Edit tour
Windows
Analysis Report
2.exe
Overview
General Information
| Sample name: | 2.exe |
| Analysis ID: | 1583227 |
| MD5: | 119a00350e1a20e1a3ea01153b91001b |
| SHA1: | 743b83522858dfc1b7f6dc36d8671844a2832af3 |
| SHA256: | f8d8066380ecd1341441dd2b0b8562c5ec662148c86376cbc5da494af8434cee |
| Tags: | exemalwaretrojanxwormuser-Joker |
| Infos: |  |
 | |
Detection
XWorm
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected XWorm
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Found potential dummy code loops (likely to delay analysis)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
AV process strings found (often used to terminate AV products)
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality for read data from the clipboard
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to create guard pages, often used to hinder reverse engineering and debugging
Contains functionality to dynamically determine API calls
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to retrieve information about pressed keystrokes
Contains long sleeps (>= 3 min)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Potential key logger detected (key state polling based)
Program does not show much activity (idle)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match
Classification
- System is w10x64
2.exe (PID: 7392 cmdline: "C:\Users\ user\Deskt op\2.exe" MD5: 119A00350E1A20E1A3EA01153B91001B)
- cleanup
| Name | Description | Attribution | Blogpost URLs | Link |
|---|---|---|---|---|
| XWorm | Malware with wide range of capabilities ranging from RAT to ransomware. | No Attribution |
{"C2 url": ["45.207.215.58"], "Port": 7000, "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe"}| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| rat_win_xworm_v3 | Finds XWorm (version XClient, v3) samples based on characteristic strings | Sekoia.io |
| |
| MALWARE_Win_AsyncRAT | Detects AsyncRAT | ditekSHen |
| |
| Windows_Trojan_Donutloader_f40e3759 | unknown | unknown |
| |
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security |
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| rat_win_xworm_v3 | Finds XWorm (version XClient, v3) samples based on characteristic strings | Sekoia.io |
| |
| MALWARE_Win_AsyncRAT | Detects AsyncRAT | ditekSHen |
| |
| JoeSecurity_XWorm | Yara detected XWorm | Joe Security | ||
| rat_win_xworm_v3 | Finds XWorm (version XClient, v3) samples based on characteristic strings | Sekoia.io |
| |
| Click to see the 2 entries | ||||
⊘No Sigma rule has matched
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2025-01-02T09:06:03.236124+0100 | 2853193 | 1 | Malware Command and Control Activity Detected | 192.168.2.4 | 50042 | 45.207.215.58 | 7000 | TCP |
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | Malware Configuration Extractor: | ||
| Source: | Virustotal: | Perma Link | ||
| Source: | ReversingLabs: | |||
| Source: | Integrated Neural Analysis Model: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Code function: | 0_2_00F97965 | |
Networking | |
|---|
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | URLs: | ||
| Source: | TCP traffic: | ||
| Source: | ASN Name: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | String found in binary or memory: | ||
| Source: | Code function: | 0_2_0100B18F | |
| Source: | Code function: | 0_2_00FD015A | |
| Source: | Code function: | 0_2_01006155 | |
| Source: | Code function: | 0_2_00F8E181 | |
| Source: | Code function: | 0_2_00FDA29E | |
| Source: | Code function: | 0_2_00FF2373 | |
| Source: | Code function: | 0_2_00FB84D7 | |
| Source: | Code function: | 0_2_00FB6642 | |
| Source: | Code function: | 0_2_00FAED51 | |
| Source: | Code function: | 0_2_01021091 | |
| Source: | Code function: | 0_2_010055BD | |
| Source: | Code function: | 0_2_0100B5CB | |
| Source: | Code function: | 0_2_00FD96DB | |
System Summary | |
|---|
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Process Stats: | ||
| Source: | Code function: | 0_2_00F9C5BA | |
| Source: | Code function: | 0_2_00FEE628 | |
| Source: | Code function: | 0_2_010106F0 | |
| Source: | Code function: | 0_2_00FCCAEB | |
| Source: | Code function: | 0_2_00FFCCD5 | |
| Source: | Code function: | 0_2_01076D2B | |
| Source: | Code function: | 0_2_00FA54B9 | |
| Source: | Code function: | 0_2_00FED58C | |
| Source: | Code function: | 0_2_00FFD624 | |
| Source: | Code function: | 0_2_00F81AF0 | |
| Source: | Code function: | 0_2_00FFBA64 | |
| Source: | Code function: | 0_2_00F81A30 | |
| Source: | Code function: | 0_2_01085BFC | |
| Source: | Code function: | 0_2_00FBDD8A | |
| Source: | Code function: | 0_2_051555D8 | |
| Source: | Code function: | 0_2_05154D08 | |
| Source: | Code function: | 0_2_051507A0 | |
| Source: | Code function: | 0_2_051549C0 | |
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Static PE information: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Cryptographic APIs: | ||
| Source: | Binary or memory string: | ||
| Source: | Classification label: | ||
| Source: | Code function: | 0_2_00F81150 | |
| Source: | Code function: | 0_2_00FCC81B | |
| Source: | Code function: | 0_2_00F864ED | |
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | Static PE information: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Virustotal: | ||
| Source: | ReversingLabs: | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Key value queried: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | Static file information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
Data Obfuscation | |
|---|
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | .Net Code: | ||
| Source: | Code function: | 0_2_0107C313 | |
| Source: | Code function: | 0_2_010763E6 | |
| Source: | Code function: | 0_2_01076608 | |
| Source: | Code function: | 0_2_05156B89 | |
| Source: | Code function: | 0_2_00FA0095 | |
| Source: | Code function: | 0_2_00FF4859 | |
| Source: | Code function: | 0_2_00FF293E | |
| Source: | Code function: | 0_2_00FF33CD | |
| Source: | Code function: | 0_2_00FF33CD | |
| Source: | Code function: | 0_2_00FF33CD | |
| Source: | Code function: | 0_2_00FAF552 | |
| Source: | Code function: | 0_2_00FF36CD | |
| Source: | Code function: | 0_2_00FC98FB | |
| Source: | Code function: | 0_2_00FB3CC6 | |
| Source: | Code function: | 0_2_00FF3C94 | |
| Source: | Code function: | 0_2_00FB3C22 | |
| Source: | Code function: | 0_2_00F96406 | |
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
Malware Analysis System Evasion | |
|---|
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | API coverage: | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread injection, dropped files, key value created, disk infection and DNS query: | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | File Volume queried: | Jump to behavior | ||
| Source: | Code function: | 0_2_00F97965 | |
| Source: | Code function: | 0_2_01078561 | |
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | API call chain: | graph_0-87942 | ||
| Source: | Process information queried: | Jump to behavior | ||
Anti Debugging | |
|---|
| Source: | Process Stats: | ||
| Source: | Code function: | 0_2_0107C421 | |
| Source: | Code function: | 0_2_01078561 | |
| Source: | Code function: | 0_2_0107C313 | |
| Source: | Code function: | 0_2_010EFE2B | |
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Thread injection, dropped files, key value created, disk infection and DNS query: | ||
| Source: | Code function: | 0_2_0107C421 | |
| Source: | Code function: | 0_2_01074C92 | |
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Code function: | 0_2_00F82D4F | |
| Source: | Code function: | 0_2_00FCF35D | |
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Code function: | 0_2_010797D1 | |
| Source: | Code function: | 0_2_01082D70 | |
| Source: | Code function: | 0_2_00F96406 | |
| Source: | Key value queried: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
| Source: | WMI Queries: | ||
Stealing of Sensitive Information | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
Remote Access Functionality | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | 11 Windows Management Instrumentation | 1 DLL Side-Loading | 1 DLL Side-Loading | 11 Disable or Modify Tools | 21 Input Capture | 2 System Time Discovery | Remote Services | 21 Input Capture | 1 Encrypted Channel | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
| Credentials | Domains | Default Accounts | 1 Native API | Boot or Logon Initialization Scripts | Boot or Logon Initialization Scripts | 232 Virtualization/Sandbox Evasion | LSASS Memory | 231 Security Software Discovery | Remote Desktop Protocol | 11 Archive Collected Data | 1 Non-Standard Port | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | Logon Script (Windows) | 11 Deobfuscate/Decode Files or Information | Security Account Manager | 232 Virtualization/Sandbox Evasion | SMB/Windows Admin Shares | 1 Clipboard Data | 1 Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | 2 Obfuscated Files or Information | NTDS | 2 Process Discovery | Distributed Component Object Model | Input Capture | Protocol Impersonation | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | Network Logon Script | 2 Software Packing | LSA Secrets | 11 Application Window Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
| Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | 1 DLL Side-Loading | Cached Domain Credentials | 1 File and Directory Discovery | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
| DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | Compile After Delivery | DCSync | 26 System Information Discovery | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 65% | Virustotal | Browse | ||
| 58% | ReversingLabs | Win32.Trojan.XWorm |
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | Avira URL Cloud | safe |
⊘No contacted domains info
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| true |
| unknown |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false | high |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 45.207.215.58 | unknown | Seychelles | 135357 | SKHT-ASShenzhenKatherineHengTechnologyInformationCo | true |
| Joe Sandbox version: | 41.0.0 Charoite |
| Analysis ID: | 1583227 |
| Start date and time: | 2025-01-02 09:02:05 +01:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 7m 32s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 5 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | 2.exe |
| Detection: | MAL |
| Classification: | mal100.troj.evad.winEXE@1/0@0/1 |
| EGA Information: |
|
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
- Excluded IPs from analysis (whitelisted): 20.109.210.53, 13.107.246.45
- Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
- Not all processes where analyzed, report is missing behavior information
- Report size exceeded maximum capacity and may have missing disassembly code.
- Report size getting too big, too many NtOpenKeyEx calls found.
