Edit tour
Windows
Analysis Report
Osb7hkGfAb.exe
Overview
General Information
| Sample name: | Osb7hkGfAb.exerenamed because original name is a hash value |
| Original sample name: | ad1dfc910b1815aea7983124549d2c04376db9b2249b99e3e672b91df91bfec6.exe |
| Analysis ID: | 1587621 |
| MD5: | a09950fd9af3c4e3ff6f778ab5d8ce0f |
| SHA1: | 043462f3e5a9b3133908c39e6c3fd8a4f0cade1b |
| SHA256: | ad1dfc910b1815aea7983124549d2c04376db9b2249b99e3e672b91df91bfec6 |
| Tags: | exeuser-adrian__luca |
| Infos: |  |
 | |
Detection
GuLoader
| Score: | 76 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected GuLoader
AI detected suspicious sample
Switches to a custom stack to bypass stack traces
Tries to detect virtualization through RDTSC time measurements
Contains functionality for read data from the clipboard
Contains functionality to dynamically determine API calls
Contains functionality to shutdown / reboot the system
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Drops PE files
Found dropped PE file which has not been started or loaded
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE / OLE file has an invalid certificate
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Classification
- System is w10x64
Osb7hkGfAb.exe (PID: 4464 cmdline:
"C:\Users\ user\Deskt op\Osb7hkG fAb.exe" MD5: A09950FD9AF3C4E3FF6F778AB5D8CE0F) "C:\Users\ user\Deskt op\Osb7hkG fAb.exe" MD5: A09950FD9AF3C4E3FF6F778AB5D8CE0F)
- cleanup
| Name | Description | Attribution | Blogpost URLs | Link |
|---|---|---|---|---|
| CloudEyE, GuLoader | CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored. | No Attribution |
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_GuLoader_2 | Yara detected GuLoader | Joe Security | ||
| JoeSecurity_GuLoader_2 | Yara detected GuLoader | Joe Security |
⊘No Sigma rule has matched
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2025-01-10T16:02:25.047759+0100 | 2803270 | 2 | Potentially Bad Traffic | 192.168.2.10 | 49708 | 142.250.184.238 | 443 | TCP |
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | Avira: | ||
| Source: | ReversingLabs: | |||
| Source: | Virustotal: | Perma Link | ||
| Source: | Integrated Neural Analysis Model: | ||
| Source: | Static PE information: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Code function: | 0_2_0040646B | |
| Source: | Code function: | 0_2_004027A1 | |
| Source: | Code function: | 0_2_004058BF | |
| Source: | JA3 fingerprint: | ||
| Source: | Suricata IDS: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Code function: | 0_2_0040535C | |
| Source: | Code function: | 0_2_00403348 | |
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Code function: | 0_2_00406945 | |
| Source: | Code function: | 0_2_0040711C | |
| Source: | Code function: | 0_2_700E1A98 | |
| Source: | Static PE information: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Static PE information: | ||
| Source: | Classification label: | ||
| Source: | Code function: | 0_2_00403348 | |
| Source: | Code function: | 0_2_0040460D | |
| Source: | Code function: | 0_2_0040216B | |
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | ReversingLabs: | ||
| Source: | Virustotal: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Key value queried: | Jump to behavior | ||
| Source: | LNK file: | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
Data Obfuscation | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | Code function: | 0_2_700E1A98 | |
| Source: | Code function: | 0_2_700E2F8E | |
| Source: | File created: | Jump to dropped file | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
Malware Analysis System Evasion | |
|---|
| Source: | API/Special instruction interceptor: | ||
| Source: | API/Special instruction interceptor: | ||
| Source: | RDTSC instruction interceptor: | ||
| Source: | RDTSC instruction interceptor: | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Last function: | ||
| Source: | Code function: | 0_2_0040646B | |
| Source: | Code function: | 0_2_004027A1 | |
| Source: | Code function: | 0_2_004058BF | |
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | API call chain: | graph_0-3944 | ||
| Source: | API call chain: | graph_0-4120 | ||
| Source: | Code function: | 0_2_700E1A98 | |
| Source: | Process created: | Jump to behavior | ||
| Source: | Code function: | 0_2_00403348 | |
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | 1 Native API | 1 DLL Side-Loading | 1 Access Token Manipulation | 11 Masquerading | OS Credential Dumping | 21 Security Software Discovery | Remote Services | 1 Archive Collected Data | 11 Encrypted Channel | Exfiltration Over Other Network Medium | 1 System Shutdown/Reboot |
| Credentials | Domains | Default Accounts | Scheduled Task/Job | Boot or Logon Initialization Scripts | 11 Process Injection | 1 Virtualization/Sandbox Evasion | LSASS Memory | 1 Virtualization/Sandbox Evasion | Remote Desktop Protocol | 1 Clipboard Data | 3 Ingress Tool Transfer | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | 1 DLL Side-Loading | 1 Access Token Manipulation | Security Account Manager | 2 File and Directory Discovery | SMB/Windows Admin Shares | Data from Network Shared Drive | 3 Non-Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | 11 Process Injection | NTDS | 23 System Information Discovery | Distributed Component Object Model | Input Capture | 14 Application Layer Protocol | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | Network Logon Script | 1 Obfuscated Files or Information | LSA Secrets | Internet Connection Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
| Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | 1 DLL Side-Loading | Cached Domain Credentials | Wi-Fi Discovery | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 75% | ReversingLabs | Win32.Trojan.GuLoader | ||
| 68% | Virustotal | Browse | ||
| 100% | Avira | TR/Injector.ofxme |
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | ReversingLabs |
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| drive.google.com | 142.250.184.238 | true | false | high | |
| drive.usercontent.google.com | 142.250.186.97 | true | false | high |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 142.250.184.238 | drive.google.com | United States | 15169 | GOOGLEUS | false | |
| 142.250.186.97 | drive.usercontent.google.com | United States | 15169 | GOOGLEUS | false |
| Joe Sandbox version: | 42.0.0 Malachite |
| Analysis ID: | 1587621 |
| Start date and time: | 2025-01-10 15:59:56 +01:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 7m 42s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Run name: | Run with higher sleep bypass |
| Number of analysed new started processes analysed: | 9 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | Osb7hkGfAb.exerenamed because original name is a hash value |
| Original Sample Name: | ad1dfc910b1815aea7983124549d2c04376db9b2249b99e3e672b91df91bfec6.exe |
| Detection: | MAL |
| Classification: | mal76.troj.evad.winEXE@3/8@2/2 |
| EGA Information: |
|
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
- Excluded IPs from analysis (whitelisted): 52.149.20.212, 13.107.246.45
- Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
- Not all processes where analyzed, report is missing behavior information
- Report size getting too big, too many NtCreateKey calls found.
- Report size getting too big, too many NtOpenKeyEx calls found.
- Report size getting too big, too many NtQueryValueKey calls found.
