Edit tour
Windows
Analysis Report
ro7eoySJ9q.exe
Overview
General Information
| Sample name: | ro7eoySJ9q.exerenamed because original name is a hash value |
| Original sample name: | ebda1db301f4e3e3500292b8c519298d577cb9908b94f106a3cbe8c83136a423.exe |
| Analysis ID: | 1588610 |
| MD5: | 69c59075bc9ffd11bf75080cfe44f29e |
| SHA1: | e1cb7f85eb9236fad345bc1e3f941219cdf84edc |
| SHA256: | ebda1db301f4e3e3500292b8c519298d577cb9908b94f106a3cbe8c83136a423 |
| Tags: | exeGuLoadersigneduser-adrian__luca |
| Infos: |   |
 | |
Detection
GuLoader
| Score: | 96 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Early bird code injection technique detected
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected GuLoader
AI detected suspicious sample
Found suspicious powershell code related to unpacking or dynamic code loading
Loading BitLocker PowerShell Module
Powershell drops PE file
Queues an APC in another process (thread injection)
Writes to foreign memory regions
Checks if the current process is being debugged
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to dynamically determine API calls
Contains functionality to shutdown / reboot the system
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE / OLE file has an invalid certificate
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Msiexec Initiated Connection
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Classification
- System is w10x64
ro7eoySJ9q.exe (PID: 5616 cmdline: "C:\Users\ user\Deskt op\ro7eoyS J9q.exe" MD5: 69C59075BC9FFD11BF75080CFE44F29E) 
powershell.exe (PID: 5732 cmdline: "powershel l.exe" -wi ndowstyle minimized "$Aichmoph obia=Get-C ontent -Ra w 'C:\User s\user\App Data\Roami ng\Polysul fonate\san gersken\Ka rbonpapirs .Fis';$Ref erendumets =$Aichmoph obia.SubSt ring(72360 ,3);.$Refe rendumets( $Aichmopho bia)" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC) 
conhost.exe (PID: 2924 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
msiexec.exe (PID: 6968 cmdline: "C:\Window s\SysWOW64 \msiexec.e xe" MD5: 9D09DC1EDA745A5F87553048E57620CF)
- cleanup
| Name | Description | Attribution | Blogpost URLs | Link |
|---|---|---|---|---|
| CloudEyE, GuLoader | CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored. | No Attribution |
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_GuLoader_2 | Yara detected GuLoader | Joe Security | ||
| JoeSecurity_GuLoader_2 | Yara detected GuLoader | Joe Security |
System Summary |   |
|---|
| Source: | Author: frack113: | ||
| Source: | Author: frack113, Nasreddine Bencherchali (Nextron Systems): | ||
| Source: | Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): | ||
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2025-01-11T03:16:24.547206+0100 | 2803270 | 2 | Potentially Bad Traffic | 192.168.2.5 | 49975 | 142.250.185.110 | 443 | TCP |
Click to jump to signature section
Show All Signature Results
AV Detection | |
|---|
| Source: | ReversingLabs: | ||
| Source: | ReversingLabs: | |||
| Source: | Virustotal: | Perma Link | ||
| Source: | Integrated Neural Analysis Model: | ||
| Source: | Static PE information: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Code function: | 0_2_004055D5 | |
| Source: | Code function: | 0_2_00406089 | |
| Source: | Code function: | 0_2_00402706 | |
| Source: | JA3 fingerprint: | ||
| Source: | Suricata IDS: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Code function: | 0_2_00405139 | |
System Summary | |
|---|
| Source: | File created: | Jump to dropped file | ||
| Source: | Code function: | 0_2_004031DD | |
| Source: | Code function: | 0_2_00404976 | |
| Source: | Code function: | 0_2_004064EC | |
| Source: | Code function: | 2_2_06E12760 | |
| Source: | Code function: | 2_2_06E179E0 | |
| Source: | Code function: | 2_2_06E1AE2D | |
| Source: | Code function: | 2_2_06E179D0 | |
| Source: | Static PE information: | ||
| Source: | Binary or memory string: | ||
| Source: | Static PE information: | ||
| Source: | Classification label: | ||
| Source: | Code function: | 0_2_00404430 | |
| Source: | Code function: | 0_2_0040206A | |
| Source: | File created: | Jump to behavior | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | WMI Queries: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | ReversingLabs: | ||
| Source: | Virustotal: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Key value queried: | Jump to behavior | ||
| Source: | Window detected: | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Static file information: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
Data Obfuscation | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | Anti Malware Scan Interface: | ||
| Source: | Anti Malware Scan Interface: | ||
| Source: | Code function: | 0_2_004060B0 | |
| Source: | Code function: | 2_2_040AAA01 | |
| Source: | Code function: | 2_2_040AD701 | |
| Source: | Code function: | 2_2_06E1161C | |
| Source: | Code function: | 2_2_06E1B9E0 | |
| Source: | Code function: | 2_2_06F80FC7 | |
| Source: | Code function: | 2_2_06F84AE4 | |
| Source: | Code function: | 2_2_06F84B43 | |
| Source: | Code function: | 2_2_06F8E3E5 | |
| Source: | Code function: | 2_2_06F8E02D | |
| Source: | File created: | Jump to dropped file | ||
Hooking and other Techniques for Hiding and Protection | |
|---|
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Last function: | ||
| Source: | Code function: | 0_2_004055D5 | |
| Source: | Code function: | 0_2_00406089 | |
| Source: | Code function: | 0_2_00402706 | |
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | API call chain: | graph_0-3121 | ||
| Source: | API call chain: | graph_0-3127 | ||
| Source: | Process information queried: | Jump to behavior | ||
| Source: | Process queried: | Jump to behavior | ||
| Source: | Code function: | 2_2_008CF520 | |
| Source: | Code function: | 0_2_004060B0 | |
| Source: | Process token adjusted: | Jump to behavior | ||
HIPS / PFW / Operating System Protection Evasion | |
|---|
| Source: | Process created / APC Queued / Resumed: | Jump to behavior | ||
| Source: | Thread APC queued: | Jump to behavior | ||
| Source: | Memory written: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Code function: | 0_2_00405D68 | |
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | 1 Windows Management Instrumentation | 1 DLL Side-Loading | 311 Process Injection | 1 Masquerading | OS Credential Dumping | 111 Security Software Discovery | Remote Services | 1 Archive Collected Data | 11 Encrypted Channel | Exfiltration Over Other Network Medium | 1 System Shutdown/Reboot |
| Credentials | Domains | Default Accounts | 1 Native API | Boot or Logon Initialization Scripts | 1 DLL Side-Loading | 31 Virtualization/Sandbox Evasion | LSASS Memory | 1 Process Discovery | Remote Desktop Protocol | 1 Clipboard Data | 3 Ingress Tool Transfer | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | 1 PowerShell | Logon Script (Windows) | Logon Script (Windows) | 311 Process Injection | Security Account Manager | 31 Virtualization/Sandbox Evasion | SMB/Windows Admin Shares | Data from Network Shared Drive | 3 Non-Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | 1 Obfuscated Files or Information | NTDS | 1 Application Window Discovery | Distributed Component Object Model | Input Capture | 14 Application Layer Protocol | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | Network Logon Script | 1 Software Packing | LSA Secrets | 2 File and Directory Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
| Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | 1 DLL Side-Loading | Cached Domain Credentials | 14 System Information Discovery | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 61% | ReversingLabs | Win32.Trojan.Guloader | ||
| 72% | Virustotal | Browse |
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 61% | ReversingLabs | Win32.Trojan.Guloader |
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| drive.google.com | 142.250.185.110 | true | false | high | |
| drive.usercontent.google.com | 142.250.181.225 | true | false | high |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 142.250.181.225 | drive.usercontent.google.com | United States | 15169 | GOOGLEUS | false | |
| 142.250.185.110 | drive.google.com | United States | 15169 | GOOGLEUS | false |
| Joe Sandbox version: | 42.0.0 Malachite |
| Analysis ID: | 1588610 |
| Start date and time: | 2025-01-11 03:14:13 +01:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 7m 48s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Run name: | Run with higher sleep bypass |
| Number of analysed new started processes analysed: | 7 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | ro7eoySJ9q.exerenamed because original name is a hash value |
| Original Sample Name: | ebda1db301f4e3e3500292b8c519298d577cb9908b94f106a3cbe8c83136a423.exe |
| Detection: | MAL |
| Classification: | mal96.troj.evad.winEXE@6/15@2/2 |
| EGA Information: |
|
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
- Excluded IPs from analysis (whitelisted): 13.107.246.45, 4.245.163.56, 20.12.23.50
- Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
- Not all processes where analyzed, report is missing behavior information
- Report size getting too big, too many NtCreateKey calls found.