- Report size getting too big, too many NtQueryValueKey calls found.
| Time | Type | Description |
|---|---|---|
| 03:02:57 | API Interceptor |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 45.207.215.58 | Get hash | malicious | XWorm | Browse | ||
| Get hash | malicious | Okiru | Browse |
⊘No context
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| SKHT-ASShenzhenKatherineHengTechnologyInformationCo | Get hash | malicious | XWorm | Browse |
| |
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | Remcos, GuLoader | Browse |
|
⊘No context
⊘No context
⊘No created / dropped files found
| File type: | |
| Entropy (8bit): | 6.555504520761382 |
| TrID: |
|
| File name: | 2.exe |
| File size: | 1'749'504 bytes |
| MD5: | 119a00350e1a20e1a3ea01153b91001b |
| SHA1: | 743b83522858dfc1b7f6dc36d8671844a2832af3 |
| SHA256: | f8d8066380ecd1341441dd2b0b8562c5ec662148c86376cbc5da494af8434cee |
| SHA512: | 7b8320e44f54f6c1e9b43ba41b7c7cf8fa9b1c2a7c78ed0c3648c4835b202de2d19884cfa1f380b8210df771d661542cc9044308687269fddfa9dfeeebe43ae2 |
| SSDEEP: | 49152:9ORCQxgswnpPJDps5v/FyqnL0t9sSeO6ONSuA7MjsfdVx7X+0YRYs:9nQxgswpPJDpS9bL0t9sS2ONSuA73DVA |
| TLSH: | E285AD3D7A619876C6323131854EF3BAE2BA8AB04DB5575766901F3C2F304D2892C76F |
| File Content Preview: | MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&.qNb...b...b...k...n.......O...................k...K...b...c.......a.......c.......c...Richb...........................PE..L.. |
 | |
| Icon Hash: | 9e1f191f6777733a |
| Entrypoint: | 0x4f5f0d |
| Entrypoint Section: | .text |
| Digitally signed: | false |
| Imagebase: | 0x400000 |
| Subsystem: | windows gui |
| Image File Characteristics: | EXECUTABLE_IMAGE, 32BIT_MACHINE |
| DLL Characteristics: | DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x675F85C6 [Mon Dec 16 01:43:34 2024 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 5 |
| OS Version Minor: | 1 |
| File Version Major: | 5 |
| File Version Minor: | 1 |
| Subsystem Version Major: | 5 |
| Subsystem Version Minor: | 1 |
| Import Hash: | 2412baa1f91d30db11660ad19c16100b |
| Instruction |
|---|
| call 00007F7A21011CCBh |
| jmp 00007F7A21007C3Eh |
| mov edi, edi |
| push ebp |
| mov ebp, esp |
| push ecx |
| push ebx |
| mov eax, dword ptr [ebp+0Ch] |
| add eax, 0Ch |
| mov dword ptr [ebp-04h], eax |
| mov ebx, dword ptr fs:[00000000h] |
| mov eax, dword ptr [ebx] |
| mov dword ptr fs:[00000000h], eax |
| mov eax, dword ptr [ebp+08h] |
| mov ebx, dword ptr [ebp+0Ch] |
| mov ebp, dword ptr [ebp-04h] |
| mov esp, dword ptr [ebx-04h] |
| jmp eax |
| pop ebx |
| leave |
| retn 0008h |
| pop eax |
| pop ecx |
| xchg dword ptr [esp], eax |
| jmp eax |
| mov edi, edi |
| push ebp |
| mov ebp, esp |
| push ecx |
| push ecx |
| push ebx |
| push esi |
| push edi |
| mov esi, dword ptr fs:[00000000h] |
| mov dword ptr [ebp-04h], esi |
| mov dword ptr [ebp-08h], 004F5F7Bh |
| push 00000000h |
| push dword ptr [ebp+0Ch] |
| push dword ptr [ebp-08h] |
| push dword ptr [ebp+08h] |
| call 00007F7A2101D8D2h |
| mov eax, dword ptr [ebp+0Ch] |
| mov eax, dword ptr [eax+04h] |
| and eax, FFFFFFFDh |
| mov ecx, dword ptr [ebp+0Ch] |
| mov dword ptr [ecx+04h], eax |
| mov edi, dword ptr fs:[00000000h] |
| mov ebx, dword ptr [ebp-04h] |
| mov dword ptr [ebx], edi |
| mov dword ptr fs:[00000000h], ebx |
| pop edi |
| pop esi |
| pop ebx |
| leave |
| retn 0008h |
| push ebp |
| mov ebp, esp |
| sub esp, 08h |
| push ebx |
| push esi |
| push edi |
| cld |
| mov dword ptr [ebp-04h], eax |
| xor eax, eax |
| push eax |
| push eax |
| push eax |
| push dword ptr [ebp-04h] |
| push dword ptr [ebp+14h] |
| push dword ptr [ebp+10h] |
| push dword ptr [ebp+0Ch] |
| push dword ptr [ebp+08h] |
| call 00007F7A210128A5h |
| add esp, 20h |
| mov dword ptr [ebp-08h], eax |
| pop edi |
| pop esi |
| pop ebx |
| mov eax, dword ptr [ebp+00h] |
| Programming Language: |
|
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0x155854 | 0x17c | .rdata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x178000 | 0x13f80 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x18c000 | 0x197e8 | .reloc |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0x119cf0 | 0x1c | .rdata |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x1407c0 | 0x40 | .rdata |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x119000 | 0x92c | .rdata |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x11778b | 0x117800 | 903291924b9b60629c10ab56d40a3783 | False | 0.5608988917151163 | COM executable for DOS | 6.533607267775877 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .rdata | 0x119000 | 0x3fa20 | 0x3fc00 | 88f6bf699551419e91214bb39b70f0fb | False | 0.2682329963235294 | data | 5.096045151045352 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .data | 0x159000 | 0x1e7e4 | 0x17400 | 368c12c069e412a97ffbaf8b1214b993 | False | 0.8108303931451613 | data | 7.604032792240809 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .rsrc | 0x178000 | 0x13f80 | 0x14000 | 6fa24f32af9342580a67dcda73dac792 | False | 0.73487548828125 | data | 6.835151820226615 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .reloc | 0x18c000 | 0x28438 | 0x28600 | 121aefc712dc7dfc9f7aba74f211daae | False | 0.26438540054179566 | data | 4.95101252025854 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| RT_CURSOR | 0x178d78 | 0x134 | Targa image data - RGB 64 x 65536 x 1 +32 "\001" | Chinese | China | 0.4805194805194805 |
| RT_CURSOR | 0x178eac | 0xb4 | Targa image data - Map 32 x 65536 x 1 +16 "\001" | Chinese | China | 0.7 |
| RT_CURSOR | 0x178f60 | 0x134 | AmigaOS bitmap font "(", fc_YSize 4294967264, 5120 elements, 2nd "\377\360?\377\377\370\177\377\377\374\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd | Chinese | China | 0.36363636363636365 |
| RT_CURSOR | 0x179094 | 0x134 | Targa image data - RLE 64 x 65536 x 1 +32 "\001" | Chinese | China | 0.35714285714285715 |
| RT_CURSOR | 0x1791c8 | 0x134 | data | Chinese | China | 0.37337662337662336 |
| RT_CURSOR | 0x1792fc | 0x134 | data | Chinese | China | 0.37662337662337664 |
| RT_CURSOR | 0x179430 | 0x134 | Targa image data 64 x 65536 x 1 +32 "\001" | Chinese | China | 0.36688311688311687 |
| RT_CURSOR | 0x179564 | 0x134 | Targa image data 64 x 65536 x 1 +32 "\001" | Chinese | China | 0.37662337662337664 |
| RT_CURSOR | 0x179698 | 0x134 | Targa image data - Mono - RLE 64 x 65536 x 1 +32 "\001" | Chinese | China | 0.36688311688311687 |
| RT_CURSOR | 0x1797cc | 0x134 | Targa image data - RGB - RLE 64 x 65536 x 1 +32 "\001" | Chinese | China | 0.38636363636363635 |
| RT_CURSOR | 0x179900 | 0x134 | data | Chinese | China | 0.44155844155844154 |
| RT_CURSOR | 0x179a34 | 0x134 | data | Chinese | China | 0.4155844155844156 |
| RT_CURSOR | 0x179b68 | 0x134 | AmigaOS bitmap font "(", fc_YSize 4294966847, 3840 elements, 2nd "\377?\374\377\377\300\003\377\377\300\003\377\377\340\007\377\377\360\017\377\377\370\037\377\377\374?\377\377\376\177\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd | Chinese | China | 0.5422077922077922 |
| RT_CURSOR | 0x179c9c | 0x134 | data | Chinese | China | 0.2662337662337662 |
| RT_CURSOR | 0x179dd0 | 0x134 | data | Chinese | China | 0.2824675324675325 |
| RT_CURSOR | 0x179f04 | 0x134 | data | Chinese | China | 0.3246753246753247 |
| RT_BITMAP | 0x17a038 | 0xb8 | Device independent bitmap graphic, 12 x 10 x 4, image size 80 | Chinese | China | 0.44565217391304346 |
| RT_BITMAP | 0x17a0f0 | 0x144 | Device independent bitmap graphic, 33 x 11 x 4, image size 220 | Chinese | China | 0.37962962962962965 |
| RT_ICON | 0x17a234 | 0x668 | Device independent bitmap graphic, 48 x 96 x 4, image size 1152 | Chinese | China | 0.5335365853658537 |
| RT_ICON | 0x17a89c | 0x2e8 | Device independent bitmap graphic, 32 x 64 x 4, image size 512 | Chinese | China | 0.646505376344086 |
| RT_ICON | 0x17ab84 | 0x1e8 | Device independent bitmap graphic, 24 x 48 x 4, image size 288 | Chinese | China | 0.6598360655737705 |
| RT_ICON | 0x17ad6c | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 128 | Chinese | China | 0.6385135135135135 |
| RT_ICON | 0x17ae94 | 0xea8 | Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors | Chinese | China | 0.6260660980810234 |
| RT_ICON | 0x17bd3c | 0x8a8 | Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors | Chinese | China | 0.7793321299638989 |
| RT_ICON | 0x17c5e4 | 0x6c8 | Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors | Chinese | China | 0.8231566820276498 |
| RT_ICON | 0x17ccac | 0x568 | Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors | Chinese | China | 0.6575144508670521 |
| RT_ICON | 0x17d214 | 0x93cb | PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced | Chinese | China | 0.9988106250825954 |
| RT_ICON | 0x1865e0 | 0x25a8 | Device independent bitmap graphic, 48 x 96 x 32, image size 9600 | Chinese | China | 0.5116182572614107 |
| RT_ICON | 0x188b88 | 0x10a8 | Device independent bitmap graphic, 32 x 64 x 32, image size 4224 | Chinese | China | 0.6109287054409006 |
| RT_ICON | 0x189c30 | 0x988 | Device independent bitmap graphic, 24 x 48 x 32, image size 2400 | Chinese | China | 0.6221311475409836 |
| RT_ICON | 0x18a5b8 | 0x468 | Device independent bitmap graphic, 16 x 32 x 32, image size 1088 | Chinese | China | 0.7402482269503546 |
| RT_DIALOG | 0x18aa20 | 0x120 | data | Chinese | China | 0.6145833333333334 |
| RT_DIALOG | 0x18ab40 | 0xd8 | data | Chinese | China | 0.7268518518518519 |
| RT_DIALOG | 0x18ac18 | 0xe2 | data | Chinese | China | 0.6769911504424779 |
| RT_DIALOG | 0x18acfc | 0x34 | data | Chinese | China | 0.8653846153846154 |
| RT_STRING | 0x18ad30 | 0x44 | data | Chinese | China | 0.6764705882352942 |
| RT_STRING | 0x18ad74 | 0x4e | data | Chinese | China | 0.8461538461538461 |
| RT_STRING | 0x18adc4 | 0x2c | data | Chinese | China | 0.5909090909090909 |
| RT_STRING | 0x18adf0 | 0x84 | data | Chinese | China | 0.9166666666666666 |
| RT_STRING | 0x18ae74 | 0x1c4 | data | Chinese | China | 0.8053097345132744 |
| RT_STRING | 0x18b038 | 0x14e | data | Chinese | China | 0.5179640718562875 |
| RT_STRING | 0x18b188 | 0x10e | data | Chinese | China | 0.7037037037037037 |
| RT_STRING | 0x18b298 | 0x50 | data | Chinese | China | 0.7125 |
| RT_STRING | 0x18b2e8 | 0x44 | data | Chinese | China | 0.6764705882352942 |
| RT_STRING | 0x18b32c | 0x68 | data | Chinese | China | 0.7019230769230769 |
| RT_STRING | 0x18b394 | 0x1b2 | data | Chinese | China | 0.6474654377880185 |
| RT_STRING | 0x18b548 | 0xf4 | data | Chinese | China | 0.6065573770491803 |
| RT_STRING | 0x18b63c | 0x24 | data | Chinese | China | 0.4722222222222222 |
| RT_STRING | 0x18b660 | 0x1a6 | data | Chinese | China | 0.6658767772511849 |
| RT_GROUP_CURSOR | 0x18b808 | 0x22 | Lotus unknown worksheet or configuration, revision 0x2 | Chinese | China | 1.0294117647058822 |
| RT_GROUP_CURSOR | 0x18b82c | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | Chinese | China | 1.3 |
| RT_GROUP_CURSOR | 0x18b840 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | Chinese | China | 1.3 |
| RT_GROUP_CURSOR | 0x18b854 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | Chinese | China | 1.3 |
| RT_GROUP_CURSOR | 0x18b868 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | Chinese | China | 1.3 |
| RT_GROUP_CURSOR | 0x18b87c | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | Chinese | China | 1.3 |
| RT_GROUP_CURSOR | 0x18b890 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | Chinese | China | 1.3 |
| RT_GROUP_CURSOR | 0x18b8a4 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | Chinese | China | 1.3 |
| RT_GROUP_CURSOR | 0x18b8b8 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | Chinese | China | 1.3 |
| RT_GROUP_CURSOR | 0x18b8cc | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | Chinese | China | 1.3 |
| RT_GROUP_CURSOR | 0x18b8e0 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | Chinese | China | 1.3 |
| RT_GROUP_CURSOR | 0x18b8f4 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | Chinese | China | 1.3 |
| RT_GROUP_CURSOR | 0x18b908 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | Chinese | China | 1.3 |
| RT_GROUP_CURSOR | 0x18b91c | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | Chinese | China | 1.3 |
| RT_GROUP_CURSOR | 0x18b930 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | Chinese | China | 1.3 |
| RT_GROUP_ICON | 0x18b944 | 0xbc | data | Chinese | China | 0.6117021276595744 |
| RT_VERSION | 0x18ba00 | 0x314 | data | Chinese | China | 0.4010152284263959 |
| RT_MANIFEST | 0x18bd14 | 0x26a | ASCII text, with very long lines (618), with no line terminators | English | United States | 0.43042071197411 |
| DLL | Import |
|---|---|