⊘No simulations
⊘No context
⊘No context
⊘No context
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 37f463bf4616ecd445d4a1937da06e19 | Get hash | malicious | GuLoader | Browse |
| |
| Get hash | malicious | GuLoader | Browse |
| ||
| Get hash | malicious | GuLoader | Browse |
| ||
| Get hash | malicious | GuLoader | Browse |
| ||
| Get hash | malicious | GuLoader | Browse |
| ||
| Get hash | malicious | GuLoader | Browse |
| ||
| Get hash | malicious | GuLoader | Browse |
| ||
| Get hash | malicious | GuLoader | Browse |
| ||
| Get hash | malicious | CobaltStrike, Metasploit | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| C:\Users\user\AppData\Local\Temp\nsc72B9.tmp\System.dll | Get hash | malicious | GuLoader | Browse | ||
| Get hash | malicious | GuLoader | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | GuLoader | Browse | |||
| Get hash | malicious | GuLoader | Browse | |||
| Get hash | malicious | GuLoader | Browse | |||
| Get hash | malicious | Remcos, GuLoader | Browse | |||
| Get hash | malicious | FormBook, GuLoader | Browse |
| Process: | C:\Users\user\Desktop\Osb7hkGfAb.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 11776 |
| Entropy (8bit): | 5.854450882766351 |
| Encrypted: | false |
| SSDEEP: | 192:jPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4I:u7VpNo8gmOyRsVc4 |
| MD5: | 34442E1E0C2870341DF55E1B7B3CCCDC |
| SHA1: | 99B2FA21AEAD4B6CCD8FF2F6D3D3453A51D9C70C |
| SHA-256: | 269D232712C86983336BADB40B9E55E80052D8389ED095EBF9214964D43B6BB1 |
| SHA-512: | 4A8C57FB12997438B488B862F3FC9DC0F236E07BB47B2BCE6053DCB03AC7AD171842F02AC749F02DDA4719C681D186330524CD2953D33CB50854844E74B33D51 |
| Malicious: | false |
| Antivirus: |
|
| Joe Sandbox View: |
|
| Reputation: | moderate, very likely benign file |
| Preview: |
| Process: | C:\Users\user\Desktop\Osb7hkGfAb.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 210620 |
| Entropy (8bit): | 7.5479608224177 |
| Encrypted: | false |
| SSDEEP: | 3072:TxsXh+JF13htt8PqX5tMt86Z3XfXA2QqtG0i3xDW4+E/lXSIjfOxVaXm2:TKXS1x70vXbDGNMGxScOHa1 |
| MD5: | 87B5C774E173976A2E28F1BA83D0AF19 |
| SHA1: | 84F517D61D4108AF7970FD480EF38F84C69508DD |
| SHA-256: | D3ADC7A77CF3BED6B58380322BE620D613085797830847ACEF8BAC9B88E14F7A |
| SHA-512: | D3AAFC404CF4F24AC2A75B0EFB3F815D7B53A3B96132122B490531B488BF04FF4AE5444744FDE22C14B8DCD943AA82AE77350A0247D705C08485D7A1C26AB5F7 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Users\user\Desktop\Osb7hkGfAb.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 441234 |
| Entropy (8bit): | 2.643055597561025 |
| Encrypted: | false |
| SSDEEP: | 1536:QZmWsnh5l4WzxPFhMOzNJoDb8glX1rYrkbN39D8e7A7Sg2gGqAXr2bHLopKRJ8No:ot0r3reuPrpL/7zB7nMWi0FThhJtG4 |
| MD5: | B3702DCDA1481DA4539338C0B2D6E4EB |
| SHA1: | 40A2001A107BE6C3D4587D8E5FF5FAEFA6C61A1B |
| SHA-256: | F2F2395066AB9072911FC0D46DAA8DFB2C7AEFB30BE7DAB9B7BBDC7583B9A94F |
| SHA-512: | AAB912267A32EA594A37BFB57F002AB8340C2CD94C2EB21E37ECE375F899D01207C48E8BF9429FB7CC302E5F17D8F8DF17EA208450D26F416A0372D2BCA245AE |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Users\user\Desktop\Osb7hkGfAb.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 485127 |
| Entropy (8bit): | 1.2565961974341746 |
| Encrypted: | false |
| SSDEEP: | 768:bgBMgq+aLnwfPnz/Km1iLGyDPiU55NCk+T93YpnK77oTpvYP3knePjlW0kwNGL+q:XQ3wvosOsCpxFJrXSBmHzTu58UR |
| MD5: | 580D05E679E74B036B55CA8E5FF32769 |
| SHA1: | 10175C43AB7B725FFFCF770EB2C3555E91D3BA13 |
| SHA-256: | B3E34975017C193D4672BEC42BC52B55F8AE1F1D5F30D56DCFD0B3A4242C3BE4 |
| SHA-512: | 0E26F0084BED372785A5E8C8BE3A0717074AA52C2E8B5413FA9F2CB8DEED40BF8BDBF15C411EFFA432A8B96E50AE6085E8F90A97350827AFAA1BE1AB4B3E1643 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\Osb7hkGfAb.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 389868 |
| Entropy (8bit): | 1.2469892412772452 |
| Encrypted: | false |
| SSDEEP: | 768:8mGX5iY6YFC1hSNYG8n6aCKBHwcX7e3ZNrt7qNIxKpGEopKfWOO72cDEDQ+7IF5i:m5ittaAwW6q8KH13QyOgs2w |
| MD5: | 2A500E1219C4894E2D45C32C5A5A11FD |
| SHA1: | AC9A88DE4C84E1EB8A535E1061CBC6584380D24E |
| SHA-256: | C65F223375C6DFE8CE71213D5DD24F39CDE31F772D2C66521BF07B21BE45E6C1 |
| SHA-512: | 89ED91AF91CF969FE7EC087EE107B52959582615EFB2AB72A21D6C3820E5BDDA78EE02EB39BB323FD996D85510627387616DF8917B12052A62D288D8E9448596 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\Osb7hkGfAb.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 442363 |
| Entropy (8bit): | 1.2533707838755617 |
| Encrypted: | false |
| SSDEEP: | 1536:f6KFImN7hPg1fMcZ9pkK6m1rmkrDAji7VW9EgfrY:PyMtabPE+7ctfM |
| MD5: | 5465B75724C031B21C018F7D72941F72 |
| SHA1: | 98176B27A41A35401A96D0AAC0859EEC25A4C5FE |
| SHA-256: | 7390780C6FB1F7B57C950A11AE287127CB6144CE9AD1C26E8C242BADB685729B |
| SHA-512: | 7084191B13FF854943DEE9FB6DDC1D7F89D06055FF4DA7E04DA1C359B557AC22762209B8DFE061F3AF628DF077E1D1D1009E9F9A18E3C9441AEE7FD4FDFF1688 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\Osb7hkGfAb.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 521 |
| Entropy (8bit): | 4.284169749449499 |
| Encrypted: | false |
| SSDEEP: | 12:7+SriF8i+WUQDJBYqRIE47W0BvM71ARi9ulhji4JDQCr6K:7tuZ+d6/GEUI18jhJsCr6K |
| MD5: | B089BD0CBC944DE0B1023E6CE9318BD3 |
| SHA1: | 715FA74E243D5C3419519E7371ED1836C9BCFA4A |
| SHA-256: | 1E8ABB4A5E85595B0EF2FC73E9012EDDFE1BCB7363E90A2EA46F561DD3742F93 |
| SHA-512: | A164EB2AB02E612E9F96531006C4A71B8D6E8EA6444D86907CB15EF2C1AAB4680EAF3BB580C6A1D5B89A3F454F3E532242FC1DE2B71A9FFF56F812F6E4638885 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\Osb7hkGfAb.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 720 |
| Entropy (8bit): | 3.2583835496355245 |
| Encrypted: | false |
| SSDEEP: | 12:8wl0bsXyllEzKYGlnEEkvEEv3w/g/iCNJkKAP4t2YZ/elFlSJm:8s2CzKJvs+/4i2HAFqy |
| MD5: | 1DD416959B3A61611C699B9C51E589D0 |
| SHA1: | 6C955BC97130A942608C2525257E2E877CFBFAF9 |
| SHA-256: | FB67473E5157A26E60B1C53C81948DEDCBBAEC23B68E2B17CD335A7830FD963F |
| SHA-512: | 3DD9311979FA9471D46B0FFA8D81B5191BBE753ED0115484E11FB0C812B313C6CF87109D567BB4AA7DDBC52F9F453308C910394D831C6A6FA2127A56A96FDFFA |
| Malicious: | false |
| Preview: |
| File type: | |
| Entropy (8bit): | 7.544810246742741 |
| TrID: |
|
| File name: | Osb7hkGfAb.exe |
| File size: | 887'424 bytes |
| MD5: | a09950fd9af3c4e3ff6f778ab5d8ce0f |
| SHA1: | 043462f3e5a9b3133908c39e6c3fd8a4f0cade1b |
| SHA256: | ad1dfc910b1815aea7983124549d2c04376db9b2249b99e3e672b91df91bfec6 |
| SHA512: | 316f36143bfb519a3fd27766960f8c758867da2df52463b7373431c2788811c11823c06fe4934e990102c9c2039feb010a501ddaa99274973dd0024f192fa3c2 |
| SSDEEP: | 24576:QiGFaq43NvC0vEFsNtiqnRCujTrlLq9u4J/QOeaa:QiGFu3NvnEFsNtRdu9u4J/qaa |
| TLSH: | DC15122AF700D9AAD4708F718D9ED256EBD07E2828200BAB7F997B4BBD72051D01F255 |
| File Content Preview: | MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1)..PG..PG..PG.*_...PG..PF.IPG.*_...PG..sw..PG..VA..PG.Rich.PG.........PE..L... ..`.................f...|......H3............@ |
 | |
| Icon Hash: | 0e13672535353f1c |
| Entrypoint: | 0x403348 |
| Entrypoint Section: | .text |
| Digitally signed: | true |
| Imagebase: | 0x400000 |
| Subsystem: | windows gui |
| Image File Characteristics: | RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE |
| DLL Characteristics: | DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x60FC9220 [Sat Jul 24 22:20:16 2021 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 4 |
| OS Version Minor: | 0 |
| File Version Major: | 4 |
| File Version Minor: | 0 |
| Subsystem Version Major: | 4 |
| Subsystem Version Minor: | 0 |
| Import Hash: | ced282d9b261d1462772017fe2f6972b |
| Signature Valid: | false |
| Signature Issuer: | CN="Customhouses Bagdres Landsale ", E=Vincula@algorithms.Tum, L=Montrose, S=Colorado, C=US |
| Signature Validation Error: | A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider |
| Error Number: | -2146762487 |
| Not Before, Not After |
|
| Subject Chain |
|
| Version: | 3 |
| Thumbprint MD5: | 6E7AA7D21C7430FFA93D1D5E81C70DD6 |
| Thumbprint SHA-1: | 5E5C2F65106F0C48F10C0B17A665BA4A7F3796B1 |
| Thumbprint SHA-256: | 9FC97C7BD25A0D8FFAED412DBDA9127DE53CBC6E6B4395C7D8146B5291551423 |
| Serial: | 29E0A557697DB56E97230C2F058F9E9DD1580106 |
| Instruction |
|---|
| sub esp, 00000184h |
| push ebx |
| push esi |
| push edi |
| xor ebx, ebx |
| push 00008001h |
| mov dword ptr [esp+18h], ebx |
| mov dword ptr [esp+10h], 0040A198h |
| mov dword ptr [esp+20h], ebx |
| mov byte ptr [esp+14h], 00000020h |
| call dword ptr [004080B8h] |
| call dword ptr [004080BCh] |
| and eax, BFFFFFFFh |
| cmp ax, 00000006h |
| mov dword ptr [0042F42Ch], eax |
| je 00007FD5A0B98363h |
| push ebx |
| call 00007FD5A0B9B4C6h |
| cmp eax, ebx |
| je 00007FD5A0B98359h |
| push 00000C00h |
| call eax |
| mov esi, 004082A0h |
| push esi |
| call 00007FD5A0B9B442h |
| push esi |
| call dword ptr [004080CCh] |
| lea esi, dword ptr [esi+eax+01h] |
| cmp byte ptr [esi], bl |
| jne 00007FD5A0B9833Dh |
| push 0000000Bh |
| call 00007FD5A0B9B49Ah |
| push 00000009h |
| call 00007FD5A0B9B493h |
| push 00000007h |
| mov dword ptr [0042F424h], eax |
| call 00007FD5A0B9B487h |
| cmp eax, ebx |
| je 00007FD5A0B98361h |
| push 0000001Eh |
| call eax |
| test eax, eax |
| je 00007FD5A0B98359h |