- Report size getting too big, too many NtQueryAttributesFile calls found.
⊘No simulations
⊘No context
⊘No context
⊘No context
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 37f463bf4616ecd445d4a1937da06e19 | Get hash | malicious | GuLoader, MassLogger RAT | Browse |
| |
| Get hash | malicious | GuLoader, Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | GuLoader | Browse |
| ||
| Get hash | malicious | GuLoader, MassLogger RAT | Browse |
| ||
| Get hash | malicious | GuLoader | Browse |
| ||
| Get hash | malicious | GuLoader | Browse |
| ||
| Get hash | malicious | Snake Keylogger | Browse |
| ||
| Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
| Get hash | malicious | GuLoader, MassLogger RAT | Browse |
|
⊘No context
| Process: | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | modified |
| Size (bytes): | 53158 |
| Entropy (8bit): | 5.062687652912555 |
| Encrypted: | false |
| SSDEEP: | 1536:N8Z+z30pPV3CNBQkj2Ph4iUx7aVKflJnqvPqdKgfSRIOdBlzStAHk4NKeCMiYoLs:iZ+z30pPV3CNBQkj2PqiU7aVKflJnqvF |
| MD5: | 5D430F1344CE89737902AEC47C61C930 |
| SHA1: | 0B90F23535E8CDAC8EC1139183D5A8A269C2EFEB |
| SHA-256: | 395099D9A062FA7A72B73D7B354BF411DA7CFD8D6ADAA9FDBC0DD7C282348DC7 |
| SHA-512: | DFC18D47703A69D44643CFC0209B785A4393F4A4C84FAC5557D996BC2A3E4F410EA6D26C66EA7F765CEC491DD52C8454CB0F538D20D2EFF09DC89DDECC0A2AFE |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| Preview: |
| Process: | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 60 |
| Entropy (8bit): | 4.038920595031593 |
| Encrypted: | false |
| SSDEEP: | 3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX |
| MD5: | D17FE0A3F47BE24A6453E9EF58C94641 |
| SHA1: | 6AB83620379FC69F80C0242105DDFFD7D98D5D9D |
| SHA-256: | 96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 |
| SHA-512: | 5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82 |
| Malicious: | false |
| Reputation: | high, very likely benign file |
| Preview: |
| Process: | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 60 |
| Entropy (8bit): | 4.038920595031593 |
| Encrypted: | false |
| SSDEEP: | 3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX |
| MD5: | D17FE0A3F47BE24A6453E9EF58C94641 |
| SHA1: | 6AB83620379FC69F80C0242105DDFFD7D98D5D9D |
| SHA-256: | 96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 |
| SHA-512: | 5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82 |
| Malicious: | false |
| Preview: |
| Process: | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 60 |
| Entropy (8bit): | 4.038920595031593 |
| Encrypted: | false |
| SSDEEP: | 3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX |
| MD5: | D17FE0A3F47BE24A6453E9EF58C94641 |
| SHA1: | 6AB83620379FC69F80C0242105DDFFD7D98D5D9D |
| SHA-256: | 96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 |
| SHA-512: | 5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82 |
| Malicious: | false |
| Preview: |
| Process: | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 60 |
| Entropy (8bit): | 4.038920595031593 |
| Encrypted: | false |
| SSDEEP: | 3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX |
| MD5: | D17FE0A3F47BE24A6453E9EF58C94641 |
| SHA1: | 6AB83620379FC69F80C0242105DDFFD7D98D5D9D |
| SHA-256: | 96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 |
| SHA-512: | 5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\ro7eoySJ9q.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 486421 |
| Entropy (8bit): | 1.2470433609131586 |
| Encrypted: | false |
| SSDEEP: | 1536:p9ffEEX6My2RPkr6vyxsgBVdhrF8pGQkuxMSmLgnrL94:bffg2CJbdlFhh2Mwl4 |
| MD5: | 858C7D246EC84B37359FDE23A9F8898A |
| SHA1: | 2046EFB2E9421F1F1C0CABA9F0D7ECCAD1F4AE0F |
| SHA-256: | 100C199A129F94FB16BDD51943FB691AB055CEA690088691C0F989D4C1C75884 |
| SHA-512: | 547AA46E6279DD8DF920C2BF21B5A98B47F8B2F81E32FB36678119BC9510CA7D358C38C63E46E71285B76236D46D515CFE7C4DEA37660AE63E533AB78878ABBB |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\ro7eoySJ9q.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 72400 |
| Entropy (8bit): | 5.192574154183547 |
| Encrypted: | false |
| SSDEEP: | 1536:AGGe3wKH5jk6dqKN1hsYIOWl8/4noyXgRCopjLSz/1cqtssTzDyohZuK:ALgwKZjNdJN/IXlK4oyXMpja6Ypj/qK |
| MD5: | FC1243B96424C77D582F495E7572027B |
| SHA1: | 21AF8B3AEAECBD754C5FE4F3B3FE84CF741AC9C4 |
| SHA-256: | 2DB217565103029D09CF451F3FACECFF81BEA4D089D1BFE4CCF297B53E2F3CB7 |
| SHA-512: | E35C6DFE1699C9B4011E42A5EFD16F317E718101C7D8A81867B1E2951021BD4DAC0AC59B5AAA9E358E4CB0FA3F0A98C4F279A8B37A0DBFC5F031F9EE1DFEBB91 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\ro7eoySJ9q.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 315374 |
| Entropy (8bit): | 7.718302595085237 |
| Encrypted: | false |
| SSDEEP: | 6144:k1gcaHtn8nWPiQWxAnN/iF14M4337pvwMXMbp2O3oL0z8QOT78wtPaB6:AgcS8nAnWxAtiF14rJMbwO3HrJwhaB6 |
| MD5: | B82937D4161F35374A360149D43614E7 |
| SHA1: | E42EADA7A06078688C363E341ADCE37237B510B3 |
| SHA-256: | DE1F8A1AE7BC242425197B7C5206A558543559A1BF5B5BFA5B4B11EC5CD4FBDF |
| SHA-512: | 90BA42E077A4F569143F935D07A263AF64966D382D4B9ADED1E462B6AE54F195DC07CE6FB67A96AEEF003B4DB13D99DEF1D84B686CC194FC985A56EA0A9999A8 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\ro7eoySJ9q.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 462783 |
| Entropy (8bit): | 1.2514895750557933 |
| Encrypted: | false |
| SSDEEP: | 1536:gR0px6Iw5kvIV8FuWk8mGWwi1BoFIN8oYd:jmIwavC6utxgIjYd |
| MD5: | 77218C2134D28A666F2FDEAA5E452489 |
| SHA1: | 16E2234D9C2F4E4265D1362887B40149B9E31823 |
| SHA-256: | A901A3525DC18A4A9E6EF655931252D8258D954D419FCE81668F251C8EF54EE5 |
| SHA-512: | AFE9F39C392A6DE29B551393CB032534D04AA18B82E747406A23828DE7B4088FBA3045F0DD8ECC37C3A4FE45125605C0504EA8A1C38DA429624A35753E8E3ED2 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\ro7eoySJ9q.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 457562 |
| Entropy (8bit): | 1.2482312628496608 |
| Encrypted: | false |
| SSDEEP: | 1536:2jMpNhAlrasgHvP3V5s9ASYucRtPbRS9y:hpNhX93V5sOSTczjB |
| MD5: | E4AC954ED484155B2A165BF00B1E8A4F |
| SHA1: | 21ACBAC21538E0258892381807BBE19524DA02E3 |
| SHA-256: | 3078C30C80C29C473A796C4E1FE5F89A175D9B23FC88DBCD0262D93B0C67BEED |
| SHA-512: | A63E484A5CF926E2484B69210BE047B1F90DAC2A0F813E33D2F1B507CC45AF21169AEC9EBEAA6152CDB2448BEE7B09D82E4427C7596E864B09A7A15560D323AC |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\ro7eoySJ9q.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 327732 |
| Entropy (8bit): | 1.2609335393847756 |
| Encrypted: | false |
| SSDEEP: | 768:rbmwczlydY1vPDT6+VOPnd7avS0bYT7bUkf0+VNt8xT70sob8aN/qfizqd71OFNj:sQdCVXhCo3Vxd/SRgV133ZBLlo |
| MD5: | 622032628F068FE10CC2E51D0502CC9A |
| SHA1: | 5AE897F10B51533C20489B755F4395FCED7EB67C |
| SHA-256: | 840F31C02A7A8CA755C4CD53619D9F93BB42848DD334B25A0A3C72B13F5753F4 |
| SHA-512: | 2E5C98D7E3FE856D22381B2B97BAC5DF50C82859CB62DCF1D2FE3386B79D96446887FECB59D43F924200532399307E3846DDECA33FB87A286ADD5E6CEFC10637 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\ro7eoySJ9q.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 433848 |
| Entropy (8bit): | 1.255481788885247 |
| Encrypted: | false |
| SSDEEP: | 768:8agBmxdiio94Vue1rGruEhQHTvyGPHzfrm75zidpc8oUH392slzddIRzyP98UmYu:NgKjnn/NnW5hQAPAfMqoDH+bI |
| MD5: | 7586252625434A405256063977B84D0D |
| SHA1: | BA800F4510A4940F6EA11F866E3F4AF9805BDFD4 |
| SHA-256: | 5AFA5BC29281632F196999E16D8F4B26F2C14EC6A8A5F589DC5932B6DE78A2A7 |
| SHA-512: | 613E03C6EC8DFBE0B2B6A450B30B932157FE40121E6A7E4AE9FB188193AB6E5D3CA044F30351A3E969FD84BAC8BC7AD2B7DD5E9D0BB091FEDE0546CC9E3A3856 |
| Malicious: | false |
| Preview: |
| Process: | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1060792 |
| Entropy (8bit): | 7.56576191182161 |
| Encrypted: | false |
| SSDEEP: | 24576:bj+EJoIVlLHDiemfwmNG3Ap137dboaPjyMi76Kbh:v+xIDXoIt3IRM+i76s |
| MD5: | 69C59075BC9FFD11BF75080CFE44F29E |
| SHA1: | E1CB7F85EB9236FAD345BC1E3F941219CDF84EDC |
| SHA-256: | EBDA1DB301F4E3E3500292B8C519298D577CB9908B94F106A3CBE8C83136A423 |
| SHA-512: | 163C7AAD4458A5E9BED67D4B20EC2DC06011F249003BC68DB7F38C4E8B617F457D2C9E0C8838D2BF7F63170CDF3C10D430F29110C0BB8C491928808AEC3258B6 |
| Malicious: | true |
| Antivirus: |
|
| Preview: |
| Process: | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 26 |
| Entropy (8bit): | 3.95006375643621 |
| Encrypted: | false |
| SSDEEP: | 3:ggPYV:rPYV |
| MD5: | 187F488E27DB4AF347237FE461A079AD |
| SHA1: | 6693BA299EC1881249D59262276A0D2CB21F8E64 |
| SHA-256: | 255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309 |
| SHA-512: | 89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E |
| Malicious: | true |
| Preview: |
| Process: | C:\Users\user\Desktop\ro7eoySJ9q.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 327124 |
| Entropy (8bit): | 1.2472891497347776 |
| Encrypted: | false |
| SSDEEP: | 768:qw1bcEnP59OCTltLumdIdNK2mkVYYHN44jjU5S6EP1KRuM/VTCo0oXATL4bYZcOO:jucypY8Gyju3O4/iALDvWJTAnjPqqaO |
| MD5: | 0EC84A842970A2C0B04893F66217F733 |
| SHA1: | E100ACDACE598C27B00E0AF658306942A70228FC |
| SHA-256: | 6B3552FC5295BE3AE9FADD8AFA8A06103BD60DDB6E0BE924C61B346895505A7A |
| SHA-512: | 27270395859FEF2B270B7C2C70FA587BAF4FDCFF742DA93B6F7D1B0B82B5B1FF0BA9004BD3B825A9A62FAE75FB0F792A176ECE980529B61A2FEADE958B8B0BFB |
| Malicious: | false |
| Preview: |
| File type: | |
| Entropy (8bit): | 7.56576191182161 |
| TrID: |
|
| File name: | ro7eoySJ9q.exe |
| File size: | 1'060'792 bytes |
| MD5: | 69c59075bc9ffd11bf75080cfe44f29e |
| SHA1: | e1cb7f85eb9236fad345bc1e3f941219cdf84edc |
| SHA256: | ebda1db301f4e3e3500292b8c519298d577cb9908b94f106a3cbe8c83136a423 |
| SHA512: | 163c7aad4458a5e9bed67d4b20ec2dc06011f249003bc68db7f38c4e8b617f457d2c9e0c8838d2bf7f63170cdf3c10d430f29110c0bb8c491928808aec3258b6 |
| SSDEEP: | 24576:bj+EJoIVlLHDiemfwmNG3Ap137dboaPjyMi76Kbh:v+xIDXoIt3IRM+i76s |
| TLSH: | B8352312B251D48EE4720632E95BE67D043ADF1CDD504A1727A43F9F397BA826C7428F |
| File Content Preview: | MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1.D9u.*ju.*ju.*j..ujw.*ju.+j..*j..wjd.*j!..j..*j..,jt.*jRichu.*j........PE..L....e.Q.................b...........1............@ |
 | |
| Icon Hash: | 0d4f7fd151493b07 |
| Entrypoint: | 0x4031dd |
| Entrypoint Section: | .text |
| Digitally signed: | true |
| Imagebase: | 0x400000 |
| Subsystem: | windows gui |