| KERNEL32.dll | IsValidCodePage, GetStdHandle, LCMapStringW, FreeEnvironmentStringsW, GetEnvironmentStringsW, SetHandleCount, QueryPerformanceCounter, GetStringTypeW, CompareStringW, GetTimeZoneInformation, GetConsoleCP, GetConsoleMode, WriteConsoleW, CreateFileW, FindResourceW, HeapCreate, IsProcessorFeaturePresent, IsDebuggerPresent, SetUnhandledExceptionFilter, UnhandledExceptionFilter, TerminateProcess, GetFileType, SetStdHandle, GetSystemTimeAsFileTime, HeapSize, HeapQueryInformation, HeapReAlloc, VirtualQuery, GetSystemInfo, LoadResource, LockResource, SizeofResource, WideCharToMultiByte, CreateThread, TerminateThread, Sleep, Process32Next, Process32First, CreateToolhelp32Snapshot, FreeLibrary, VirtualAlloc, RaiseException, ExitThread, RtlUnwind, GetStartupInfoW, HeapSetInformation, GetCommandLineA, ExitProcess, HeapAlloc, HeapFree, DecodePointer, EncodePointer, FindResourceExW, SearchPathA, GetProfileIntA, GetTickCount, InitializeCriticalSectionAndSpinCount, GetNumberFormatA, GetWindowsDirectoryA, GetTempPathA, GetTempFileNameA, GetFileTime, GetFileSizeEx, GetFileAttributesA, FileTimeToLocalFileTime, GetFileAttributesExA, SetErrorMode, GetOEMCP, GetCPInfo, FileTimeToSystemTime, GetACP, GetFullPathNameA, GetVolumeInformationA, FindFirstFileA, FindClose, GetCurrentProcess, DuplicateHandle, GetFileSize, SetEndOfFile, UnlockFile, LockFile, FlushFileBuffers, SetFilePointer, WriteFile, SetEnvironmentVariableA, ReadFile, lstrcmpiA, lstrcpyA, DeleteFileA, InterlockedIncrement, TlsFree, DeleteCriticalSection, LocalReAlloc, TlsSetValue, TlsAlloc, InitializeCriticalSection, GlobalHandle, GlobalReAlloc, EnterCriticalSection, TlsGetValue, LeaveCriticalSection, LocalAlloc, GlobalFlags, GetCurrentDirectoryA, GlobalGetAtomNameA, GlobalFindAtomA, GetVersionExA, LoadLibraryW, lstrcmpW, InterlockedDecrement, GetModuleFileNameW, ReleaseActCtx, CreateActCtxW, CopyFileA, GlobalSize, FormatMessageA, LocalFree, lstrlenW, MulDiv, GlobalUnlock, GlobalFree, FindResourceA, FreeResource, GetCurrentProcessId, GlobalAddAtomA, GetPrivateProfileStringA, WritePrivateProfileStringA, GetPrivateProfileIntA, lstrlenA, WaitForSingleObject, ResumeThread, SetThreadPriority, GlobalDeleteAtom, GetCurrentThread, GetCurrentThreadId, MultiByteToWideChar, GetUserDefaultUILanguage, ConvertDefaultLocale, GetSystemDefaultUILanguage, GetModuleFileNameA, GetLocaleInfoA, CompareStringA, ActivateActCtx, LoadLibraryA, GetLastError, DeactivateActCtx, SetLastError, InterlockedExchange, GlobalLock, lstrcmpA, GlobalAlloc, GetModuleHandleW, GetProcAddress, CloseHandle, VirtualProtect, CreateFileA, GetModuleHandleA |
| USER32.dll | IsDialogMessageA, SetWindowTextA, MoveWindow, ShowWindow, CharUpperA, IntersectRect, OffsetRect, LoadMenuW, SetWindowRgn, RedrawWindow, MessageBeep, NotifyWinEvent, GetAsyncKeyState, IsZoomed, IsRectEmpty, UnionRect, EnableScrollBar, SetCapture, MonitorFromPoint, IsMenu, CreatePopupMenu, SetMenuDefaultItem, GetMenuDefaultItem, UnregisterClassA, TranslateAcceleratorA, BringWindowToTop, InsertMenuItemA, LoadAcceleratorsA, LoadImageA, LoadMenuA, ReuseDDElParam, SetParent, DestroyAcceleratorTable, SetClassLongA, DrawIconEx, DrawEdge, DrawFocusRect, CopyAcceleratorTableA, ToAsciiEx, MapVirtualKeyA, GetKeyboardLayout, GetKeyboardState, LoadAcceleratorsW, CreateAcceleratorTableA, SetRect, SetCursorPos, LockWindowUpdate, InvertRect, HideCaret, GetIconInfo, CopyImage, GetNextDlgGroupItem, OpenClipboard, SetClipboardData, CloseClipboard, EmptyClipboard, LoadImageW, RegisterClipboardFormatA, FrameRect, CopyIcon, CharUpperBuffA, PostThreadMessageA, GetKeyNameTextA, DefFrameProcA, DefMDIChildProcA, DrawMenuBar, TranslateMDISysAccel, CreateMenu, IsClipboardFormatAvailable, GetUpdateRect, GetDoubleClickTime, IsCharLowerA, MapVirtualKeyExA, SubtractRect, DestroyCursor, MapDialogRect, CheckDlgButton, RegisterWindowMessageA, DeleteMenu, WaitMessage, RealChildWindowFromPoint, LoadIconA, SendDlgItemMessageA, WinHelpA, SetTimer, KillTimer, SetRectEmpty, EnumDisplayMonitors, IsChild, SetLayeredWindowAttributes, GetSysColorBrush, DrawFrameControl, DestroyIcon, GetWindowRgn, WindowFromPoint, LoadCursorW, LoadCursorA, UpdateLayeredWindow, ReleaseCapture, EnableWindow, DrawIcon, GetClientRect, GetSystemMetrics, IsIconic, SendMessageA, AppendMenuA, GetSystemMenu, LoadIconW, UnpackDDElParam, PostMessageA, PostQuitMessage, CheckMenuItem, EnableMenuItem, GetMenuState, ModifyMenuA, GetParent, GetFocus, LoadBitmapW, GetMenuCheckMarkDimensions, SetMenuItemBitmaps, ValidateRect, GetCursorPos, PeekMessageA, GetKeyState, IsWindowVisible, GetActiveWindow, DispatchMessageA, TranslateMessage, GetMessageA, CallNextHookEx, SetWindowsHookExA, SetCursor, ShowOwnedPopups, MessageBoxA, IsWindowEnabled, GetLastActivePopup, GetWindowLongA, GetWindowThreadProcessId, DrawStateA, FillRect, UpdateWindow, InvalidateRect, GetClassNameA, EndDialog, GetNextDlgTabItem, GetDlgItem, IsWindow, DestroyWindow, CreateDialogIndirectParamA, SetActiveWindow, GetDesktopWindow, RemoveMenu, GetSubMenu, GetMenuItemCount, InsertMenuA, GetMenuItemID, GetMenuStringA, TabbedTextOutA, DrawTextA, DrawTextExA, GrayStringA, ScreenToClient, ClientToScreen, GetDC, ReleaseDC, GetWindowDC, BeginPaint, EndPaint, GetSysColor, PtInRect, GetWindowRect, UnhookWindowsHookEx, CopyRect, InflateRect, GetMenuItemInfoA, DestroyMenu, SystemParametersInfoA, GetWindow, SetWindowPos, SetWindowLongA, GetMenu, CallWindowProcA, DefWindowProcA, GetDlgCtrlID, GetWindowPlacement, SetWindowPlacement, SetScrollInfo, GetScrollInfo, DeferWindowPos, EqualRect, AdjustWindowRectEx, RegisterClassA, GetClassInfoA, GetClassInfoExA, CreateWindowExA, ShowScrollBar, SetForegroundWindow, GetScrollPos, SetScrollPos, GetScrollRange, SetScrollRange, SetMenu, TrackPopupMenu, ScrollWindow, MapWindowPoints, GetMonitorInfoA, MonitorFromWindow, GetMessagePos, GetMessageTime, GetTopWindow, EndDeferWindowPos, BeginDeferWindowPos, GetForegroundWindow, GetWindowTextA, GetWindowTextLengthA, SetFocus, RemovePropA, GetPropA, SetPropA, GetClassLongA, GetCapture |
| GDI32.dll | SetPixelV, CreateBitmap, DeleteObject, CreateSolidBrush, GetObjectA, GetStockObject, GetDeviceCaps, CopyMetaFileA, CreateDCA, SaveDC, RestoreDC, SetBkColor, SetBkMode, SetPolyFillMode, SetROP2, SetTextColor, SetMapMode, GetClipBox, ExcludeClipRect, IntersectClipRect, LineTo, MoveToEx, SetTextAlign, GetLayout, SetLayout, SelectClipRgn, CreateRectRgn, GetViewportExtEx, GetWindowExtEx, BitBlt, GetPixel, PtVisible, RectVisible, TextOutA, ExtTextOutA, Escape, SelectObject, SetViewportOrgEx, OffsetViewportOrgEx, SetViewportExtEx, ScaleViewportExtEx, SetWindowOrgEx, OffsetWindowOrgEx, SetWindowExtEx, ScaleWindowExtEx, ExtSelectClipRgn, DeleteDC, CreatePatternBrush, CreateCompatibleDC, SelectPalette, GetObjectType, CreatePen, CreateHatchBrush, CreateFontIndirectA, GetTextExtentPoint32A, CreateDIBitmap, CreateCompatibleBitmap, CreateRectRgnIndirect, GetTextMetricsA, EnumFontFamiliesA, GetTextCharsetInfo, SetRectRgn, CombineRgn, PatBlt, DPtoLP, CreateRoundRectRgn, CreateDIBSection, CreatePolygonRgn, GetBkColor, GetTextColor, CreateEllipticRgn, Polyline, Ellipse, Polygon, CreatePalette, GetPaletteEntries, GetNearestPaletteIndex, RealizePalette, GetSystemPaletteEntries, OffsetRgn, GetRgnBox, SetDIBColorTable, StretchBlt, SetPixel, Rectangle, EnumFontFamiliesExA, ExtFloodFill, SetPaletteEntries, LPtoDP, GetWindowOrgEx, GetViewportOrgEx, PtInRegion, FillRgn, FrameRgn, GetBoundsRect, GetTextFaceA |
| MSIMG32.dll | AlphaBlend, TransparentBlt |
| COMDLG32.dll | GetFileTitleA |
| WINSPOOL.DRV | ClosePrinter, DocumentPropertiesA, OpenPrinterA |
| ADVAPI32.dll | RegOpenKeyExA, RegCreateKeyExA, RegCloseKey, RegQueryValueExA, RegSetValueExA, RegDeleteValueA, RegEnumKeyA, RegQueryValueA, RegEnumValueA, RegEnumKeyExA, RegDeleteKeyA |
| SHELL32.dll | SHGetFileInfoA, DragFinish, DragQueryFileA, SHGetDesktopFolder, SHGetPathFromIDListA, SHGetSpecialFolderLocation, ShellExecuteA, SHAppBarMessage, SHBrowseForFolderA |
| COMCTL32.dll | ImageList_GetIconSize |
| SHLWAPI.dll | PathFindExtensionA, PathFindFileNameA, PathStripToRootA, PathIsUNCA, PathRemoveFileSpecW |
| ole32.dll | RevokeDragDrop, CoLockObjectExternal, RegisterDragDrop, OleGetClipboard, OleLockRunning, IsAccelerator, OleTranslateAccelerator, OleDestroyMenuDescriptor, OleCreateMenuDescriptor, DoDragDrop, CreateStreamOnHGlobal, CoInitializeEx, CoInitialize, CoCreateInstance, CoUninitialize, OleDuplicateData, CoTaskMemAlloc, ReleaseStgMedium, CoTaskMemFree, CoCreateGuid |
| OLEAUT32.dll | VariantClear, VariantChangeType, VariantInit, SysStringLen, SysAllocStringLen, SysFreeString, SysAllocString, VarBstrFromDate, SystemTimeToVariantTime, VariantTimeToSystemTime |
| gdiplus.dll | GdipCreateBitmapFromStream, GdipGetImagePalette, GdipGetImagePaletteSize, GdipGetImagePixelFormat, GdipGetImageHeight, GdipGetImageWidth, GdipCloneImage, GdipDrawImageRectI, GdipSetInterpolationMode, GdipCreateFromHDC, GdiplusShutdown, GdiplusStartup, GdipCreateBitmapFromHBITMAP, GdipDisposeImage, GdipDeleteGraphics, GdipAlloc, GdipFree, GdipCreateBitmapFromScan0, GdipBitmapLockBits, GdipDrawImageI, GdipGetImageGraphicsContext, GdipBitmapUnlockBits |
| IPHLPAPI.DLL | GetTcpTable2, SetTcpEntry |
| WS2_32.dll | inet_ntop, htonl |
| OLEACC.dll | AccessibleObjectFromWindow, LresultFromObject, CreateStdAccessibleObject |
| IMM32.dll | ImmGetContext, ImmGetOpenStatus, ImmReleaseContext |
| WINMM.dll | PlaySoundA |
| Language of compilation system | Country where language is spoken | Map |
|---|---|---|
| Chinese | China |  |
| English | United States |  |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | SID | Signature | Severity | Source IP | Source Port | Dest IP | Dest Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2025-01-02T09:04:10.632637+0100 | 2855924 | ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound | 1 | 192.168.2.4 | 49837 | 45.207.215.58 | 7000 | TCP |
| 2025-01-02T09:06:03.236124+0100 | 2853193 | ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound | 1 | 192.168.2.4 | 50042 | 45.207.215.58 | 7000 | TCP |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Jan 2, 2025 09:03:01.303708076 CET | 49731 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:01.308528900 CET | 7000 | 49731 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:03:01.308599949 CET | 49731 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:01.482429028 CET | 49731 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:01.491786003 CET | 7000 | 49731 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:03:03.364532948 CET | 7000 | 49731 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:03:03.364617109 CET | 49731 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:04.876215935 CET | 49731 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:04.877474070 CET | 49732 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:04.881138086 CET | 7000 | 49731 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:03:04.882340908 CET | 7000 | 49732 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:03:04.882431984 CET | 49732 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:04.899415016 CET | 49732 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:04.904300928 CET | 7000 | 49732 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:03:06.925477028 CET | 7000 | 49732 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:03:06.925605059 CET | 49732 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:09.044536114 CET | 49732 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:09.049433947 CET | 7000 | 49732 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:03:09.050333977 CET | 49733 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:09.055254936 CET | 7000 | 49733 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:03:09.055346966 CET | 49733 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:09.202789068 CET | 49733 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:09.207705021 CET | 7000 | 49733 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:03:11.077393055 CET | 7000 | 49733 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:03:11.077538967 CET | 49733 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:12.891817093 CET | 49733 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:12.892528057 CET | 49734 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:12.896680117 CET | 7000 | 49733 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:03:12.897388935 CET | 7000 | 49734 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:03:12.897454977 CET | 49734 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:12.919740915 CET | 49734 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:12.924590111 CET | 7000 | 49734 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:03:14.902340889 CET | 7000 | 49734 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:03:14.902419090 CET | 49734 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:17.016803026 CET | 49734 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:17.017896891 CET | 49740 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:17.021842957 CET | 7000 | 49734 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:03:17.023142099 CET | 7000 | 49740 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:03:17.023216009 CET | 49740 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:17.043034077 CET | 49740 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:17.047905922 CET | 7000 | 49740 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:03:19.047076941 CET | 7000 | 49740 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:03:19.047445059 CET | 49740 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:21.969878912 CET | 49740 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:21.970844030 CET | 49742 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:21.974806070 CET | 7000 | 49740 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:03:21.975714922 CET | 7000 | 49742 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:03:21.975815058 CET | 49742 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:21.992624044 CET | 49742 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:21.997636080 CET | 7000 | 49742 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:03:23.999439001 CET | 7000 | 49742 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:03:23.999512911 CET | 49742 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:25.970261097 CET | 49742 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:25.972567081 CET | 49743 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:25.975065947 CET | 7000 | 49742 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:03:25.977394104 CET | 7000 | 49743 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:03:25.977483034 CET | 49743 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:25.996726990 CET | 49743 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:26.001929998 CET | 7000 | 49743 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:03:27.979439974 CET | 7000 | 49743 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:03:27.983642101 