| or byte ptr [0042F42Fh], 00000040h |
| push ebp |
| call dword ptr [00408038h] |
| push ebx |
| call dword ptr [00408288h] |
| mov dword ptr [0042F4F8h], eax |
| push ebx |
| lea eax, dword ptr [esp+38h] |
| push 00000160h |
| push eax |
| push ebx |
| push 00429850h |
| call dword ptr [0040816Ch] |
| push 0040A188h |
| Programming Language: |
|
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0x8544 | 0xa0 | .rdata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x58000 | 0x41dd0 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0xd7720 | 0x1360 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x8000 | 0x29c | .rdata |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x6457 | 0x6600 | f6e38befa56abea7a550141c731da779 | False | 0.6682368259803921 | data | 6.434985703212657 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .rdata | 0x8000 | 0x1380 | 0x1400 | 569269e9338b2e8ce268ead1326e2b0b | False | 0.4625 | data | 5.2610038973135005 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .data | 0xa000 | 0x25538 | 0x600 | 17edd496e40111b5a48947c480fda13c | False | 0.4635416666666667 | data | 4.133728555004788 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .ndata | 0x30000 | 0x28000 | 0x0 | d41d8cd98f00b204e9800998ecf8427e | False | 0 | empty | 0.0 | IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .rsrc | 0x58000 | 0x41dd0 | 0x41e00 | 51f103b856396aac282c5bd5a24beff1 | False | 0.6063619248102466 | data | 5.8960782160116745 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| RT_ICON | 0x583b8 | 0x130ca | PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced | English | United States | 0.998410786148207 |
| RT_ICON | 0x6b488 | 0x10828 | Device independent bitmap graphic, 128 x 256 x 32, image size 67584 | English | United States | 0.40775464332189754 |
| RT_ICON | 0x7bcb0 | 0x94a8 | Device independent bitmap graphic, 96 x 192 x 32, image size 38016 | English | United States | 0.4554866512507883 |
| RT_ICON | 0x85158 | 0x67e8 | Device independent bitmap graphic, 80 x 160 x 32, image size 26560 | English | United States | 0.462218045112782 |
| RT_ICON | 0x8b940 | 0x5488 | Device independent bitmap graphic, 72 x 144 x 32, image size 21600 | English | United States | 0.4729667282809612 |
| RT_ICON | 0x90dc8 | 0x4228 | Device independent bitmap graphic, 64 x 128 x 32, image size 16896 | English | United States | 0.46835144071799717 |
| RT_ICON | 0x94ff0 | 0x25a8 | Device independent bitmap graphic, 48 x 96 x 32, image size 9600 | English | United States | 0.5149377593360995 |
| RT_ICON | 0x97598 | 0x10a8 | Device independent bitmap graphic, 32 x 64 x 32, image size 4224 | English | United States | 0.5457317073170732 |
| RT_ICON | 0x98640 | 0x988 | Device independent bitmap graphic, 24 x 48 x 32, image size 2400 | English | United States | 0.6073770491803279 |
| RT_ICON | 0x98fc8 | 0x468 | Device independent bitmap graphic, 16 x 32 x 32, image size 1088 | English | United States | 0.6719858156028369 |
| RT_DIALOG | 0x99430 | 0x100 | data | English | United States | 0.5234375 |
| RT_DIALOG | 0x99530 | 0x11c | data | English | United States | 0.6056338028169014 |
| RT_DIALOG | 0x99650 | 0xc4 | data | English | United States | 0.5918367346938775 |
| RT_DIALOG | 0x99718 | 0x60 | data | English | United States | 0.7291666666666666 |
| RT_GROUP_ICON | 0x99778 | 0x92 | Targa image data - Map 32 x 12490 x 1 +1 | English | United States | 0.7191780821917808 |
| RT_VERSION | 0x99810 | 0x27c | data | English | United States | 0.5 |
| RT_MANIFEST | 0x99a90 | 0x33e | XML 1.0 document, ASCII text, with very long lines (830), with no line terminators | English | United States | 0.5542168674698795 |
| DLL | Import |
|---|---|
| ADVAPI32.dll | RegCreateKeyExA, RegEnumKeyA, RegQueryValueExA, RegSetValueExA, RegCloseKey, RegDeleteValueA, RegDeleteKeyA, AdjustTokenPrivileges, LookupPrivilegeValueA, OpenProcessToken, SetFileSecurityA, RegOpenKeyExA, RegEnumValueA |
| SHELL32.dll | SHGetFileInfoA, SHFileOperationA, SHGetPathFromIDListA, ShellExecuteExA, SHGetSpecialFolderLocation, SHBrowseForFolderA |
| ole32.dll | IIDFromString, OleInitialize, OleUninitialize, CoCreateInstance, CoTaskMemFree |
| COMCTL32.dll | ImageList_Create, ImageList_Destroy, ImageList_AddMasked |
| USER32.dll | SetClipboardData, CharPrevA, CallWindowProcA, PeekMessageA, DispatchMessageA, MessageBoxIndirectA, GetDlgItemTextA, SetDlgItemTextA, GetSystemMetrics, CreatePopupMenu, AppendMenuA, TrackPopupMenu, FillRect, EmptyClipboard, LoadCursorA, GetMessagePos, CheckDlgButton, GetSysColor, SetCursor, GetWindowLongA, SetClassLongA, SetWindowPos, IsWindowEnabled, GetWindowRect, GetSystemMenu, EnableMenuItem, RegisterClassA, ScreenToClient, EndDialog, GetClassInfoA, SystemParametersInfoA, CreateWindowExA, ExitWindowsEx, DialogBoxParamA, CharNextA, SetTimer, DestroyWindow, CreateDialogParamA, SetForegroundWindow, SetWindowTextA, PostQuitMessage, SendMessageTimeoutA, ShowWindow, wsprintfA, GetDlgItem, FindWindowExA, IsWindow, GetDC, SetWindowLongA, LoadImageA, InvalidateRect, ReleaseDC, EnableWindow, BeginPaint, SendMessageA, DefWindowProcA, DrawTextA, GetClientRect, EndPaint, IsWindowVisible, CloseClipboard, OpenClipboard |
| GDI32.dll | SetBkMode, SetBkColor, GetDeviceCaps, CreateFontIndirectA, CreateBrushIndirect, DeleteObject, SetTextColor, SelectObject |
| KERNEL32.dll | GetExitCodeProcess, WaitForSingleObject, GetProcAddress, GetSystemDirectoryA, WideCharToMultiByte, MoveFileExA, ReadFile, GetTempFileNameA, WriteFile, RemoveDirectoryA, CreateProcessA, CreateFileA, GetLastError, CreateThread, CreateDirectoryA, GlobalUnlock, GetDiskFreeSpaceA, GlobalLock, SetErrorMode, GetVersion, lstrcpynA, GetCommandLineA, GetTempPathA, lstrlenA, SetEnvironmentVariableA, ExitProcess, GetWindowsDirectoryA, GetCurrentProcess, GetModuleFileNameA, CopyFileA, GetTickCount, Sleep, GetFileSize, GetFileAttributesA, SetCurrentDirectoryA, SetFileAttributesA, GetFullPathNameA, GetShortPathNameA, MoveFileA, CompareFileTime, SetFileTime, SearchPathA, lstrcmpiA, lstrcmpA, CloseHandle, GlobalFree, GlobalAlloc, ExpandEnvironmentStringsA, LoadLibraryExA, FreeLibrary, lstrcpyA, lstrcatA, FindClose, MultiByteToWideChar, WritePrivateProfileStringA, GetPrivateProfileStringA, SetFilePointer, GetModuleHandleA, FindNextFileA, FindFirstFileA, DeleteFileA, MulDiv |
| Language of compilation system | Country where language is spoken | Map |
|---|---|---|
| English | United States |  |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | SID | Signature | Severity | Source IP | Source Port | Dest IP | Dest Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2025-01-10T16:02:25.047759+0100 | 2803270 | ETPRO MALWARE Common Downloader Header Pattern UHCa | 2 | 192.168.2.10 | 49708 | 142.250.184.238 | 443 | TCP |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Jan 10, 2025 16:02:23.761857986 CET | 49708 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:02:23.761888981 CET | 443 | 49708 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:02:23.762059927 CET | 49708 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:02:23.885025978 CET | 49708 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:02:23.885042906 CET | 443 | 49708 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:02:24.530599117 CET | 443 | 49708 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:02:24.530736923 CET | 49708 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:02:24.531414986 CET | 443 | 49708 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:02:24.531481028 CET | 49708 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:02:24.704308033 CET | 49708 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:02:24.704332113 CET | 443 | 49708 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:02:24.704668999 CET | 443 | 49708 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:02:24.705135107 CET | 49708 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:02:24.732578039 CET | 49708 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:02:24.779323101 CET | 443 | 49708 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:02:25.047743082 CET | 443 | 49708 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:02:25.048029900 CET | 49708 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:02:25.048047066 CET | 443 | 49708 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:02:25.048201084 CET | 49708 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:02:25.048201084 CET | 49708 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:02:25.048248053 CET | 443 | 49708 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:02:25.048413992 CET | 443 | 49708 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:02:25.048506975 CET | 49708 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:02:25.048507929 CET | 49708 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:02:25.074887991 CET | 49710 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:02:25.074927092 CET | 443 | 49710 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:02:25.075213909 CET | 49710 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:02:25.075541973 CET | 49710 