevance: .1, Instructions: 76COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005BC233 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 114COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005ACD2E Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 79windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005B8EB1 Relevance: 15.1, APIs: 10, Instructions: 54COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005AACD0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 98windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00599443 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136fileCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005A8E62 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 125memoryCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005B8FA5 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 50COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005A0A8A Relevance: 12.1, APIs: 8, Instructions: 115timeCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005BEE2D Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005B9029 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 53COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005ADC9A Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 50COMMONLIBRARYCODE
Download Yara Rule
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005A0CBE Relevance: 9.1, APIs: 6, Instructions: 94timeCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005A91B0 Relevance: 9.1, APIs: 6, Instructions: 89COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005AD2E6 Relevance: 9.0, APIs: 6, Instructions: 43windowsynchronizationCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005AADED Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 59windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005B2503 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 48COMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005B75C2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0059EB73 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 20libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005BB610 Relevance: 7.6, APIs: 5, Instructions: 68COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005A075B Relevance: 7.5, APIs: 5, Instructions: 44COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005A9DBB Relevance: 6.0, APIs: 4, Instructions: 19COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005B2016 Relevance: 6.0, APIs: 4, Instructions: 14COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0059772B Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138timeCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005AEC4A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005A0889 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49threadCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005BB2AE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 005A084E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19synchronizationCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF848F1B075 Relevance: .7, Instructions: 656COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF848F1B070 Relevance: .5, Instructions: 489COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF848F1CF88 Relevance: .3, Instructions: 321COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF848F1AEED Relevance: .3, Instructions: 280COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF848F1CF20 Relevance: .4, Instructions: 438COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF848F1BBDA Relevance: .4, Instructions: 424COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF848F1C0C0 Relevance: .4, Instructions: 389COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF848F12CC3 Relevance: .4, Instructions: 383COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF848F1DA0A Relevance: .4, Instructions: 377COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF848F11B15 Relevance: .4, Instructions: 368COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF848F105F0 Relevance: .4, Instructions: 366COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF848F1DA88 Relevance: .3, Instructions: 342COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF848F1AFE8 Relevance: .3, Instructions: 338COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF848F2BF70 Relevance: .3, Instructions: 331COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF848F2BFE0 Relevance: .3, Instructions: 326COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF848F1C0BA Relevance: .3, Instructions: 320COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF848F12155 Relevance: .3, Instructions: 303COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF848F1DB08 Relevance: .3, Instructions: 301COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF848F1C128 Relevance: .3, Instructions: 290COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF848F116F8 Relevance: .3, Instructions: 285COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF848F1B035 Relevance: .3, Instructions: 274COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF848F1CC40 Relevance: .3, Instructions: 273COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF848F130AC Relevance: .3, Instructions: 273COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF848F2EA90 Relevance: .3, Instructions: 272COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF848F274F0 Relevance: .3, Instructions: 265COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF848F11C58 Relevance: .3, Instructions: 261COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF848F11CC8 Relevance: .2, Instructions: 230COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF848F105D0 Relevance: .2, Instructions: 229COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF848F12A50 Relevance: .2, Instructions: 221COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF848F2F9F0 Relevance: .2, Instructions: 216COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF848F262F0 Relevance: .2, Instructions: 211COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF848F1C229 Relevance: .2, Instructions: 209COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF848F129F0 Relevance: .2, Instructions: 202COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF848F130E0 Relevance: .2, Instructions: 200COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF848F1287D Relevance: .2, Instructions: 171COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF848F1C2A8 Relevance: .2, Instructions: 169COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF848F11D78 Relevance: .2, Instructions: 167COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF848F12E29 Relevance: .2, Instructions: 161COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF848F1CF28 Relevance: .2, Instructions: 154COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF848F124E8 Relevance: .1, Instructions: 134COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF848F1CA55 Relevance: .1, Instructions: 133COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF848F1CA48 Relevance: .1, Instructions: 125COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF848F1D6F9 Relevance: .1, Instructions: 120COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF848F1CF30 Relevance: .1, Instructions: 118COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF848F126AD Relevance: .1, Instructions: 108COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF848F12EB8 Relevance: .1, Instructions: 108COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF848F10500 Relevance: .1, Instructions: 107COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF848F1CF1D Relevance: .1, Instructions: 89COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF848F2B230 Relevance: .1, Instructions: 85COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF848F104F8 Relevance: .1, Instructions: 77COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF848F12F28 Relevance: .1, Instructions: 76COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF848F1ACC8 Relevance: .1, Instructions: 67COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF848F12739 Relevance: .1, Instructions: 65COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF848F105D8 Relevance: .1, Instructions: 59COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF848F1CF18 Relevance: .1, Instructions: 55COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF848F1B13A Relevance: .1, Instructions: 54COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF848F10608 Relevance: .0, Instructions: 42COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF848F10610 Relevance: .0, Instructions: 42COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF848F1BB11 Relevance: .0, Instructions: 37COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF848F12465 Relevance: .0, Instructions: 35COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF848F1280D Relevance: .0, Instructions: 31COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF848F1D966 Relevance: .0, Instructions: 22COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF848F12408 Relevance: .0, Instructions: 22COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00007FF848F1CE50 Relevance: .0, Instructions: 3COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|