| Image File Characteristics: | RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE |
| DLL Characteristics: | TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x519965E1 [Sun May 19 23:53:05 2013 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 4 |
| OS Version Minor: | 0 |
| File Version Major: | 4 |
| File Version Minor: | 0 |
| Subsystem Version Major: | 4 |
| Subsystem Version Minor: | 0 |
| Import Hash: | 7fd61eafe142870d6d0380163804a642 |
| Signature Valid: | false |
| Signature Issuer: | CN=Cadamba, O=Cadamba, L=Pagney, C=FR |
| Signature Validation Error: | A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider |
| Error Number: | -2146762487 |
| Not Before, Not After |
|
| Subject Chain |
|
| Version: | 3 |
| Thumbprint MD5: | A1DDD1E0B2FDEE711CFF6DC5EF151203 |
| Thumbprint SHA-1: | E1D495360FBCBEFE3EB73B2B05198778C4E351AA |
| Thumbprint SHA-256: | 7937613CCFB0CF0772387EDE47A346B0A09760A520BEF4DABB06C92C2294CB5B |
| Serial: | 3B493B0032D7E072710BAB5C19E1E82C545F1684 |
| Instruction |
|---|
| sub esp, 000002D4h |
| push ebx |
| push ebp |
| push esi |
| push edi |
| push 00000020h |
| xor ebp, ebp |
| pop esi |
| mov dword ptr [esp+18h], ebp |
| mov dword ptr [esp+10h], 0040A2D8h |
| mov dword ptr [esp+14h], ebp |
| call dword ptr [00408034h] |
| push 00008001h |
| call dword ptr [00408134h] |
| push ebp |
| call dword ptr [004082ACh] |
| push 00000008h |
| mov dword ptr [00434F58h], eax |
| call 00007F5FDCD26F75h |
| mov dword ptr [00434EA4h], eax |
| push ebp |
| lea eax, dword ptr [esp+34h] |
| push 000002B4h |
| push eax |
| push ebp |
| push 0042B1B8h |
| call dword ptr [0040817Ch] |
| push 0040A2C0h |
| push 00433EA0h |
| call 00007F5FDCD26BE0h |
| call dword ptr [00408138h] |
| mov ebx, 0043F000h |
| push eax |
| push ebx |
| call 00007F5FDCD26BCEh |
| push ebp |
| call dword ptr [0040810Ch] |
| cmp word ptr [0043F000h], 0022h |
| mov dword ptr [00434EA0h], eax |
| mov eax, ebx |
| jne 00007F5FDCD240EAh |
| push 00000022h |
| mov eax, 0043F002h |
| pop esi |
| push esi |
| push eax |
| call 00007F5FDCD2663Ch |
| push eax |
| call dword ptr [00408240h] |
| mov dword ptr [esp+1Ch], eax |
| jmp 00007F5FDCD241A9h |
| push 00000020h |
| pop edx |
| cmp cx, dx |
| jne 00007F5FDCD240E9h |
| inc eax |
| inc eax |
| cmp word ptr [eax], dx |
| je 00007F5FDCD240DBh |
| add word ptr [eax], 0000h |
| Programming Language: |
|
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0x85a0 | 0xb4 | .rdata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x55000 | 0x2eba8 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x1026d0 | 0x8e8 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x8000 | 0x2b8 | .rdata |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x6010 | 0x6200 | c51ae685760de510818d22f29d66b8b0 | False | 0.6646603954081632 | data | 6.440168137798694 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .rdata | 0x8000 | 0x1460 | 0x1600 | 24345ed7377f4b4663284282b5ef48b3 | False | 0.42134232954545453 | data | 4.947177345443015 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .data | 0xa000 | 0x2af98 | 0x600 | dc268be7d1af6fdfcd38d44492cfdaf5 | False | 0.486328125 | data | 3.791234740340295 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .ndata | 0x35000 | 0x20000 | 0x0 | d41d8cd98f00b204e9800998ecf8427e | False | 0 | empty | 0.0 | IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .rsrc | 0x55000 | 0x2eba8 | 0x2ec00 | bdebbd0274fda95ee828978bf6f6217f | False | 0.3979413853609626 | data | 3.9167771947187013 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| RT_ICON | 0x55388 | 0x10828 | Device independent bitmap graphic, 128 x 256 x 32, image size 67584 | English | United States | 0.364929610789069 |
| RT_ICON | 0x65bb0 | 0x94a8 | Device independent bitmap graphic, 96 x 192 x 32, image size 38016 | English | United States | 0.403011351692243 |
| RT_ICON | 0x6f058 | 0x67e8 | Device independent bitmap graphic, 80 x 160 x 32, image size 26560 | English | United States | 0.4087218045112782 |
| RT_ICON | 0x75840 | 0x5488 | Device independent bitmap graphic, 72 x 144 x 32, image size 21600 | English | United States | 0.4187615526802218 |
| RT_ICON | 0x7acc8 | 0x4228 | Device independent bitmap graphic, 64 x 128 x 32, image size 16896 | English | United States | 0.40298771846953235 |
| RT_ICON | 0x7eef0 | 0x25a8 | Device independent bitmap graphic, 48 x 96 x 32, image size 9600 | English | United States | 0.4413900414937759 |
| RT_ICON | 0x81498 | 0x10a8 | Device independent bitmap graphic, 32 x 64 x 32, image size 4224 | English | United States | 0.4702157598499062 |
| RT_ICON | 0x82540 | 0x988 | Device independent bitmap graphic, 24 x 48 x 32, image size 2400 | English | United States | 0.5204918032786885 |
| RT_ICON | 0x82ec8 | 0x468 | Device independent bitmap graphic, 16 x 32 x 32, image size 1088 | English | United States | 0.5824468085106383 |
| RT_DIALOG | 0x83330 | 0x100 | data | English | United States | 0.5234375 |
| RT_DIALOG | 0x83430 | 0x11c | data | English | United States | 0.6091549295774648 |
| RT_DIALOG | 0x83550 | 0xc4 | data | English | United States | 0.5918367346938775 |
| RT_DIALOG | 0x83618 | 0x60 | data | English | United States | 0.7291666666666666 |
| RT_GROUP_ICON | 0x83678 | 0x84 | data | English | United States | 0.7272727272727273 |
| RT_VERSION | 0x83700 | 0x1d8 | data | English | United States | 0.5317796610169492 |
| RT_MANIFEST | 0x838d8 | 0x2cb | XML 1.0 document, ASCII text, with very long lines (715), with no line terminators | English | United States | 0.5664335664335665 |
| DLL | Import |
|---|---|
| KERNEL32.dll | CompareFileTime, SearchPathW, SetFileTime, CloseHandle, GetShortPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, GetFullPathNameW, CreateDirectoryW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, SetEnvironmentVariableW, GetWindowsDirectoryW, GetTempPathW, SetFileAttributesW, ExpandEnvironmentStringsW, LoadLibraryW, lstrlenW, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, CreateProcessW, RemoveDirectoryW, lstrcmpiA, CreateFileW, GetTempFileNameW, lstrcpyA, lstrcpyW, lstrcatW, GetSystemDirectoryW, GetVersion, GetProcAddress, LoadLibraryA, GetModuleHandleA, GetModuleHandleW, lstrcmpiW, lstrcmpW, WaitForSingleObject, GlobalFree, GlobalAlloc, LoadLibraryExW, GetExitCodeProcess, FreeLibrary, WritePrivateProfileStringW, SetErrorMode, GetCommandLineW, GetPrivateProfileStringW, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, MultiByteToWideChar, FindClose, MulDiv, ReadFile, WriteFile, lstrlenA, WideCharToMultiByte |
| USER32.dll | EndDialog, ScreenToClient, GetWindowRect, RegisterClassW, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, wsprintfW, CreateWindowExW, SystemParametersInfoW, AppendMenuW, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, GetDC, SetWindowLongW, LoadImageW, SendMessageTimeoutW, FindWindowExW, EmptyClipboard, OpenClipboard, TrackPopupMenu, EndPaint, ShowWindow, GetDlgItem, IsWindow, SetForegroundWindow |
| GDI32.dll | SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor |
| SHELL32.dll | SHGetSpecialFolderLocation, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW |
| ADVAPI32.dll | RegCloseKey, RegOpenKeyExW, RegDeleteKeyW, RegDeleteValueW, RegEnumValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumKeyW |
| COMCTL32.dll | ImageList_Create, ImageList_AddMasked, ImageList_Destroy |
| ole32.dll | CoCreateInstance, CoTaskMemFree, OleInitialize, OleUninitialize |
| VERSION.dll | GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW |
| Language of compilation system | Country where language is spoken | Map |
|---|---|---|
| English | United States |  |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | SID | Signature | Severity | Source IP | Source Port | Dest IP | Dest Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2025-01-11T03:16:24.547206+0100 | 2803270 | ETPRO MALWARE Common Downloader Header Pattern UHCa | 2 | 192.168.2.5 | 49975 | 142.250.185.110 | 443 | TCP |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Jan 11, 2025 03:16:23.227967024 CET | 49975 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:16:23.228020906 CET | 443 | 49975 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:16:23.228091002 CET | 49975 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:16:23.254100084 CET | 49975 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:16:23.254125118 CET | 443 | 49975 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:16:23.893841028 CET | 443 | 49975 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:16:23.893996000 CET | 49975 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:16:23.894635916 CET | 443 | 49975 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:16:23.894900084 CET | 49975 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:16:24.252881050 CET | 49975 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:16:24.252918959 CET | 443 | 49975 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:16:24.253850937 CET | 443 | 49975 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:16:24.254226923 CET | 49975 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:16:24.257916927 CET | 49975 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:16:24.299330950 CET | 443 | 49975 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:16:24.547224998 CET | 443 | 49975 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:16:24.547341108 CET | 49975 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:16:24.547360897 CET | 443 | 49975 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:16:24.547456980 CET | 443 | 49975 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:16:24.547488928 CET | 49975 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:16:24.547488928 CET | 49975 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:16:24.547502041 CET | 443 | 49975 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:16:24.547560930 CET | 49975 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:16:24.547560930 CET | 49975 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:16:24.588149071 CET | 49976 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:16:24.588188887 CET | 443 | 49976 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:16:24.588319063 