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:02:25.075551987 CET | 443 | 49710 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:02:25.705897093 CET | 443 | 49710 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:02:25.706192970 CET | 49710 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:02:25.710899115 CET | 49710 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:02:25.710906982 CET | 443 | 49710 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:02:25.711226940 CET | 443 | 49710 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:02:25.711642027 CET | 49710 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:02:25.711781025 CET | 49710 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:02:25.755330086 CET | 443 | 49710 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:02:26.113558054 CET | 443 | 49710 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:02:26.113622904 CET | 443 | 49710 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:02:26.113683939 CET | 443 | 49710 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:02:26.113682985 CET | 49710 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:02:26.113682985 CET | 49710 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:02:26.113749027 CET | 49710 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:02:26.169022083 CET | 49710 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:02:26.169050932 CET | 443 | 49710 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:02:36.199043989 CET | 49780 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:02:36.199093103 CET | 443 | 49780 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:02:36.199202061 CET | 49780 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:02:36.199436903 CET | 49780 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:02:36.199450970 CET | 443 | 49780 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:02:36.853045940 CET | 443 | 49780 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:02:36.853132963 CET | 49780 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:02:36.853825092 CET | 443 | 49780 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:02:36.853893995 CET | 49780 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:02:36.855505943 CET | 49780 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:02:36.855519056 CET | 443 | 49780 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:02:36.855767012 CET | 443 | 49780 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:02:36.855833054 CET | 49780 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:02:36.856147051 CET | 49780 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:02:36.899326086 CET | 443 | 49780 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:02:37.344922066 CET | 443 | 49780 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:02:37.345063925 CET | 49780 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:02:37.346051931 CET | 443 | 49780 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:02:37.346107006 CET | 443 | 49780 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:02:37.346120119 CET | 49780 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:02:37.346153975 CET | 49780 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:02:37.346436977 CET | 49780 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:02:37.346457005 CET | 443 | 49780 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:02:37.346472025 CET | 49780 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:02:37.346507072 CET | 49780 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:02:37.414457083 CET | 49787 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:02:37.414510965 CET | 443 | 49787 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:02:37.414601088 CET | 49787 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:02:37.414880991 CET | 49787 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:02:37.414891005 CET | 443 | 49787 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:02:38.051625967 CET | 443 | 49787 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:02:38.051733017 CET | 49787 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:02:38.091120005 CET | 49787 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:02:38.091140985 CET | 443 | 49787 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:02:38.095698118 CET | 49787 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:02:38.095704079 CET | 443 | 49787 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:02:38.471332073 CET | 443 | 49787 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:02:38.471379995 CET | 443 | 49787 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:02:38.471419096 CET | 49787 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:02:38.471441031 CET | 443 | 49787 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:02:38.471452951 CET | 443 | 49787 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:02:38.471456051 CET | 49787 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:02:38.471488953 CET | 49787 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:02:38.472024918 CET | 49787 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:02:38.472038031 CET | 443 | 49787 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:02:48.495605946 CET | 49856 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:02:48.495712042 CET | 443 | 49856 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:02:48.495930910 CET | 49856 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:02:48.496135950 CET | 49856 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:02:48.496184111 CET | 443 | 49856 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:02:49.152767897 CET | 443 | 49856 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:02:49.152909994 CET | 49856 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:02:49.153419971 CET | 49856 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:02:49.153430939 CET | 443 | 49856 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:02:49.153598070 CET | 49856 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:02:49.153604031 CET | 443 | 49856 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:02:49.635363102 CET | 443 | 49856 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:02:49.635473967 CET | 49856 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:02:49.635509014 CET | 443 | 49856 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:02:49.635533094 CET | 443 | 49856 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:02:49.635564089 CET | 49856 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:02:49.635595083 CET | 49856 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:02:49.635703087 CET | 49856 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:02:49.635723114 CET | 443 | 49856 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:02:49.635745049 CET | 49856 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:02:49.635768890 CET | 49856 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:02:49.644726038 CET | 49866 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:02:49.644767046 CET | 443 | 49866 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:02:49.644881010 CET | 49866 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:02:49.645052910 CET | 49866 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:02:49.645072937 CET | 443 | 49866 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:02:50.273226976 CET | 443 | 49866 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:02:50.273291111 CET | 49866 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:02:50.273746967 CET | 49866 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:02:50.273761988 CET | 443 | 49866 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:02:50.273994923 CET | 49866 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:02:50.274007082 CET | 443 | 49866 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:02:50.751805067 CET | 443 | 49866 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:02:50.751872063 CET | 443 | 49866 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:02:50.751887083 CET | 49866 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:02:50.751897097 CET | 443 | 49866 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:02:50.751919031 CET | 49866 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:02:50.751945972 CET | 443 | 49866 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:02:50.751962900 CET | 49866 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:02:50.752002001 CET | 49866 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:02:50.754822016 CET | 49866 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:02:50.754837036 CET | 443 | 49866 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:03:00.777019024 CET | 49933 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:03:00.777051926 CET | 443 | 49933 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:03:00.777225971 CET | 49933 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:03:00.777648926 CET | 49933 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:03:00.777663946 