CET | 49743 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:29.548048973 CET | 49743 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:29.548813105 CET | 49744 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:29.581753969 CET | 7000 | 49743 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:03:29.581772089 CET | 7000 | 49744 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:03:29.581849098 CET | 49744 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:29.599633932 CET | 49744 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:29.604437113 CET | 7000 | 49744 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:03:31.614010096 CET | 7000 | 49744 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:03:31.614132881 CET | 49744 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:33.407783031 CET | 49744 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:33.408629894 CET | 49745 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:33.412750959 CET | 7000 | 49744 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:03:33.413716078 CET | 7000 | 49745 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:03:33.413811922 CET | 49745 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:33.433409929 CET | 49745 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:33.438287973 CET | 7000 | 49745 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:03:35.438076019 CET | 7000 | 49745 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:03:35.438205957 CET | 49745 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:38.188637018 CET | 49745 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:38.189533949 CET | 49746 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:38.193543911 CET | 7000 | 49745 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:03:38.194284916 CET | 7000 | 49746 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:03:38.194458008 CET | 49746 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:38.210820913 CET | 49746 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:38.215621948 CET | 7000 | 49746 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:03:40.215435028 CET | 7000 | 49746 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:03:40.215508938 CET | 49746 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:41.142126083 CET | 49746 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:41.144246101 CET | 49747 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:41.147070885 CET | 7000 | 49746 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:03:41.149034977 CET | 7000 | 49747 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:03:41.149136066 CET | 49747 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:41.166814089 CET | 49747 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:41.171624899 CET | 7000 | 49747 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:03:43.194048882 CET | 7000 | 49747 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:03:43.194236994 CET | 49747 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:43.954242945 CET | 49747 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:43.955105066 CET | 49748 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:43.959125996 CET | 7000 | 49747 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:03:43.959908962 CET | 7000 | 49748 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:03:43.959989071 CET | 49748 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:43.979909897 CET | 49748 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:43.984658003 CET | 7000 | 49748 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:03:45.968584061 CET | 7000 | 49748 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:03:45.968662024 CET | 49748 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:46.283066988 CET | 49748 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:46.283900023 CET | 49749 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:46.287889957 CET | 7000 | 49748 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:03:46.288729906 CET | 7000 | 49749 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:03:46.288830996 CET | 49749 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:46.304570913 CET | 49749 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:46.309657097 CET | 7000 | 49749 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:03:48.287239075 CET | 7000 | 49749 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:03:48.287293911 CET | 49749 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:48.958312988 CET | 49749 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:48.961066961 CET | 49750 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:48.963186026 CET | 7000 | 49749 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:03:48.965893984 CET | 7000 | 49750 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:03:48.965995073 CET | 49750 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:49.510581970 CET | 49750 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:49.515486002 CET | 7000 | 49750 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:03:50.984214067 CET | 7000 | 49750 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:03:50.984440088 CET | 49750 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:51.736880064 CET | 49750 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:51.739034891 CET | 49751 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:51.741823912 CET | 7000 | 49750 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:03:51.743871927 CET | 7000 | 49751 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:03:51.744035006 CET | 49751 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:52.158354998 CET | 49751 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:52.163336992 CET | 7000 | 49751 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:03:53.784413099 CET | 7000 | 49751 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:03:53.784506083 CET | 49751 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:54.016731024 CET | 49751 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:54.017436028 CET | 49753 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:54.021675110 CET | 7000 | 49751 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:03:54.022361040 CET | 7000 | 49753 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:03:54.022433996 CET | 49753 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:54.038189888 CET | 49753 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:03:54.043055058 CET | 7000 | 49753 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:04:01.313730955 CET | 7000 | 49753 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:04:01.313807964 CET | 49753 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:01.579266071 CET | 49753 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:01.580008984 CET | 49790 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:01.584101915 CET | 7000 | 49753 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:04:01.584796906 CET | 7000 | 49790 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:04:01.584907055 CET | 49790 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:01.601016045 CET | 49790 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:01.605993032 CET | 7000 | 49790 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:04:03.586123943 CET | 7000 | 49790 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:04:03.586214066 CET | 49790 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:03.710297108 CET | 49790 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:03.713753939 CET | 49799 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:03.715152025 CET | 7000 | 49790 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:04:03.718563080 CET | 7000 | 49799 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:04:03.718658924 CET | 49799 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:03.825083971 CET | 49799 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:03.830033064 CET | 7000 | 49799 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:04:05.747859001 CET | 7000 | 49799 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:04:05.751301050 CET | 49799 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:10.313695908 CET | 49799 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:10.314996958 CET | 49837 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:10.318536043 CET | 7000 | 49799 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:04:10.319823980 CET | 7000 | 49837 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:04:10.319940090 CET | 49837 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:10.364715099 CET | 49837 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:10.369564056 CET | 7000 | 49837 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:04:10.632637024 CET | 49837 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:10.637531042 CET | 7000 | 49837 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:04:12.322925091 CET | 7000 | 49837 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:04:12.323008060 CET | 49837 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:15.641906977 CET | 49837 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:15.643757105 CET | 49871 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:15.646684885 CET | 7000 | 49837 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:04:15.648580074 CET | 7000 | 49871 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:04:15.648663998 CET | 49871 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:15.734035969 CET | 49871 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:15.738917112 CET | 7000 | 49871 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:04:15.782939911 CET | 49871 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:15.787692070 CET | 7000 | 49871 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:04:15.970318079 CET | 49871 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:15.975070953 CET | 7000 | 49871 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:04:16.001341105 CET | 49871 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:16.006175041 CET | 7000 | 49871 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:04:17.672837973 CET | 7000 | 49871 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:04:17.672986031 CET | 49871 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:21.080241919 CET | 49871 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:21.082750082 CET | 49903 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:21.084990978 CET | 7000 | 49871 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:04:21.087565899 CET | 7000 | 49903 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:04:21.087670088 CET | 49903 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:21.231132984 CET | 49903 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:21.235984087 CET | 7000 | 49903 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:04:21.298274994 CET | 49903 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:21.303091049 CET | 7000 | 49903 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:04:23.113632917 CET | 7000 | 49903 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:04:23.115766048 CET | 49903 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:26.329879999 CET | 49903 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:26.334651947 CET | 7000 | 49903 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:04:26.340576887 CET | 49935 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:26.346913099 CET | 7000 | 49935 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:04:26.346997023 CET | 49935 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:26.537020922 CET | 49935 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:26.541817904 CET | 7000 | 49935 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:04:26.564013004 CET | 49935 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:26.568785906 CET | 7000 | 49935 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:04:26.595413923 CET | 49935 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:26.600203037 CET | 7000 | 49935 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:04:28.354948044 CET | 7000 | 49935 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:04:28.355030060 CET | 49935 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:31.832075119 CET | 49935 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:31.833544970 CET | 49971 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:31.838854074 CET | 7000 | 49935 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:04:31.840286016 CET | 7000 | 49971 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:04:31.840399027 CET | 49971 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:32.575788021 CET | 49971 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:32.580712080 CET | 7000 | 49971 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:04:33.873929024 CET | 7000 | 49971 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:04:33.874042034 CET | 49971 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:37.847111940 CET | 49971 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:37.847723961 CET | 50012 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:37.851962090 CET | 7000 | 49971 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:04:37.852545977 CET | 7000 | 50012 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:04:37.852668047 CET | 50012 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:37.981811047 CET | 50012 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:37.986676931 CET | 7000 | 50012 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:04:39.853543043 CET | 