CET | 49976 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:16:24.588874102 CET | 49976 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:16:24.588892937 CET | 443 | 49976 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:16:25.241508961 CET | 443 | 49976 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:16:25.241611004 CET | 49976 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:16:25.247636080 CET | 49976 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:16:25.247651100 CET | 443 | 49976 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:16:25.247940063 CET | 443 | 49976 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:16:25.248054981 CET | 49976 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:16:25.248414040 CET | 49976 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:16:25.291349888 CET | 443 | 49976 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:16:25.646305084 CET | 443 | 49976 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:16:25.646363974 CET | 49976 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:16:25.646378040 CET | 443 | 49976 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:16:25.646398067 CET | 443 | 49976 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:16:25.646419048 CET | 49976 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:16:25.646425962 CET | 443 | 49976 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:16:25.646440029 CET | 49976 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:16:25.646482944 CET | 443 | 49976 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:16:25.646497011 CET | 49976 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:16:25.646528006 CET | 49976 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:16:25.652029037 CET | 49976 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:16:25.652050018 CET | 443 | 49976 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:16:35.686355114 CET | 49978 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:16:35.686409950 CET | 443 | 49978 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:16:35.686625004 CET | 49978 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:16:35.686949015 CET | 49978 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:16:35.686963081 CET | 443 | 49978 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:16:36.346822023 CET | 443 | 49978 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:16:36.346918106 CET | 49978 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:16:36.347358942 CET | 49978 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:16:36.347364902 CET | 443 | 49978 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:16:36.347640038 CET | 49978 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:16:36.347645044 CET | 443 | 49978 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:16:36.835648060 CET | 443 | 49978 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:16:36.835823059 CET | 49978 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:16:36.835850954 CET | 443 | 49978 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:16:36.835992098 CET | 49978 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:16:36.835992098 CET | 49978 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:16:36.836090088 CET | 443 | 49978 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:16:36.836227894 CET | 49978 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:16:36.866991997 CET | 49979 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:16:36.867034912 CET | 443 | 49979 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:16:36.867425919 CET | 49979 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:16:36.867425919 CET | 49979 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:16:36.867456913 CET | 443 | 49979 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:16:37.496696949 CET | 443 | 49979 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:16:37.496968985 CET | 49979 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:16:37.497590065 CET | 49979 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:16:37.497596025 CET | 443 | 49979 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:16:37.497751951 CET | 49979 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:16:37.497756958 CET | 443 | 49979 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:16:37.912811041 CET | 443 | 49979 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:16:37.912919044 CET | 443 | 49979 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:16:37.913012981 CET | 443 | 49979 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:16:37.913017035 CET | 49979 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:16:37.913079023 CET | 49979 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:16:37.913094997 CET | 49979 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:16:37.918461084 CET | 49979 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:16:37.918473959 CET | 443 | 49979 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:16:47.936362028 CET | 49980 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:16:47.936408043 CET | 443 | 49980 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:16:47.936577082 CET | 49980 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:16:47.936837912 CET | 49980 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:16:47.936851025 CET | 443 | 49980 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:16:48.575582981 CET | 443 | 49980 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:16:48.576364040 CET | 443 | 49980 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:16:48.576430082 CET | 49980 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:16:48.576431036 CET | 49980 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:16:48.576448917 CET | 443 | 49980 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:16:48.576633930 CET | 49980 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:16:48.592909098 CET | 49980 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:16:48.592927933 CET | 443 | 49980 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:16:48.593324900 CET | 443 | 49980 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:16:48.593555927 CET | 49980 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:16:48.593770027 CET | 49980 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:16:48.639328003 CET | 443 | 49980 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:16:48.962508917 CET | 443 | 49980 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:16:48.963327885 CET | 49980 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:16:48.963344097 CET | 443 | 49980 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:16:48.963555098 CET | 443 | 49980 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:16:48.963601112 CET | 49980 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:16:48.963601112 CET | 49980 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:16:48.963601112 CET | 49980 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:16:48.963613033 CET | 443 | 49980 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:16:48.964904070 CET | 49980 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:16:48.976141930 CET | 49981 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:16:48.976186037 CET | 443 | 49981 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:16:48.976262093 CET | 49981 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:16:48.976499081 CET | 49981 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:16:48.976509094 CET | 443 | 49981 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:16:49.690931082 CET | 443 | 49981 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:16:49.691031933 CET | 49981 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:16:49.691564083 CET | 49981 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:16:49.691574097 CET | 443 | 49981 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:16:49.691718102 CET | 49981 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:16:49.691725016 CET | 443 | 49981 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:16:50.105324030 CET | 443 | 49981 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:16:50.105410099 CET | 443 | 49981 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:16:50.105484962 CET | 443 | 49981 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:16:50.105523109 CET | 49981 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:16:50.105590105 CET | 49981 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:16:50.106522083 CET | 49981 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:16:50.106544018 CET | 443 | 49981 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:17:00.140614986 CET | 49982 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:17:00.140651941 CET | 443 | 49982 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:17:00.140723944 CET | 49982 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:17:00.141175985 CET | 49982 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:17:00.141190052 CET | 443 | 49982 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:17:00.771039963 CET | 443 | 49982 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:17:00.771222115 CET | 49982 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:17:00.771917105 CET | 49982 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:17:00.771927118 CET | 443 | 49982 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:17:00.772084951 CET | 49982 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:17:00.772089958 CET | 443 | 49982 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:17:01.166256905 CET | 443 | 49982 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:17:01.166333914 CET | 49982 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:17:01.166353941 CET | 443 | 49982 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:17:01.166393995 CET | 49982 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:17:01.166452885 CET | 49982 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:17:01.166498899 CET | 443 | 49982 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:17:01.166549921 