CET | 443 | 49933 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:03:01.409368992 CET | 443 | 49933 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:03:01.409519911 CET | 49933 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:03:01.410052061 CET | 49933 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:03:01.410062075 CET | 443 | 49933 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:03:01.410130024 CET | 49933 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:03:01.410135984 CET | 443 | 49933 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:03:01.800108910 CET | 443 | 49933 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:03:01.800410032 CET | 49933 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:03:01.800410032 CET | 49933 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:03:01.800455093 CET | 443 | 49933 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:03:01.800612926 CET | 443 | 49933 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:03:01.800662041 CET | 49933 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:03:01.800662041 CET | 49933 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:03:01.818093061 CET | 49941 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:03:01.818157911 CET | 443 | 49941 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:03:01.818259954 CET | 49941 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:03:01.818542004 CET | 49941 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:03:01.818562984 CET | 443 | 49941 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:03:02.472721100 CET | 443 | 49941 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:03:02.472904921 CET | 49941 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:03:02.473412037 CET | 49941 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:03:02.473438025 CET | 443 | 49941 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:03:02.473575115 CET | 49941 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:03:02.473588943 CET | 443 | 49941 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:03:02.889415979 CET | 443 | 49941 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:03:02.889506102 CET | 49941 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:03:02.889516115 CET | 443 | 49941 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:03:02.889532089 CET | 443 | 49941 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:03:02.889580011 CET | 443 | 49941 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:03:02.889586926 CET | 49941 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:03:02.889619112 CET | 49941 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:03:02.892173052 CET | 49941 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:03:02.892189980 CET | 443 | 49941 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:03:12.933109999 CET | 49981 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:03:12.933167934 CET | 443 | 49981 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:03:12.933254957 CET | 49981 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:03:12.933594942 CET | 49981 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:03:12.933604956 CET | 443 | 49981 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:03:13.602880955 CET | 443 | 49981 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:03:13.603127003 CET | 49981 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:03:13.603976011 CET | 443 | 49981 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:03:13.604047060 CET | 49981 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:03:13.605720997 CET | 49981 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:03:13.605734110 CET | 443 | 49981 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:03:13.606080055 CET | 443 | 49981 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:03:13.606136084 CET | 49981 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:03:13.606533051 CET | 49981 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:03:13.651325941 CET | 443 | 49981 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:03:13.998424053 CET | 443 | 49981 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:03:13.998493910 CET | 49981 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:03:13.998733044 CET | 443 | 49981 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:03:13.998796940 CET | 443 | 49981 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:03:13.998819113 CET | 49981 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:03:13.998837948 CET | 49981 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:03:13.999001026 CET | 49981 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:03:13.999001026 CET | 49981 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:03:13.999022961 CET | 443 | 49981 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:03:13.999160051 CET | 49981 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:03:14.007627964 CET | 49982 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:03:14.007678032 CET | 443 | 49982 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:03:14.007749081 CET | 49982 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:03:14.008101940 CET | 49982 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:03:14.008126020 CET | 443 | 49982 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:03:14.656549931 CET | 443 | 49982 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:03:14.656636000 CET | 49982 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:03:14.661947966 CET | 49982 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:03:14.661963940 CET | 443 | 49982 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:03:14.662148952 CET | 49982 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:03:14.662153006 CET | 443 | 49982 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:03:15.080645084 CET | 443 | 49982 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:03:15.080703974 CET | 443 | 49982 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:03:15.080734968 CET | 49982 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:03:15.080750942 CET | 443 | 49982 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:03:15.080759048 CET | 49982 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:03:15.080791950 CET | 49982 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:03:15.081510067 CET | 49982 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:03:15.081543922 CET | 443 | 49982 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:03:15.081605911 CET | 49982 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:03:25.105837107 CET | 49983 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:03:25.105884075 CET | 443 | 49983 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:03:25.105957985 CET | 49983 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:03:25.106316090 CET | 49983 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:03:25.106333017 CET | 443 | 49983 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:03:25.756721973 CET | 443 | 49983 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:03:25.756869078 CET | 49983 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:03:25.757426977 CET | 49983 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:03:25.757440090 CET | 443 | 49983 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:03:25.757635117 CET | 49983 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:03:25.757642031 CET | 443 | 49983 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:03:26.160593033 CET | 443 | 49983 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:03:26.160664082 CET | 49983 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:03:26.160692930 CET | 443 | 49983 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:03:26.160733938 CET | 49983 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:03:26.160835028 CET | 49983 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:03:26.160875082 CET | 443 | 49983 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:03:26.160921097 CET | 49983 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:03:26.177356958 CET | 49984 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:03:26.177387953 CET | 443 | 49984 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:03:26.177637100 CET | 49984 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:03:26.177723885 CET | 49984 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:03:26.177741051 CET | 443 | 49984 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:03:26.837132931 CET | 443 | 49984 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:03:26.837497950 CET | 49984 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:03:26.839214087 CET | 49984 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:03:26.839222908 CET | 443 | 49984 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:03:26.839531898 CET | 443 | 49984 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:03:26.839624882 CET | 49984 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:03:26.839939117 CET | 49984 