7000 | 50012 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:04:39.853631973 CET | 50012 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:43.051588058 CET | 50012 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:43.056360006 CET | 7000 | 50012 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:04:43.118995905 CET | 50027 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:43.123919010 CET | 7000 | 50027 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:04:43.124002934 CET | 50027 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:43.707171917 CET | 50027 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:43.712052107 CET | 7000 | 50027 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:04:43.970274925 CET | 50027 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:43.975099087 CET | 7000 | 50027 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:04:44.345160007 CET | 50027 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:44.349971056 CET | 7000 | 50027 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:04:44.360763073 CET | 50027 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:44.365601063 CET | 7000 | 50027 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:04:44.376528978 CET | 50027 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:44.381383896 CET | 7000 | 50027 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:04:44.517134905 CET | 50027 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:44.521925926 CET | 7000 | 50027 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:04:45.140489101 CET | 7000 | 50027 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:04:45.142718077 CET | 50027 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:45.142718077 CET | 50027 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:45.145600080 CET | 50028 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:45.148932934 CET | 7000 | 50027 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:04:45.150624990 CET | 7000 | 50028 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:04:45.151572943 CET | 50028 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:45.349035025 CET | 50028 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:45.353934050 CET | 7000 | 50028 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:04:47.150453091 CET | 7000 | 50028 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:04:47.150517941 CET | 50028 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:50.364182949 CET | 50028 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:50.367523909 CET | 50029 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:50.368998051 CET | 7000 | 50028 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:04:50.372406006 CET | 7000 | 50029 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:04:50.372477055 CET | 50029 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:50.419919014 CET | 50029 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:50.424885035 CET | 7000 | 50029 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:04:52.389048100 CET | 7000 | 50029 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:04:52.389106035 CET | 50029 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:55.602356911 CET | 50029 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:55.605817080 CET | 50030 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:55.607259035 CET | 7000 | 50029 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:04:55.610673904 CET | 7000 | 50030 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:04:55.611633062 CET | 50030 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:55.738368988 CET | 50030 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:04:55.743329048 CET | 7000 | 50030 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:04:57.620404959 CET | 7000 | 50030 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:04:57.620475054 CET | 50030 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:00.899028063 CET | 50030 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:00.904040098 CET | 7000 | 50030 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:05:00.924504042 CET | 50031 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:00.930437088 CET | 7000 | 50031 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:05:00.930505037 CET | 50031 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:01.976555109 CET | 50031 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:01.981431961 CET | 7000 | 50031 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:05:02.972819090 CET | 7000 | 50031 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:05:02.972946882 CET | 50031 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:07.251416922 CET | 50031 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:07.252501011 CET | 50032 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:07.256356001 CET | 7000 | 50031 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:05:07.257318974 CET | 7000 | 50032 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:05:07.257414103 CET | 50032 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:07.294564962 CET | 50032 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:07.299416065 CET | 7000 | 50032 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:05:07.454746008 CET | 50032 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:07.459640026 CET | 7000 | 50032 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:05:07.501585007 CET | 50032 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:07.506433964 CET | 7000 | 50032 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:05:08.142288923 CET | 50032 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:08.147154093 CET | 7000 | 50032 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:05:09.280343056 CET | 7000 | 50032 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:05:09.280392885 CET | 50032 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:12.673245907 CET | 50032 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:12.677206039 CET | 50033 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:12.678112030 CET | 7000 | 50032 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:05:12.682082891 CET | 7000 | 50033 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:05:12.682157993 CET | 50033 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:12.717817068 CET | 50033 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:12.722618103 CET | 7000 | 50033 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:05:14.727057934 CET | 7000 | 50033 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:05:14.730068922 CET | 50033 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:17.720139027 CET | 50033 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:17.721863031 CET | 50034 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:17.725147009 CET | 7000 | 50033 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:05:17.726732969 CET | 7000 | 50034 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:05:17.726804018 CET | 50034 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:17.773340940 CET | 50034 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:17.778130054 CET | 7000 | 50034 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:05:18.658195972 CET | 50034 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:18.663049936 CET | 7000 | 50034 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:05:19.753040075 CET | 7000 | 50034 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:05:19.753976107 CET | 50034 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:23.005716085 CET | 50034 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:23.010565996 CET | 7000 | 50034 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:05:23.023736954 CET | 50035 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:23.028731108 CET | 7000 | 50035 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:05:23.031157017 CET | 50035 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:23.139477968 CET | 50035 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:23.144349098 CET | 7000 | 50035 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:05:25.047983885 CET | 7000 | 50035 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:05:25.048057079 CET | 50035 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:28.409687042 CET | 50035 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:28.410166025 CET | 50036 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:28.414609909 CET | 7000 | 50035 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:05:28.414979935 CET | 7000 | 50036 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:05:28.415090084 CET | 50036 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:28.519191027 CET | 50036 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:28.524025917 CET | 7000 | 50036 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:05:30.438448906 CET | 7000 | 50036 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:05:30.438535929 CET | 50036 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:33.627372980 CET | 50036 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:33.630132914 CET | 50037 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:33.632280111 CET | 7000 | 50036 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:05:33.635021925 CET | 7000 | 50037 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:05:33.638330936 CET | 50037 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:33.682832003 CET | 50037 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:33.687639952 CET | 7000 | 50037 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:05:33.892293930 CET | 50037 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:33.897213936 CET | 7000 | 50037 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:05:35.680099010 CET | 7000 | 50037 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:05:35.681726933 CET | 50037 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:38.954583883 CET | 50037 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:38.957581997 CET | 50038 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:38.959462881 CET | 7000 | 50037 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:05:38.962403059 CET | 7000 | 50038 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:05:38.962594986 CET | 50038 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:39.062500000 CET | 50038 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:39.067276001 CET | 7000 | 50038 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:05:39.157738924 CET | 50038 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:39.162522078 CET | 7000 | 50038 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:05:39.173362970 CET | 50038 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:39.178177118 CET | 7000 | 50038 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:05:39.220274925 CET | 50038 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:39.225080967 CET | 7000 | 50038 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:05:40.970660925 CET | 7000 | 50038 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:05:40.970853090 CET | 50038 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:44.424174070 CET | 50038 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:44.429001093 CET | 7000 | 50038 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:05:44.512080908 CET | 50039 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:44.516906977 CET | 7000 | 50039 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:05:44.517929077 CET | 50039 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:44.829353094 CET | 50039 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:44.834280014 CET | 7000 | 50039 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:05:46.550199986 CET | 7000 | 50039 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:05:46.550542116 CET | 50039 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:49.923655033 CET | 50039 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:49.929672003 CET | 7000 | 50039 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:05:49.937818050 CET | 50040 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:49.942569971 CET | 7000 | 50040 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:05:49.942643881 CET | 50040 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:49.972322941 CET | 50040 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:49.977154016 CET | 7000 | 50040 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:05:51.946372032 CET | 7000 | 50040 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:05:51.946511030 CET | 50040 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:55.941458941 CET | 50040 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:55.946301937 CET | 7000 | 50040 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:05:55.948683023 CET | 50041 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:55.953584909 CET | 7000 | 50041 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:05:55.953651905 CET | 50041 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:55.980709076 CET | 50041 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:55.985601902 CET | 7000 | 50041 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:05:57.173657894 CET | 50041 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:57.178565025 CET | 7000 | 50041 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:05:57.220413923 CET | 50041 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:05:57.225258112 CET | 7000 | 50041 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:05:57.965637922 CET | 7000 | 50041 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:05:57.965709925 