CET | 49982 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:17:01.177944899 CET | 49983 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:17:01.178045988 CET | 443 | 49983 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:17:01.178148985 CET | 49983 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:17:01.178378105 CET | 49983 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:17:01.178416014 CET | 443 | 49983 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:17:01.824255943 CET | 443 | 49983 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:17:01.824491024 CET | 49983 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:17:01.825128078 CET | 49983 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:17:01.825136900 CET | 443 | 49983 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:17:01.825335026 CET | 49983 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:17:01.825341940 CET | 443 | 49983 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:17:02.228727102 CET | 443 | 49983 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:17:02.228805065 CET | 443 | 49983 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:17:02.228880882 CET | 443 | 49983 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:17:02.228883028 CET | 49983 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:17:02.228950977 CET | 49983 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:17:02.259881973 CET | 49983 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:17:02.259912968 CET | 443 | 49983 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:17:12.295829058 CET | 49984 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:17:12.295880079 CET | 443 | 49984 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:17:12.295979023 CET | 49984 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:17:12.296257019 CET | 49984 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:17:12.296273947 CET | 443 | 49984 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:17:12.935559988 CET | 443 | 49984 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:17:12.935709953 CET | 49984 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:17:12.938138962 CET | 443 | 49984 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:17:12.938210964 CET | 49984 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:17:12.939775944 CET | 49984 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:17:12.939786911 CET | 443 | 49984 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:17:12.940099001 CET | 443 | 49984 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:17:12.940160990 CET | 49984 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:17:12.940479040 CET | 49984 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:17:12.983333111 CET | 443 | 49984 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:17:13.311728954 CET | 443 | 49984 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:17:13.311798096 CET | 443 | 49984 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:17:13.311801910 CET | 49984 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:17:13.311845064 CET | 49984 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:17:13.312001944 CET | 49984 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:17:13.312025070 CET | 443 | 49984 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:17:13.312072992 CET | 49984 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:17:13.312098980 CET | 49984 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:17:13.322665930 CET | 49985 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:17:13.322701931 CET | 443 | 49985 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:17:13.322777033 CET | 49985 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:17:13.323008060 CET | 49985 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:17:13.323020935 CET | 443 | 49985 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:17:13.950315952 CET | 443 | 49985 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:17:13.950375080 CET | 49985 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:17:13.953078032 CET | 49985 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:17:13.953084946 CET | 443 | 49985 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:17:13.957365990 CET | 49985 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:17:13.957372904 CET | 443 | 49985 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:17:14.350722075 CET | 443 | 49985 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:17:14.350794077 CET | 49985 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:17:14.350805044 CET | 443 | 49985 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:17:14.350852013 CET | 49985 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:17:14.355161905 CET | 443 | 49985 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:17:14.355231047 CET | 49985 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:17:14.355236053 CET | 443 | 49985 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:17:14.355247021 CET | 443 | 49985 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:17:14.355269909 CET | 49985 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:17:14.355276108 CET | 443 | 49985 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:17:14.355292082 CET | 49985 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:17:14.355292082 CET | 49985 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:17:14.355309010 CET | 49985 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:17:14.355339050 CET | 49985 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:17:24.374075890 CET | 49986 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:17:24.374129057 CET | 443 | 49986 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:17:24.374222994 CET | 49986 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:17:24.374499083 CET | 49986 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:17:24.374516010 CET | 443 | 49986 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:17:25.029428959 CET | 443 | 49986 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:17:25.029551029 CET | 49986 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:17:25.030040026 CET | 49986 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:17:25.030054092 CET | 443 | 49986 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:17:25.030225992 CET | 49986 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:17:25.030231953 CET | 443 | 49986 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:17:25.410510063 CET | 443 | 49986 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:17:25.410598040 CET | 49986 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:17:25.410629988 CET | 443 | 49986 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:17:25.410674095 CET | 49986 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:17:25.410681009 CET | 443 | 49986 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:17:25.410718918 CET | 49986 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:17:25.410743952 CET | 443 | 49986 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:17:25.410770893 CET | 49986 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:17:25.410778999 CET | 443 | 49986 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:17:25.410794020 CET | 49986 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:17:25.410814047 CET | 49986 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:17:25.410834074 CET | 49986 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:17:25.419578075 CET | 49987 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:17:25.419616938 CET | 443 | 49987 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:17:25.419682026 CET | 49987 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:17:25.419981956 CET | 49987 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:17:25.419995070 CET | 443 | 49987 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:17:26.069962978 CET | 443 | 49987 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:17:26.070051908 CET | 49987 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:17:26.070539951 CET | 49987 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:17:26.070549965 CET | 443 | 49987 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:17:26.070679903 CET | 49987 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:17:26.070686102 CET | 443 | 49987 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:17:26.475301027 CET | 443 | 49987 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:17:26.475431919 CET | 443 | 49987 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:17:26.475477934 CET | 49987 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:17:26.475492954 CET | 443 | 49987 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:17:26.475513935 CET | 443 | 49987 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:17:26.475523949 CET | 49987 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:17:26.475537062 CET | 49987 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:17:26.475564003 CET | 49987 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:17:26.476263046 CET | 49987 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:17:26.476277113 CET | 443 | 49987 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:17:36.499406099 CET | 49988 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:17:36.499525070 CET | 443 | 49988 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:17:36.499778986 CET | 49988 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:17:36.499871016 CET | 49988 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:17:36.499891996 CET | 443 | 49988 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:17:37.157987118 CET | 443 | 49988 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:17:37.158257961 CET | 49988 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:17:37.161149025 CET | 49988 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:17:37.161180973 CET | 443 | 49988 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:17:37.161305904 CET | 49988 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:17:37.161320925 