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:03:26.883327961 CET | 443 | 49984 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:03:27.293531895 CET | 443 | 49984 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:03:27.293607950 CET | 443 | 49984 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:03:27.293689966 CET | 443 | 49984 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:03:27.293730974 CET | 49984 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:03:27.293730974 CET | 49984 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:03:27.293730974 CET | 49984 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:03:27.299340963 CET | 49984 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:03:27.299365044 CET | 443 | 49984 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:03:37.323337078 CET | 49985 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:03:37.323362112 CET | 443 | 49985 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:03:37.323455095 CET | 49985 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:03:37.323765993 CET | 49985 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:03:37.323772907 CET | 443 | 49985 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:03:37.952819109 CET | 443 | 49985 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:03:37.952980042 CET | 49985 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:03:37.953627110 CET | 443 | 49985 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:03:37.953696012 CET | 49985 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:03:37.955790997 CET | 49985 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:03:37.955796957 CET | 443 | 49985 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:03:37.956068039 CET | 443 | 49985 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:03:37.956118107 CET | 49985 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:03:37.956423998 CET | 49985 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:03:37.999320984 CET | 443 | 49985 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:03:38.344026089 CET | 443 | 49985 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:03:38.344412088 CET | 49985 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:03:38.344423056 CET | 443 | 49985 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:03:38.344486952 CET | 49985 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:03:38.344527006 CET | 443 | 49985 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:03:38.344531059 CET | 49985 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:03:38.344583988 CET | 443 | 49985 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:03:38.344707012 CET | 49985 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:03:38.344707012 CET | 49985 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:03:38.357512951 CET | 49986 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:03:38.357557058 CET | 443 | 49986 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:03:38.357878923 CET | 49986 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:03:38.357878923 CET | 49986 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:03:38.357909918 CET | 443 | 49986 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:03:39.049685955 CET | 443 | 49986 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:03:39.049746990 CET | 49986 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:03:39.050208092 CET | 49986 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:03:39.050223112 CET | 443 | 49986 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:03:39.050380945 CET | 49986 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:03:39.050385952 CET | 443 | 49986 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:03:39.485647917 CET | 443 | 49986 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:03:39.485699892 CET | 443 | 49986 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:03:39.485712051 CET | 49986 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:03:39.485727072 CET | 443 | 49986 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:03:39.485749960 CET | 49986 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:03:39.485801935 CET | 49986 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:03:39.486293077 CET | 49986 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:03:39.486335993 CET | 443 | 49986 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:03:39.486387014 CET | 49986 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:03:49.518327951 CET | 49987 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:03:49.518371105 CET | 443 | 49987 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:03:49.519330025 CET | 49987 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:03:49.522780895 CET | 49987 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:03:49.522792101 CET | 443 | 49987 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:03:50.152215958 CET | 443 | 49987 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:03:50.152355909 CET | 49987 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:03:50.152983904 CET | 49987 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:03:50.152988911 CET | 443 | 49987 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:03:50.153230906 CET | 49987 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:03:50.153234959 CET | 443 | 49987 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:03:50.542787075 CET | 443 | 49987 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:03:50.542892933 CET | 49987 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:03:50.542905092 CET | 443 | 49987 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:03:50.543190956 CET | 49987 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:03:50.543190956 CET | 49987 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:03:50.543199062 CET | 443 | 49987 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:03:50.543227911 CET | 443 | 49987 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:03:50.543306112 CET | 49987 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:03:50.543306112 CET | 49987 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:03:50.552361965 CET | 49988 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:03:50.552390099 CET | 443 | 49988 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:03:50.552557945 CET | 49988 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:03:50.553468943 CET | 49988 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:03:50.553486109 CET | 443 | 49988 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:03:51.238729954 CET | 443 | 49988 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:03:51.238965034 CET | 49988 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:03:51.240927935 CET | 49988 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:03:51.240935087 CET | 443 | 49988 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:03:51.241168022 CET | 443 | 49988 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:03:51.241260052 CET | 49988 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:03:51.241646051 CET | 49988 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:03:51.283324957 CET | 443 | 49988 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:03:51.653275013 CET | 443 | 49988 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:03:51.653331995 CET | 443 | 49988 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:03:51.653393984 CET | 443 | 49988 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:03:51.653417110 CET | 49988 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:03:51.653444052 CET | 49988 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:03:51.654360056 CET | 49988 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:03:51.654376984 CET | 443 | 49988 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:04:01.682600975 CET | 49989 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:04:01.682657003 CET | 443 | 49989 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:04:01.682724953 CET | 49989 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:04:01.683113098 CET | 49989 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:04:01.683135033 CET | 443 | 49989 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:04:02.409703016 CET | 443 | 49989 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:04:02.410018921 CET | 49989 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:04:02.411062002 CET | 49989 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:04:02.411072969 CET | 443 | 49989 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:04:02.411360979 CET | 49989 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:04:02.411372900 CET | 443 | 49989 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:04:02.797755003 CET | 443 | 49989 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:04:02.797887087 CET | 49989 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:04:02.798336029 CET | 49989 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:04:02.798393965 CET | 443 | 49989 