CET | 50041 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:02.428996086 CET | 50041 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:02.433866978 CET | 7000 | 50041 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:02.439076900 CET | 50042 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:02.443907976 CET | 7000 | 50042 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:02.444178104 CET | 50042 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:02.889173031 CET | 50042 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:02.894026041 CET | 7000 | 50042 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:03.236124039 CET | 50042 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:03.240994930 CET | 7000 | 50042 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:03.267329931 CET | 50042 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:03.272193909 CET | 7000 | 50042 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:03.361197948 CET | 50042 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:03.366115093 CET | 7000 | 50042 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:03.376686096 CET | 50042 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:03.381501913 CET | 7000 | 50042 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:03.392292976 CET | 50042 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:03.397119999 CET | 7000 | 50042 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:03.423532009 CET | 50042 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:03.428313017 CET | 7000 | 50042 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:03.454782963 CET | 50042 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:03.459604979 CET | 7000 | 50042 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:04.451268911 CET | 7000 | 50042 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:04.454458952 CET | 50042 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:08.517297983 CET | 50042 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:08.517988920 CET | 50043 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:08.522212982 CET | 7000 | 50042 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:08.522839069 CET | 7000 | 50043 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:08.523001909 CET | 50043 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:08.564228058 CET | 50043 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:08.569077969 CET | 7000 | 50043 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:08.736455917 CET | 50043 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:08.741271973 CET | 7000 | 50043 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:08.767225027 CET | 50043 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:08.772080898 CET | 7000 | 50043 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:08.782821894 CET | 50043 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:08.787657022 CET | 7000 | 50043 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:08.876674891 CET | 50043 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:08.881592989 CET | 7000 | 50043 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:08.907953978 CET | 50043 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:08.912812948 CET | 7000 | 50043 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:09.548494101 CET | 50043 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:09.553416967 CET | 7000 | 50043 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:10.524324894 CET | 7000 | 50043 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:10.524395943 CET | 50043 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:14.033998966 CET | 50043 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:14.034173965 CET | 50044 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:14.039011955 CET | 7000 | 50043 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:14.039031982 CET | 7000 | 50044 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:14.039158106 CET | 50044 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:14.113933086 CET | 50044 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:14.118853092 CET | 7000 | 50044 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:14.439208031 CET | 50044 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:14.444066048 CET | 7000 | 50044 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:14.470418930 CET | 50044 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:14.475208044 CET | 7000 | 50044 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:14.564237118 CET | 50044 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:14.569158077 CET | 7000 | 50044 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:16.070152998 CET | 7000 | 50044 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:16.070271969 CET | 50044 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:19.683967113 CET | 50044 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:19.686758995 CET | 50045 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:19.690243959 CET | 7000 | 50044 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:19.693007946 CET | 7000 | 50045 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:19.695091009 CET | 50045 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:19.882862091 CET | 50045 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:19.952939987 CET | 7000 | 50045 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:21.717936993 CET | 7000 | 50045 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:21.718121052 CET | 50045 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:24.971887112 CET | 50045 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:24.976772070 CET | 7000 | 50045 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:25.008598089 CET | 50046 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:25.014595032 CET | 7000 | 50046 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:25.014712095 CET | 50046 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:25.409828901 CET | 50046 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:25.414777040 CET | 7000 | 50046 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:25.626779079 CET | 50046 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:25.631683111 CET | 7000 | 50046 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:27.051207066 CET | 7000 | 50046 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:27.051281929 CET | 50046 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:30.739999056 CET | 50046 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:30.741808891 CET | 50047 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:30.744832039 CET | 7000 | 50046 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:30.746699095 CET | 7000 | 50047 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:30.746805906 CET | 50047 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:30.773370028 CET | 50047 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:30.778188944 CET | 7000 | 50047 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:32.764533997 CET | 7000 | 50047 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:32.764641047 CET | 50047 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:35.829711914 CET | 50047 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:35.832724094 CET | 50048 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:35.834582090 CET | 7000 | 50047 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:35.837546110 CET | 7000 | 50048 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:35.837620974 CET | 50048 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:35.875992060 CET | 50048 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:35.880868912 CET | 7000 | 50048 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:37.841651917 CET | 7000 | 50048 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:37.841795921 CET | 50048 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:41.064078093 CET | 50048 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:41.067167997 CET | 50049 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:41.068895102 CET | 7000 | 50048 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:41.071975946 CET | 7000 | 50049 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:41.072094917 CET | 50049 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:41.142064095 CET | 50049 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:41.146934986 CET | 7000 | 50049 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:43.080264091 CET | 7000 | 50049 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:43.080518961 CET | 50049 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:46.331840038 CET | 50049 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:46.336741924 CET | 7000 | 50049 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:46.338282108 CET | 50050 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:46.343126059 CET | 7000 | 50050 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:46.343347073 CET | 50050 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:46.449507952 CET | 50050 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:46.454407930 CET | 7000 | 50050 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:46.691838026 CET | 50050 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:46.696768999 CET | 7000 | 50050 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:48.362284899 CET | 7000 | 50050 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:48.366183996 CET | 50050 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:51.814172029 CET | 50050 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:51.816540956 CET | 50051 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:51.818949938 CET | 7000 | 50050 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:51.821321964 CET | 7000 | 50051 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:51.821402073 CET | 50051 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:51.848881960 CET | 50051 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:51.853704929 CET | 7000 | 50051 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:53.828413963 CET | 7000 | 50051 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:53.828485966 CET | 50051 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:56.939084053 CET | 50051 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:56.941797972 CET | 50052 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:56.943968058 CET | 7000 | 50051 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:56.946614027 CET | 7000 | 50052 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:56.946753979 CET | 50052 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:57.172271967 CET | 50052 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:57.177098989 CET | 7000 | 50052 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:57.329967976 CET | 50052 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:57.334779024 CET | 7000 | 50052 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:57.345784903 CET | 50052 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:57.350613117 CET | 7000 | 50052 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:57.377079964 CET | 50052 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:57.381859064 CET | 7000 | 50052 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:57.392632008 CET | 50052 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:57.397419930 CET | 7000 | 50052 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:57.471155882 CET | 50052 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:57.475939989 CET | 7000 | 50052 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:57.502029896 CET | 50052 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:57.506807089 CET | 7000 | 50052 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:57.533149958 CET | 50052 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:06:57.537885904 CET | 7000 | 50052 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:58.951889992 CET | 7000 | 50052 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:06:58.954866886 CET | 50052 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:07:02.595381021 CET | 50052 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:07:02.597515106 CET | 50053 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:07:02.600193977 CET | 7000 | 50052 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:07:02.602364063 CET | 7000 | 50053 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:07:02.602447987 CET | 50053 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:07:02.633047104 CET | 50053 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:07:02.637893915 CET | 7000 | 50053 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:07:02.704991102 CET | 50053 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:07:02.709789991 CET | 7000 | 50053 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:07:02.767663956 CET | 50053 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:07:02.773781061 CET | 7000 | 50053 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:07:02.986287117 CET | 50053 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:07:02.991173983 CET | 7000 | 50053 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:07:03.080180883 CET | 50053 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:07:03.085108995 CET | 7000 | 50053 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:07:03.111217022 CET | 50053 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:07:03.116053104 CET | 7000 | 50053 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:07:03.142483950 CET | 50053 | 7000 | 192.168.2.4 | 45.207.215.58 |