CET | 443 | 49988 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:17:37.646089077 CET | 443 | 49988 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:17:37.646178007 CET | 49988 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:17:37.646228075 CET | 443 | 49988 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:17:37.646289110 CET | 49988 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:17:37.646337032 CET | 49988 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:17:37.646392107 CET | 443 | 49988 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:17:37.646441936 CET | 443 | 49988 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:17:37.646471977 CET | 49988 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:17:37.646509886 CET | 49988 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:17:37.661941051 CET | 49989 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:17:37.661983013 CET | 443 | 49989 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:17:37.662058115 CET | 49989 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:17:37.662282944 CET | 49989 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:17:37.662298918 CET | 443 | 49989 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:17:38.321058035 CET | 443 | 49989 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:17:38.321132898 CET | 49989 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:17:38.344396114 CET | 49989 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:17:38.344405890 CET | 443 | 49989 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:17:38.344547033 CET | 49989 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:17:38.344553947 CET | 443 | 49989 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:17:38.732800961 CET | 443 | 49989 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:17:38.732950926 CET | 49989 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:17:38.732970953 CET | 443 | 49989 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:17:38.732992887 CET | 443 | 49989 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:17:38.733020067 CET | 49989 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:17:38.733028889 CET | 443 | 49989 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:17:38.733041048 CET | 49989 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:17:38.733088970 CET | 49989 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:17:38.733094931 CET | 443 | 49989 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:17:38.733150959 CET | 443 | 49989 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:17:38.733155966 CET | 49989 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:17:38.733203888 CET | 49989 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:17:38.733632088 CET | 49989 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:17:38.733648062 CET | 443 | 49989 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:17:38.733658075 CET | 49989 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:17:38.733696938 CET | 49989 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:17:48.764477015 CET | 49990 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:17:48.764573097 CET | 443 | 49990 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:17:48.764688015 CET | 49990 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:17:48.764918089 CET | 49990 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:17:48.764941931 CET | 443 | 49990 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:17:49.397126913 CET | 443 | 49990 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:17:49.397258997 CET | 49990 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:17:49.397732973 CET | 49990 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:17:49.397741079 CET | 443 | 49990 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:17:49.397891045 CET | 49990 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:17:49.397896051 CET | 443 | 49990 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:17:49.782810926 CET | 443 | 49990 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:17:49.782886028 CET | 443 | 49990 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:17:49.782900095 CET | 49990 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:17:49.782949924 CET | 49990 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:17:49.796216011 CET | 49990 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:17:49.796233892 CET | 443 | 49990 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:17:49.880556107 CET | 49991 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:17:49.880609035 CET | 443 | 49991 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:17:49.880714893 CET | 49991 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:17:49.881050110 CET | 49991 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:17:49.881062984 CET | 443 | 49991 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:17:50.529814959 CET | 443 | 49991 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:17:50.529897928 CET | 49991 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:17:50.530338049 CET | 49991 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:17:50.530345917 CET | 443 | 49991 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:17:50.530473948 CET | 49991 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:17:50.530483961 CET | 443 | 49991 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:17:50.942326069 CET | 443 | 49991 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:17:50.942393064 CET | 443 | 49991 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:17:50.942461014 CET | 443 | 49991 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:17:50.942459106 CET | 49991 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:17:50.942459106 CET | 49991 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:17:50.942528963 CET | 49991 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:17:50.943291903 CET | 49991 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:17:50.943320990 CET | 443 | 49991 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:18:00.967446089 CET | 49992 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:18:00.967519999 CET | 443 | 49992 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:18:00.967629910 CET | 49992 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:18:00.967844009 CET | 49992 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:18:00.967864037 CET | 443 | 49992 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:18:01.618403912 CET | 443 | 49992 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:18:01.618494987 CET | 49992 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:18:01.618971109 CET | 49992 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:18:01.618985891 CET | 443 | 49992 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:18:01.619239092 CET | 49992 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:18:01.619246006 CET | 443 | 49992 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:18:02.013448954 CET | 443 | 49992 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:18:02.013547897 CET | 49992 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:18:02.013591051 CET | 443 | 49992 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:18:02.013641119 CET | 49992 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:18:02.013649940 CET | 443 | 49992 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:18:02.013678074 CET | 443 | 49992 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:18:02.013695002 CET | 49992 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:18:02.013722897 CET | 49992 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:18:02.013792992 CET | 49992 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:18:02.013808966 CET | 443 | 49992 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:18:02.025403023 CET | 49993 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:18:02.025439978 CET | 443 | 49993 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:18:02.025506020 CET | 49993 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:18:02.025708914 CET | 49993 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:18:02.025718927 CET | 443 | 49993 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:18:02.652488947 CET | 443 | 49993 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:18:02.652544975 CET | 49993 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:18:02.652942896 CET | 49993 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:18:02.652951956 CET | 443 | 49993 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:18:02.653093100 CET | 49993 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:18:02.653098106 CET | 443 | 49993 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:18:03.057857990 CET | 443 | 49993 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:18:03.057924032 CET | 443 | 49993 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:18:03.057991028 CET | 443 | 49993 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:18:03.058036089 CET | 49993 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:18:03.058053017 CET | 49993 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:18:03.058182955 CET | 49993 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:18:03.058969021 CET | 49993 | 443 | 192.168.2.5 | 142.250.181.225 |
| Jan 11, 2025 03:18:03.058989048 CET | 443 | 49993 | 142.250.181.225 | 192.168.2.5 |