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:04:02.798578978 CET | 443 | 49989 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:04:02.799340963 CET | 49989 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:04:02.799340963 CET | 49989 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:04:02.813172102 CET | 49990 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:04:02.813220024 CET | 443 | 49990 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:04:02.813298941 CET | 49990 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:04:02.813693047 CET | 49990 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:04:02.813705921 CET | 443 | 49990 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:04:03.444830894 CET | 443 | 49990 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:04:03.444896936 CET | 49990 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:04:03.445611000 CET | 49990 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:04:03.445619106 CET | 443 | 49990 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:04:03.445873976 CET | 49990 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:04:03.445878029 CET | 443 | 49990 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:04:03.868947983 CET | 443 | 49990 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:04:03.869019985 CET | 443 | 49990 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:04:03.869086027 CET | 443 | 49990 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:04:03.869102001 CET | 49990 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:04:03.869122028 CET | 49990 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:04:03.869158983 CET | 49990 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:04:03.871263981 CET | 49990 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:04:03.871280909 CET | 443 | 49990 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:04:13.919028044 CET | 49991 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:04:13.919059992 CET | 443 | 49991 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:04:13.919329882 CET | 49991 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:04:13.920027018 CET | 49991 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:04:13.920039892 CET | 443 | 49991 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:04:14.566487074 CET | 443 | 49991 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:04:14.566678047 CET | 49991 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:04:14.567277908 CET | 443 | 49991 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:04:14.567363024 CET | 49991 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:04:14.569288969 CET | 49991 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:04:14.569299936 CET | 443 | 49991 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:04:14.569725990 CET | 443 | 49991 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:04:14.569778919 CET | 49991 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:04:14.570324898 CET | 49991 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:04:14.611325026 CET | 443 | 49991 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:04:14.970143080 CET | 443 | 49991 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:04:14.970230103 CET | 49991 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:04:14.970247030 CET | 443 | 49991 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:04:14.970284939 CET | 49991 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:04:14.970345020 CET | 443 | 49991 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:04:14.970390081 CET | 49991 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:04:14.970937967 CET | 49991 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:04:14.970952988 CET | 443 | 49991 | 142.250.184.238 | 192.168.2.10 |
| Jan 10, 2025 16:04:14.970963955 CET | 49991 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:04:14.970999002 CET | 49991 | 443 | 192.168.2.10 | 142.250.184.238 |
| Jan 10, 2025 16:04:14.983972073 CET | 49992 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:04:14.984036922 CET | 443 | 49992 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:04:14.984133959 CET | 49992 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:04:14.984544992 CET | 49992 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:04:14.984566927 CET | 443 | 49992 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:04:15.636060953 CET | 443 | 49992 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:04:15.636162996 CET | 49992 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:04:15.639920950 CET | 49992 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:04:15.639976978 CET | 443 | 49992 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:04:15.640130997 CET | 49992 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:04:15.640146971 CET | 443 | 49992 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:04:16.140510082 CET | 443 | 49992 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:04:16.140598059 CET | 443 | 49992 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:04:16.140595913 CET | 49992 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:04:16.140625954 CET | 443 | 49992 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:04:16.140650034 CET | 49992 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:04:16.140672922 CET | 49992 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:04:16.140678883 CET | 443 | 49992 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:04:16.140690088 CET | 443 | 49992 | 142.250.186.97 | 192.168.2.10 |
| Jan 10, 2025 16:04:16.140711069 CET | 49992 | 443 | 192.168.2.10 | 142.250.186.97 |
| Jan 10, 2025 16:04:16.140732050 CET | 49992 | 443 | 192.168.2.10 | 142.250.186.97 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Jan 10, 2025 16:02:23.746577978 CET | 52757 | 53 | 192.168.2.10 | 1.1.1.1 |
| Jan 10, 2025 16:02:23.753942966 CET | 53 | 52757 | 1.1.1.1 | 192.168.2.10 |
| Jan 10, 2025 16:02:25.065788031 CET | 60223 | 53 | 192.168.2.10 | 1.1.1.1 |
| Jan 10, 2025 16:02:25.073983908 CET | 53 | 60223 | 1.1.1.1 | 192.168.2.10 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Jan 10, 2025 16:02:23.746577978 CET | 192.168.2.10 | 1.1.1.1 | 0xcf55 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Jan 10, 2025 16:02:25.065788031 CET | 192.168.2.10 | 1.1.1.1 | 0xc7e2 | Standard query (0) | A (IP address) | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Jan 10, 2025 16:02:23.753942966 CET | 1.1.1.1 | 192.168.2.10 | 0xcf55 | No error (0) | 142.250.184.238 | A (IP address) | IN (0x0001) | false | ||
| Jan 10, 2025 16:02:25.073983908 CET | 1.1.1.1 | 192.168.2.10 | 0xc7e2 | No error (0) | 142.250.186.97 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.10 | 49708 | 142.250.184.238 | 443 | 2900 | C:\Users\user\Desktop\Osb7hkGfAb.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-10 15:02:24 UTC | 216 | OUT | |
| 2025-01-10 15:02:25 UTC | 1920 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.10 | 49710 | 142.250.186.97 | 443 | 2900 | C:\Users\user\Desktop\Osb7hkGfAb.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-10 15:02:25 UTC | 258 | OUT | |
| 2025-01-10 15:02:26 UTC | 2225 | IN | |
| 2025-01-10 15:02:26 UTC | 1652 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 2 | 192.168.2.10 | 49780 | 142.250.184.238 | 443 | 2900 | C:\Users\user\Desktop\Osb7hkGfAb.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-10 15:02:36 UTC | 417 | OUT | |
| 2025-01-10 15:02:37 UTC | 1920 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 3 | 192.168.2.10 | 49787 | 142.250.186.97 | 443 | 2900 | C:\Users\user\Desktop\Osb7hkGfAb.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-10 15:02:38 UTC | 459 | OUT | |
| 2025-01-10 15:02:38 UTC | 1851 | IN | |
| 2025-01-10 15:02:38 UTC | 1652 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 4 | 192.168.2.10 | 49856 | 142.250.184.238 | 443 | 2900 | C:\Users\user\Desktop\Osb7hkGfAb.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-10 15:02:49 UTC | 417 | OUT | |
| 2025-01-10 15:02:49 UTC | 1920 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 5 | 192.168.2.10 | 49866 | 142.250.186.97 | 443 | 2900 | C:\Users\user\Desktop\Osb7hkGfAb.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-10 15:02:50 UTC | 459 | OUT | |
| 2025-01-10 15:02:50 UTC | 1851 | IN | |
| 2025-01-10 15:02:50 UTC | 1652 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 6 | 192.168.2.10 | 49933 | 142.250.184.238 | 443 | 2900 | C:\Users\user\Desktop\Osb7hkGfAb.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-10 15:03:01 UTC | 417 | OUT | |
| 2025-01-10 15:03:01 UTC | 1920 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 7 | 192.168.2.10 | 49941 | 142.250.186.97 | 443 | 2900 | C:\Users\user\Desktop\Osb7hkGfAb.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-10 15:03:02 UTC | 459 | OUT | |
| 2025-01-10 15:03:02 UTC | 1851 | IN | |
| 2025-01-10 15:03:02 UTC | 1652 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 8 | 192.168.2.10 | 49981 | 142.250.184.238 | 443 | 2900 | C:\Users\user\Desktop\Osb7hkGfAb.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-10 15:03:13 UTC | 417 | OUT | |