| Jan 2, 2025 09:07:03.147319078 CET | 7000 | 50053 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:07:04.611331940 CET | 7000 | 50053 | 45.207.215.58 | 192.168.2.4 |
| Jan 2, 2025 09:07:04.611399889 CET | 50053 | 7000 | 192.168.2.4 | 45.207.215.58 |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
| Target ID: | 0 |
| Start time: | 03:02:56 |
| Start date: | 02/01/2025 |
| Path: | C:\Users\user\Desktop\2.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0xf80000 |
| File size: | 1'749'504 bytes |
| MD5 hash: | 119A00350E1A20E1A3EA01153B91001B |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Reputation: | low |
| Has exited: | false |
Execution Graph
| Execution Coverage: | 2.6% |
| Dynamic/Decrypted Code Coverage: | 26.2% |
| Signature Coverage: | 9.8% |
| Total number of Nodes: | 367 |
| Total number of Limit Nodes: | 20 |
Graph
Function 00F96406 Relevance: 103.8, APIs: 48, Strings: 11, Instructions: 557libraryloaderstringCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00F81150 Relevance: 7.6, APIs: 5, Instructions: 52processCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 05154D08 Relevance: 1.5, Strings: 1, Instructions: 281COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 051555D8 Relevance: .3, Instructions: 266COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FE4678 Relevance: 40.7, APIs: 22, Strings: 1, Instructions: 421windowCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00F81400 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 113threadsleepCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00F92271 Relevance: 16.6, APIs: 11, Instructions: 106memoryCOMMONLIBRARYCODE
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Control-flow Graph
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00F81330 Relevance: 6.0, APIs: 4, Instructions: 48processCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FE4A50 Relevance: 4.6, APIs: 3, Instructions: 119COMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00F811F0 Relevance: 4.6, APIs: 3, Instructions: 83sleepCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FB0F76 Relevance: 3.0, APIs: 2, Instructions: 36COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00F8C62F Relevance: 3.0, APIs: 2, Instructions: 24libraryCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00F84788 Relevance: 3.0, APIs: 2, Instructions: 15threadCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 010EF1FC Relevance: 1.7, APIs: 1, Instructions: 180memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 051575E0 Relevance: 1.6, APIs: 1, Instructions: 130COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 051576B0 Relevance: 1.6, APIs: 1, Instructions: 56COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 05156F64 Relevance: 1.6, APIs: 1, Instructions: 55COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00F8ADF3 Relevance: 1.5, APIs: 1, Instructions: 45COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00F81E10 Relevance: 1.5, APIs: 1, Instructions: 29COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00F87AC2 Relevance: 1.5, APIs: 1, Instructions: 27COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00F813C0 Relevance: 1.5, APIs: 1, Instructions: 18memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00F951CB Relevance: 1.5, APIs: 1, Instructions: 17COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 026FD334 Relevance: .1, Instructions: 76COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 026FD32F Relevance: .1, Instructions: 57COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 026FD006 Relevance: .0, Instructions: 45COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 026FD01D Relevance: .0, Instructions: 45COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 01006155 Relevance: 37.1, APIs: 20, Strings: 1, Instructions: 325windowkeyboardCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 010106F0 Relevance: 24.8, APIs: 13, Strings: 1, Instructions: 340COMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FB84D7 Relevance: 21.3, APIs: 14, Instructions: 280keyboardwindowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FB6642 Relevance: 21.3, APIs: 14, Instructions: 268keyboardwindowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FF293E Relevance: 16.7, APIs: 11, Instructions: 220windowkeyboardCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FCC81B Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182comCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00F9C5BA Relevance: 15.7, APIs: 10, Instructions: 664COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0100B18F Relevance: 13.6, APIs: 9, Instructions: 121clipboardwindowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FEE628 Relevance: 9.4, APIs: 6, Instructions: 383COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00F82D4F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73libraryCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00F864ED Relevance: 6.1, APIs: 4, Instructions: 59COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FF4859 Relevance: 3.1, APIs: 2, Instructions: 57windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FE416B Relevance: 51.1, APIs: 28, Strings: 1, Instructions: 323fileCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00F8A93D Relevance: 47.7, APIs: 25, Strings: 2, Instructions: 428windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FE4BE4 Relevance: 37.8, APIs: 25, Instructions: 260COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FB04F5 Relevance: 37.2, APIs: 19, Strings: 2, Instructions: 451windowstringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FE51E4 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 277windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FE117E Relevance: 31.9, APIs: 17, Strings: 1, Instructions: 394windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FFC84F Relevance: 31.9, APIs: 17, Strings: 1, Instructions: 352windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00F8D185 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 191windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FCE9A6 Relevance: 30.1, APIs: 16, Strings: 1, Instructions: 315windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FE083D Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 263windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FE055D Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 237windowCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FD209F Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 230windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FBCECA Relevance: 26.3, APIs: 7, Strings: 8, Instructions: 73libraryloaderCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FACA34 Relevance: 25.0, APIs: 11, Strings: 3, Instructions: 472windowCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00F82E21 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 130libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FA6C3E Relevance: 23.1, APIs: 12, Strings: 1, Instructions: 335windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FAC2E8 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 285windowkeyboardCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FA709A Relevance: 22.7, APIs: 15, Instructions: 232timeCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FDE5FC Relevance: 21.3, APIs: 2, Strings: 10, Instructions: 280windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FE0ED6 Relevance: 19.7, APIs: 13, Instructions: 192COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FAC441 Relevance: 19.6, APIs: 10, Strings: 1, Instructions: 397keyboardwindowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FD454A Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 137windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FDC2B1 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 234windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 010089F7 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 199windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FCE43C Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 163windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00F8A6E9 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 112windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FB33FA Relevance: 16.8, APIs: 11, Instructions: 269COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FA870C Relevance: 16.7, APIs: 11, Instructions: 192timeCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00F86795 Relevance: 16.6, APIs: 11, Instructions: 139COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FFA68D Relevance: 16.6, APIs: 11, Instructions: 120COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00F94707 Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 329windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FE24A4 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 240windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 01044BCD Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 152keyboardCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FFAD07 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 113stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 01003150 Relevance: 15.3, APIs: 10, Instructions: 266COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FB4250 Relevance: 13.7, APIs: 9, Instructions: 242COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 01001325 Relevance: 13.7, APIs: 9, Instructions: 207COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00F92430 Relevance: 13.6, APIs: 9, Instructions: 96memoryCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00F81080 Relevance: 13.6, APIs: 9, Instructions: 80COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FA8E7E Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 364stringwindowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 01008CFD Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 130windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FD2357 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 79windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FD3093 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 64windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FEC6E5 Relevance: 12.2, APIs: 8, Instructions: 167COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0106426C Relevance: 12.1, APIs: 8, Instructions: 134COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00F9CEC7 Relevance: 12.1, APIs: 8, Instructions: 111COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FE329C Relevance: 12.1, APIs: 8, Instructions: 108COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FAB1C0 Relevance: 12.1, APIs: 8, Instructions: 100COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00F9897D Relevance: 12.1, APIs: 8, Instructions: 98COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FCF0A0 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00F86AF3 Relevance: 12.1, APIs: 8, Instructions: 74windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00F94E7A Relevance: 12.1, APIs: 8, Instructions: 64COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00F86DED Relevance: 12.1, APIs: 8, Instructions: 52memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00F96DDA Relevance: 12.0, APIs: 8, Instructions: 39COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 010585BD Relevance: 12.0, APIs: 8, Instructions: 36COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 010024AF Relevance: 10.8, APIs: 7, Instructions: 255COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FF9211 Relevance: 10.8, APIs: 7, Instructions: 251COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 01010D91 Relevance: 10.7, APIs: 7, Instructions: 242COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FB48C5 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 175libraryloaderCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FE503C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 136windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00F981E9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 127stringCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00F9D20D Relevance: 10.6, APIs: 7, Instructions: 126COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00F851C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 106registryCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FA43FF Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 92windowCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FB45E0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 90libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 010188E4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 83stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FFA7DA Relevance: 10.6, APIs: 7, Instructions: 81windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FF2CC7 Relevance: 10.6, APIs: 7, Instructions: 80windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00F849A6 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 78registryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FFEC99 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 78windowCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FB9006 Relevance: 10.6, APIs: 7, Instructions: 78COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FFEC0E Relevance: 10.6, APIs: 7, Instructions: 64windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00F931FF Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloadertimeCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00F8C9CF Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 53libraryloaderCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00F82993 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 53libraryloaderCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00F924D1 Relevance: 10.6, APIs: 7, Instructions: 51memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00F828FB Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 45libraryloaderCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00F96D94 Relevance: 10.5, APIs: 7, Instructions: 30COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FF72C7 Relevance: 9.5, APIs: 6, Instructions: 481COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00F9EF23 Relevance: 9.3, APIs: 6, Instructions: 299COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FA8427 Relevance: 9.2, APIs: 6, Instructions: 246windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FFC2E7 Relevance: 9.2, APIs: 6, Instructions: 222windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 01011315 Relevance: 9.2, APIs: 6, Instructions: 157windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FA09FC Relevance: 9.2, APIs: 6, Instructions: 155windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FCD189 Relevance: 9.1, APIs: 6, Instructions: 144windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 01020085 Relevance: 9.1, APIs: 6, Instructions: 138COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00F865D6 Relevance: 9.1, APIs: 6, Instructions: 138COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FDC943 Relevance: 9.1, APIs: 6, Instructions: 125COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FD6A8F Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 363keyboardCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FEC8D0 Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FA525A Relevance: 9.1, APIs: 6, Instructions: 95windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0101465E Relevance: 9.1, APIs: 6, Instructions: 89windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FFC75B Relevance: 9.1, APIs: 6, Instructions: 89windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FD4B4E Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FA653D Relevance: 9.1, APIs: 6, Instructions: 79timeCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0100A602 Relevance: 9.1, APIs: 6, Instructions: 76windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FE289F Relevance: 9.1, APIs: 6, Instructions: 74memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FB03F6 Relevance: 9.1, APIs: 6, Instructions: 67windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FFED75 Relevance: 9.1, APIs: 6, Instructions: 64windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00F92064 Relevance: 9.1, APIs: 6, Instructions: 52windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FA8AC9 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 294keyboardCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FB4558 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 54libraryloaderCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00F928AB Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FF60D7 Relevance: 7.8, APIs: 5, Instructions: 316COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0100A95D Relevance: 7.8, APIs: 5, Instructions: 272windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FC4C08 Relevance: 7.7, APIs: 5, Instructions: 205COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FAA7FD Relevance: 7.7, APIs: 5, Instructions: 196COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FD0E63 Relevance: 7.7, APIs: 5, Instructions: 169COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0100A36D Relevance: 7.7, APIs: 5, Instructions: 166windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 01070EF4 Relevance: 7.7, APIs: 5, Instructions: 164stringCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FCE63F Relevance: 7.7, APIs: 5, Instructions: 162stringCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 010653D0 Relevance: 7.7, APIs: 5, Instructions: 154COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FF5223 Relevance: 7.6, APIs: 5, Instructions: 135COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FBC9BE Relevance: 7.6, APIs: 5, Instructions: 133COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FC68B6 Relevance: 7.6, APIs: 5, Instructions: 124windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FCA198 Relevance: 7.6, APIs: 5, Instructions: 113windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FA06BC Relevance: 7.6, APIs: 5, Instructions: 108windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 010006EE Relevance: 7.6, APIs: 5, Instructions: 108windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FCA455 Relevance: 7.6, APIs: 5, Instructions: 106COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FA07FA Relevance: 7.6, APIs: 5, Instructions: 99COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FA6639 Relevance: 7.6, APIs: 5, Instructions: 96COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FDA7DF Relevance: 7.6, APIs: 5, Instructions: 96windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 010185E5 Relevance: 7.6, APIs: 5, Instructions: 95COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00F96268 Relevance: 7.6, APIs: 5, Instructions: 92windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 010187E0 Relevance: 7.6, APIs: 5, Instructions: 90windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FECA1C Relevance: 7.6, APIs: 5, Instructions: 89COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FF2BD1 Relevance: 7.6, APIs: 5, Instructions: 87COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00F8CD61 Relevance: 7.6, APIs: 5, Instructions: 81windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FFA343 Relevance: 7.6, APIs: 5, Instructions: 80windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00F8E8F2 Relevance: 7.6, APIs: 5, Instructions: 80windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FB9106 Relevance: 7.6, APIs: 5, Instructions: 76windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FA42DE Relevance: 7.6, APIs: 5, Instructions: 73windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FE027F Relevance: 7.6, APIs: 5, Instructions: 72COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FAE195 Relevance: 7.6, APIs: 5, Instructions: 70windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FF20E8 Relevance: 7.6, APIs: 5, Instructions: 68windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FAE99F Relevance: 7.6, APIs: 5, Instructions: 66windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00F86D39 Relevance: 7.6, APIs: 5, Instructions: 65windowCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 01054DF5 Relevance: 7.6, APIs: 5, Instructions: 64COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 010584B8 Relevance: 7.6, APIs: 5, Instructions: 61COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FC2366 Relevance: 7.6, APIs: 5, Instructions: 56COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FDA3F6 Relevance: 7.6, APIs: 5, Instructions: 55windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FD49E0 Relevance: 7.6, APIs: 5, Instructions: 53COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FE2971 Relevance: 7.6, APIs: 5, Instructions: 51COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 01070B3A Relevance: 7.6, APIs: 5, Instructions: 50COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FDAB5B Relevance: 7.5, APIs: 5, Instructions: 45COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00F92736 Relevance: 7.5, APIs: 5, Instructions: 36COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FB2A55 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72libraryloaderCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00F94F41 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72windowCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00F8F13F Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 010206F4 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 40timewindowCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00F84924 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39libraryloaderCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00F85042 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38libraryloaderCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00F848CB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35libraryloaderCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FD878F Relevance: 6.2, APIs: 4, Instructions: 190windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FA2541 Relevance: 6.2, APIs: 4, Instructions: 183COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 01008EE8 Relevance: 6.2, APIs: 4, Instructions: 177COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FD2C00 Relevance: 6.2, APIs: 4, Instructions: 175COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FF0D9D Relevance: 6.2, APIs: 4, Instructions: 170COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 01018D54 Relevance: 6.2, APIs: 4, Instructions: 162windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 01044F9D Relevance: 6.2, APIs: 4, Instructions: 157COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0105421E Relevance: 6.2, APIs: 4, Instructions: 155windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00F90B66 Relevance: 6.1, APIs: 4, Instructions: 131windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FF4A0D Relevance: 6.1, APIs: 4, Instructions: 129COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FF6C98 Relevance: 6.1, APIs: 4, Instructions: 129COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FD08D3 Relevance: 6.1, APIs: 4, Instructions: 125windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FA4AF8 Relevance: 6.1, APIs: 4, Instructions: 120COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FE8C86 Relevance: 6.1, APIs: 4, Instructions: 115windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FF6684 Relevance: 6.1, APIs: 4, Instructions: 114COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FD4E4B Relevance: 6.1, APIs: 4, Instructions: 111COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FB51A1 Relevance: 6.1, APIs: 4, Instructions: 111COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FCF1D8 Relevance: 6.1, APIs: 4, Instructions: 107COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FD3198 Relevance: 6.1, APIs: 4, Instructions: 101COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FFB14C Relevance: 6.1, APIs: 4, Instructions: 101COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FD6F6B Relevance: 6.1, APIs: 4, Instructions: 100windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0100CE18 Relevance: 6.1, APIs: 4, Instructions: 99COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FDF185 Relevance: 6.1, APIs: 4, Instructions: 93COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0101454A Relevance: 6.1, APIs: 4, Instructions: 91windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0100B37A Relevance: 6.1, APIs: 4, Instructions: 89COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0100CD4D Relevance: 6.1, APIs: 4, Instructions: 77COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FDC17C Relevance: 6.1, APIs: 4, Instructions: 71windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0100659D Relevance: 6.1, APIs: 4, Instructions: 70windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 01078AA3 Relevance: 6.1, APIs: 4, Instructions: 69COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FB2D4E Relevance: 6.1, APIs: 4, Instructions: 61windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FDECEC Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00F8C279 Relevance: 6.1, APIs: 4, Instructions: 57COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FC3284 Relevance: 6.1, APIs: 4, Instructions: 57COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FD046A Relevance: 6.1, APIs: 4, Instructions: 52windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FAE85B Relevance: 6.1, APIs: 4, Instructions: 52fileCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FD3002 Relevance: 6.1, APIs: 4, Instructions: 52COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00F8E777 Relevance: 6.0, APIs: 4, Instructions: 50COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FBC572 Relevance: 6.0, APIs: 4, Instructions: 49COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00F83242 Relevance: 6.0, APIs: 4, Instructions: 49memoryCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00F9D188 Relevance: 6.0, APIs: 4, Instructions: 47COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FD2B82 Relevance: 6.0, APIs: 4, Instructions: 46COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00F91061 Relevance: 6.0, APIs: 4, Instructions: 45COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FBF010 Relevance: 6.0, APIs: 4, Instructions: 40COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FDACC8 Relevance: 6.0, APIs: 4, Instructions: 39COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00F86994 Relevance: 6.0, APIs: 4, Instructions: 38COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00F86900 Relevance: 6.0, APIs: 4, Instructions: 32COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 01064184 Relevance: 6.0, APIs: 4, Instructions: 30COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 01020FF3 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 105timeCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 0100665F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62windowCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FCE880 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47windowCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FD72FD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46memoryCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00FE6A41 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34registryclipboardCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
Function 00F92580 Relevance: 5.1, APIs: 4, Instructions: 61COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Yara matches |
| Similarity |
|