| Jan 11, 2025 03:18:13.077275991 CET | 49994 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:18:13.077331066 CET | 443 | 49994 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:18:13.077438116 CET | 49994 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:18:13.077781916 CET | 49994 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:18:13.077797890 CET | 443 | 49994 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:18:13.768066883 CET | 443 | 49994 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:18:13.768230915 CET | 49994 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:18:13.768933058 CET | 49994 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:18:13.768946886 CET | 443 | 49994 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:18:13.769094944 CET | 49994 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:18:13.769115925 CET | 443 | 49994 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:18:14.157228947 CET | 443 | 49994 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:18:14.157327890 CET | 49994 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:18:14.157366991 CET | 443 | 49994 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:18:14.157426119 CET | 49994 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:18:14.158299923 CET | 443 | 49994 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:18:14.158354998 CET | 49994 | 443 | 192.168.2.5 | 142.250.185.110 |
| Jan 11, 2025 03:18:14.158400059 CET | 443 | 49994 | 142.250.185.110 | 192.168.2.5 |
| Jan 11, 2025 03:18:14.158456087 CET | 49994 | 443 | 192.168.2.5 | 142.250.185.110 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Jan 11, 2025 03:16:23.211277008 CET | 55924 | 53 | 192.168.2.5 | 1.1.1.1 |
| Jan 11, 2025 03:16:23.217915058 CET | 53 | 55924 | 1.1.1.1 | 192.168.2.5 |
| Jan 11, 2025 03:16:24.580043077 CET | 52970 | 53 | 192.168.2.5 | 1.1.1.1 |
| Jan 11, 2025 03:16:24.587332010 CET | 53 | 52970 | 1.1.1.1 | 192.168.2.5 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Jan 11, 2025 03:16:23.211277008 CET | 192.168.2.5 | 1.1.1.1 | 0xa51b | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Jan 11, 2025 03:16:24.580043077 CET | 192.168.2.5 | 1.1.1.1 | 0xa649 | Standard query (0) | A (IP address) | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Jan 11, 2025 03:16:23.217915058 CET | 1.1.1.1 | 192.168.2.5 | 0xa51b | No error (0) | 142.250.185.110 | A (IP address) | IN (0x0001) | false | ||
| Jan 11, 2025 03:16:24.587332010 CET | 1.1.1.1 | 192.168.2.5 | 0xa649 | No error (0) | 142.250.181.225 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.5 | 49975 | 142.250.185.110 | 443 | 6968 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-11 02:16:24 UTC | 216 | OUT | |
| 2025-01-11 02:16:24 UTC | 1920 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.5 | 49976 | 142.250.181.225 | 443 | 6968 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-11 02:16:25 UTC | 258 | OUT | |
| 2025-01-11 02:16:25 UTC | 2219 | IN | |
| 2025-01-11 02:16:25 UTC | 1652 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 2 | 192.168.2.5 | 49978 | 142.250.185.110 | 443 | 6968 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-11 02:16:36 UTC | 418 | OUT | |
| 2025-01-11 02:16:36 UTC | 1920 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 3 | 192.168.2.5 | 49979 | 142.250.181.225 | 443 | 6968 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-11 02:16:37 UTC | 460 | OUT | |
| 2025-01-11 02:16:37 UTC | 1844 | IN | |
| 2025-01-11 02:16:37 UTC | 1652 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 4 | 192.168.2.5 | 49980 | 142.250.185.110 | 443 | 6968 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-11 02:16:48 UTC | 418 | OUT | |
| 2025-01-11 02:16:48 UTC | 1920 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 5 | 192.168.2.5 | 49981 | 142.250.181.225 | 443 | 6968 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-11 02:16:49 UTC | 460 | OUT | |
| 2025-01-11 02:16:50 UTC | 1851 | IN | |
| 2025-01-11 02:16:50 UTC | 1652 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 6 | 192.168.2.5 | 49982 | 142.250.185.110 | 443 | 6968 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-11 02:17:00 UTC | 418 | OUT | |
| 2025-01-11 02:17:01 UTC | 1920 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 7 | 192.168.2.5 | 49983 | 142.250.181.225 | 443 | 6968 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-11 02:17:01 UTC | 460 | OUT | |
| 2025-01-11 02:17:02 UTC | 1844 | IN | |
| 2025-01-11 02:17:02 UTC | 1652 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 8 | 192.168.2.5 | 49984 | 142.250.185.110 | 443 | 6968 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-11 02:17:12 UTC | 418 | OUT | |
| 2025-01-11 02:17:13 UTC | 1920 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 9 | 192.168.2.5 | 49985 | 142.250.181.225 | 443 | 6968 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-11 02:17:13 UTC | 460 | OUT | |
| 2025-01-11 02:17:14 UTC | 1851 | IN | |
| 2025-01-11 02:17:14 UTC | 1652 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 10 | 192.168.2.5 | 49986 | 142.250.185.110 | 443 | 6968 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-11 02:17:25 UTC | 418 | OUT | |
| 2025-01-11 02:17:25 UTC | 1920 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 11 | 192.168.2.5 | 49987 | 142.250.181.225 | 443 | 6968 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-11 02:17:26 UTC | 460 | OUT | |
| 2025-01-11 02:17:26 UTC | 1844 | IN | |
| 2025-01-11 02:17:26 UTC | 1652 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 12 | 192.168.2.5 | 49988 | 142.250.185.110 | 443 | 6968 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-11 02:17:37 UTC | 418 | OUT | |
| 2025-01-11 02:17:37 UTC | 1920 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 13 | 192.168.2.5 | 49989 | 142.250.181.225 | 443 | 6968 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-11 02:17:38 UTC | 460 | OUT | |
| 2025-01-11 02:17:38 UTC | 1851 | IN | |
| 2025-01-11 02:17:38 UTC | 1652 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 14 | 192.168.2.5 | 49990 | 142.250.185.110 | 443 | 6968 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-11 02:17:49 UTC | 418 | OUT | |
| 2025-01-11 02:17:49 UTC | 1920 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 15 | 192.168.2.5 | 49991 | 142.250.181.225 | 443 | 6968 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-11 02:17:50 UTC | 460 | OUT | |
| 2025-01-11 02:17:50 UTC | 1844 | IN | |
| 2025-01-11 02:17:50 UTC | 1652 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 16 | 192.168.2.5 | 49992 | 142.250.185.110 | 443 | 6968 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-11 02:18:01 UTC | 418 | OUT | |
| 2025-01-11 02:18:02 UTC | 1920 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 17 | 192.168.2.5 | 49993 | 142.250.181.225 | 443 | 6968 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-11 02:18:02 UTC | 460 | OUT | |
| 2025-01-11 02:18:03 UTC | 1844 | IN | |
| 2025-01-11 02:18:03 UTC | 1652 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 18 | 192.168.2.5 | 49994 | 142.250.185.110 | 443 | 6968 | C:\Windows\SysWOW64\msiexec.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-11 02:18:13 UTC | 418 | OUT | |
| 2025-01-11 02:18:14 UTC | 1920 | IN |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
| Target ID: | 0 |
| Start time: | 21:15:07 |
| Start date: | 10/01/2025 |
| Path: | C:\Users\user\Desktop\ro7eoySJ9q.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x400000 |
| File size: | 1'060'792 bytes |
| MD5 hash: | 69C59075BC9FFD11BF75080CFE44F29E |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | low |
| Has exited: | true |
| Target ID: | 2 |
| Start time: | 21:15:12 |
| Start date: | 10/01/2025 |
| Path: | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x9a0000 |
| File size: | 433'152 bytes |
| MD5 hash: | C32CA4ACFCC635EC1EA6ED8A34DF5FAC |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Reputation: | high |
| Has exited: | true |
| Target ID: | 3 |
| Start time: | 21:15:12 |
| Start date: | 10/01/2025 |
| Path: | C:\Windows\System32\conhost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff6d64d0000 |
| File size: | 862'208 bytes |
| MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 6 |
| Start time: | 21:16:08 |
| Start date: | 10/01/2025 |
| Path: | C:\Windows\SysWOW64\msiexec.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x7ff6068e0000 |
| File size: | 59'904 bytes |
| MD5 hash: | 9D09DC1EDA745A5F87553048E57620CF |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Reputation: | high |
| Has exited: | false |
Execution Graph
| Execution Coverage: | 22.3% |
| Dynamic/Decrypted Code Coverage: | 0% |
| Signature Coverage: | 21.7% |
| Total number of Nodes: | 1267 |
| Total number of Limit Nodes: | 30 |
Graph
Function 004031DD Relevance: 75.6, APIs: 27, Strings: 16, Instructions: 335stringfilecomCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405139 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282windowclipboardmemoryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405D68 Relevance: 23.0, APIs: 8, Strings: 5, Instructions: 207stringCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004055D5 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 159filestringCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00406089 Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040371A Relevance: 51.0, APIs: 15, Strings: 14, Instructions: 216stringregistrylibraryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401752 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145stringtimeCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00402F38 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 175fileCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404FFA Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72stringwindowCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405C13 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45registryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004054C8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401F08 Relevance: 3.1, APIs: 2, Instructions: 55memoryCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004050CD Relevance: 3.0, APIs: 2, Instructions: 32comCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004059CF Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004059AA Relevance: 3.0, APIs: 2, Instructions: 13COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00402251 Relevance: 1.5, APIs: 1, Instructions: 25COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00403160 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00402293 Relevance: 1.5, APIs: 1, Instructions: 20COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040159B Relevance: 1.5, APIs: 1, Instructions: 18COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00403FE1 Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00403FCA Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00403192 