| 2025-01-10 15:03:13 UTC | 1920 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 9 | 192.168.2.10 | 49982 | 142.250.186.97 | 443 | 2900 | C:\Users\user\Desktop\Osb7hkGfAb.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-10 15:03:14 UTC | 459 | OUT | |
| 2025-01-10 15:03:15 UTC | 1851 | IN | |
| 2025-01-10 15:03:15 UTC | 1652 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 10 | 192.168.2.10 | 49983 | 142.250.184.238 | 443 | 2900 | C:\Users\user\Desktop\Osb7hkGfAb.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-10 15:03:25 UTC | 417 | OUT | |
| 2025-01-10 15:03:26 UTC | 1920 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 11 | 192.168.2.10 | 49984 | 142.250.186.97 | 443 | 2900 | C:\Users\user\Desktop\Osb7hkGfAb.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-10 15:03:26 UTC | 459 | OUT | |
| 2025-01-10 15:03:27 UTC | 1844 | IN | |
| 2025-01-10 15:03:27 UTC | 1652 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 12 | 192.168.2.10 | 49985 | 142.250.184.238 | 443 | 2900 | C:\Users\user\Desktop\Osb7hkGfAb.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-10 15:03:37 UTC | 417 | OUT | |
| 2025-01-10 15:03:38 UTC | 1920 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 13 | 192.168.2.10 | 49986 | 142.250.186.97 | 443 | 2900 | C:\Users\user\Desktop\Osb7hkGfAb.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-10 15:03:39 UTC | 459 | OUT | |
| 2025-01-10 15:03:39 UTC | 1851 | IN | |
| 2025-01-10 15:03:39 UTC | 1652 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 14 | 192.168.2.10 | 49987 | 142.250.184.238 | 443 | 2900 | C:\Users\user\Desktop\Osb7hkGfAb.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-10 15:03:50 UTC | 417 | OUT | |
| 2025-01-10 15:03:50 UTC | 1920 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 15 | 192.168.2.10 | 49988 | 142.250.186.97 | 443 | 2900 | C:\Users\user\Desktop\Osb7hkGfAb.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-10 15:03:51 UTC | 459 | OUT | |
| 2025-01-10 15:03:51 UTC | 1851 | IN | |
| 2025-01-10 15:03:51 UTC | 1652 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 16 | 192.168.2.10 | 49989 | 142.250.184.238 | 443 | 2900 | C:\Users\user\Desktop\Osb7hkGfAb.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-10 15:04:02 UTC | 417 | OUT | |
| 2025-01-10 15:04:02 UTC | 1920 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 17 | 192.168.2.10 | 49990 | 142.250.186.97 | 443 | 2900 | C:\Users\user\Desktop\Osb7hkGfAb.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-10 15:04:03 UTC | 459 | OUT | |
| 2025-01-10 15:04:03 UTC | 1851 | IN | |
| 2025-01-10 15:04:03 UTC | 1652 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 18 | 192.168.2.10 | 49991 | 142.250.184.238 | 443 | 2900 | C:\Users\user\Desktop\Osb7hkGfAb.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-10 15:04:14 UTC | 417 | OUT | |
| 2025-01-10 15:04:14 UTC | 1920 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 19 | 192.168.2.10 | 49992 | 142.250.186.97 | 443 | 2900 | C:\Users\user\Desktop\Osb7hkGfAb.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-10 15:04:15 UTC | 459 | OUT | |
| 2025-01-10 15:04:16 UTC | 1851 | IN | |
| 2025-01-10 15:04:16 UTC | 1652 | IN |
Click to jump to process
Click to jump to process
Click to jump to process
| Target ID: | 0 |
| Start time: | 10:01:08 |
| Start date: | 10/01/2025 |
| Path: | C:\Users\user\Desktop\Osb7hkGfAb.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x400000 |
| File size: | 887'424 bytes |
| MD5 hash: | A09950FD9AF3C4E3FF6F778AB5D8CE0F |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Reputation: | low |
| Has exited: | true |
| Target ID: | 6 |
| Start time: | 10:02:14 |
| Start date: | 10/01/2025 |
| Path: | C:\Users\user\Desktop\Osb7hkGfAb.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x400000 |
| File size: | 887'424 bytes |
| MD5 hash: | A09950FD9AF3C4E3FF6F778AB5D8CE0F |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Reputation: | low |
| Has exited: | false |
Execution Graph
| Execution Coverage: | 19% |
| Dynamic/Decrypted Code Coverage: | 0% |
| Signature Coverage: | 16.5% |
| Total number of Nodes: | 1511 |
| Total number of Limit Nodes: | 46 |
Graph
Function 00403348 Relevance: 91.4, APIs: 32, Strings: 20, Instructions: 366stringcomfileCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004058BF Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 159filestringCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040646B Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004027A1 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040390A Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 215stringregistryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00402EA1 Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 181memoryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040618A Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 199stringCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401759 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147stringtimeCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00406492 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401C2E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00402476 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64registrystringCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405FDE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405796 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401EC5 Relevance: 3.0, APIs: 2, Instructions: 25COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405C90 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405761 Relevance: 3.0, APIs: 2, Instructions: 9COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 700E2A38 Relevance: 1.6, APIs: 1, Instructions: 143memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040266D Relevance: 1.6, APIs: 1, Instructions: 76COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040166A Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040272B Relevance: 1.5, APIs: 1, Instructions: 28COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040239C Relevance: 1.5, APIs: 1, Instructions: 26COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040171F Relevance: 1.5, APIs: 1, Instructions: 24COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405D08 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405D37 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 700E2921 Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004023E0 Relevance: 1.5, APIs: 1, Instructions: 20COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040159D Relevance: 1.5, APIs: 1, Instructions: 18COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00403300 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401F7B Relevance: 1.3, APIs: 1, Instructions: 37COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004014D6 Relevance: 1.3, APIs: 1, Instructions: 19sleepCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040535C Relevance: 54.3, APIs: 36, Instructions: 282windowclipboardmemoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040460D Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 274stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 700E1A98 Relevance: 20.1, APIs: 13, Instructions: 591stringlibrarymemoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00406945 Relevance: .3, Instructions: 334COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040711C Relevance: .3, Instructions: 300COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404B80 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 491windowmemoryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004042E6 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 202windowstringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405D66 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 129memorystringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 700E22F1 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 140memoryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004041E2 Relevance: 12.1, APIs: 8, Instructions: 68COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 700E24D8 Relevance: 10.6, APIs: 7, Instructions: 124COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404ACE Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00402DBA Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 700E1837 Relevance: 7.7, APIs: 5, Instructions: 194COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401D65 Relevance: 7.6, APIs: 5, Instructions: 75windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004049C4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405A8F Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00402E3D Relevance: 6.0, APIs: 4, Instructions: 33COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405B7D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405192 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405AD6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 700E10E0 Relevance: 5.1, APIs: 4, Instructions: 102memoryCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405BF5 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|