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00403FB7 Relevance: 1.5, APIs: 1, Instructions: 4COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404976 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404430 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 269stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00402706 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004064EC Relevance: .3, Instructions: 334COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404132 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 207windowstringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405A52 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 141filestringmemoryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004024EC Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 54filestringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00403FFC Relevance: 12.1, APIs: 8, Instructions: 61COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004048C4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00402C15 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00402571 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 105fileCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040232F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71registrystringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401CE5 Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004047DE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78stringCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401BCA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401F98 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73libraryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004057AE Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00402C9B Relevance: 6.0, APIs: 4, Instructions: 33COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404F6E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004057FA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405934 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Execution Graph
| Execution Coverage: | 6.1% |
| Dynamic/Decrypted Code Coverage: | 0% |
| Signature Coverage: | 0% |
| Total number of Nodes: | 3 |
| Total number of Limit Nodes: | 0 |
Graph
Function 008CF520 Relevance: .1, Instructions: 76COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 06F8C0EF Relevance: 14.7, Strings: 11, Instructions: 994COMMON
Download Yara Rule
Control-flow Graph
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 06F87E20 Relevance: 10.4, Strings: 8, Instructions: 373COMMON
Download Yara Rule
Control-flow Graph
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 06F87E01 Relevance: 6.6, Strings: 5, Instructions: 301COMMON
Download Yara Rule
Control-flow Graph
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 06F86478 Relevance: 5.7, Strings: 4, Instructions: 711COMMON
Download Yara Rule
Control-flow Graph
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 06F8CAC1 Relevance: 5.4, Strings: 4, Instructions: 425COMMON
Download Yara Rule
Control-flow Graph
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 06F8CAAB Relevance: 5.3, Strings: 4, Instructions: 331COMMON
Download Yara Rule
Control-flow Graph
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 06F86F0A Relevance: 4.4, Strings: 3, Instructions: 647COMMON
Download Yara Rule
Control-flow Graph
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 06F86477 Relevance: 4.4, Strings: 3, Instructions: 630COMMON
Download Yara Rule
Control-flow Graph
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 06F8C93B Relevance: 4.4, Strings: 3, Instructions: 621COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 06F87026 Relevance: 4.2, Strings: 3, Instructions: 483COMMON
Download Yara Rule
Control-flow Graph
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 06F8CA2D Relevance: 4.2, Strings: 3, Instructions: 466COMMON
Download Yara Rule
Control-flow Graph
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 06F856C6 Relevance: 4.1, Strings: 3, Instructions: 391COMMON
Download Yara Rule
Control-flow Graph
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 06F83E00 Relevance: 3.9, Strings: 3, Instructions: 124COMMON
Download Yara Rule
Control-flow Graph
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 06F84420 Relevance: 3.8, Strings: 3, Instructions: 94COMMON
Download Yara Rule
Control-flow Graph
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 06E1D96B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 51threadCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 06E1D970 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 48threadCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 06F872B8 Relevance: 3.0, Strings: 2, Instructions: 544COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 06F8440D Relevance: 2.6, Strings: 2, Instructions: 76COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 06F83DFF Relevance: 2.6, Strings: 2, Instructions: 63COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 06F882C0 Relevance: 1.4, Strings: 1, Instructions: 102COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 06F84548 Relevance: .4, Instructions: 382COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 06F872B7 Relevance: .4, Instructions: 380COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 06F8452C Relevance: .3, Instructions: 345COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 040A72A8 Relevance: .3, Instructions: 313COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 040A2AA0 Relevance: .2, Instructions: 218COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 040A7A70 Relevance: .2, Instructions: 191COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 040A7BDE Relevance: .2, Instructions: 188COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 040AFB71 Relevance: .1, Instructions: 149COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 040A7801 Relevance: .1, Instructions: 120COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 040AFBA0 Relevance: .1, Instructions: 119COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 040A7A5B Relevance: .1, Instructions: 117COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 040A2BB0 Relevance: .1, Instructions: 107COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 06F8214C Relevance: .1, Instructions: 101COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 06F88794 Relevance: .1, Instructions: 98COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 008CF51B Relevance: .1, Instructions: 57COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 008CD01D Relevance: .0, Instructions: 45COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 008CD01C Relevance: .0, Instructions: 36COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 06F84B85 Relevance: .0, Instructions: 26COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 040AFD45 Relevance: .0, Instructions: 21COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 040AFD57 Relevance: .0, Instructions: 17COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 040AFD58 Relevance: .0, Instructions: 16COMMON
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 06F8E3E8 Relevance: 22.9, Strings: 18, Instructions: 384COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 06F8E900 Relevance: 19.1, Strings: 15, Instructions: 311COMMON
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 06F8A4B0 Relevance: 15.5, Strings: 12, Instructions: 498COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 06F8E088 Relevance: 14.0, Strings: 11, Instructions: 241COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 06F8E8FF Relevance: 11.4, Strings: 9, Instructions: 197COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 06F8F3A5 Relevance: 10.2, Strings: 8, Instructions: 194COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 06F8E59D Relevance: 10.2, Strings: 8, Instructions: 161COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 040AAFD8 Relevance: 9.2, Strings: 7, Instructions: 456COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 06F8E068 Relevance: 8.9, Strings: 7, Instructions: 163COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 06F80AE8 Relevance: 8.9, Strings: 7, Instructions: 126COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 06F8B7B6 Relevance: 7.9, Strings: 6, Instructions: 403COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 06F82790 Relevance: 7.7, Strings: 6, Instructions: 230COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 06F8AB04 Relevance: 7.6, Strings: 6, Instructions: 100COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 06F8E1AE Relevance: 7.6, Strings: 6, Instructions: 85COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 06F8ED10 Relevance: 6.5, Strings: 5, Instructions: 218COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 06F8D6C0 Relevance: 6.4, Strings: 5, Instructions: 153COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 06F80538 Relevance: 6.4, Strings: 5, Instructions: 149COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 06F854C8 Relevance: 6.4, Strings: 5, Instructions: 130COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 06F8A730 Relevance: 6.4, Strings: 5, Instructions: 108COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 06F81598 Relevance: 6.3, Strings: 5, Instructions: 71COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 040AE6A8 Relevance: 5.5, Strings: 4, Instructions: 470COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 06F87B60 Relevance: 5.2, Strings: 4, Instructions: 192COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 06F85D90 Relevance: 5.2, Strings: 4, Instructions: 188COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 040AEC2D Relevance: 5.1, Strings: 4, Instructions: 144COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 06F89840 Relevance: 5.1, Strings: 4, Instructions: 133COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 06F836A0 Relevance: 5.1, Strings: 4, Instructions: 94COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 06F8AB40 Relevance: 5.1, Strings: 4, Instructions: 73COMMON
Download Yara Rule
| Strings |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|