Edit tour
Windows
Analysis Report
63416c4d.exe
Overview
General Information
Detection
Babuk, Cerber, DeriaLock, InfinityLock, Mimikatz, RedLine
Score: | 100 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Yara detected RedLine Stealer
Detected unpacking (overwrites its own PE header)
Yara detected DeriaLock Ransomware
Yara detected Babuk Ransomware
System process connects to network (likely due to code injection or exploit)
Sigma detected: Execute DLL with spoofed extension
Detected unpacking (changes PE section rights)
Antivirus detection for URL or domain
Antivirus detection for dropped file
Detected unpacking (creates a PE file in dynamic memory)
Snort IDS alert for network traffic
Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Yara detected Cerber ransomware
Antivirus / Scanner detection for submitted sample
Yara detected Mimikatz
Multi AV Scanner detection for dropped file
Yara detected InfinityLock Ransomware
Creates multiple autostart registry keys
Uses netsh to modify the Windows network and firewall settings
Tries to detect sandboxes and other dynamic analysis tools (window names)
Found Tor onion address
Deletes keys related to Windows Defender
PE file has a writeable .text section
Deletes keys which are related to windows safe boot (disables safe mode boot)
Clears the journal log
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Machine Learning detection for sample
Clears the windows event log
Writes many files with high entropy
Connects to many different private IPs (likely to spread or exploit)
Disables security and backup related services
Tries to detect virtualization through RDTSC time measurements
Disables the windows security center
Disables the Windows registry editor (regedit)
Drops executables to the windows directory (C:\Windows) and starts them
Uses schtasks.exe or at.exe to add and modify task schedules
Contains functionality to create processes via WMI
Opens network shares
Disables Windows system restore
Changes security center settings (notifications, updates, antivirus, firewall)
Disables the Windows task manager (taskmgr)
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
PE file has nameless sections
Creates an undocumented autostart registry key
Machine Learning detection for dropped file
Modifies the windows firewall
Connects to many different private IPs via SMB (likely to spread or exploit)
Antivirus or Machine Learning detection for unpacked file
Deletes Internet Explorer cookies via registry
Contains functionality to query locales information (e.g. system language)
May sleep (evasive loops) to hinder dynamic analysis
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
Stores files to the Windows start menu directory
Contains functionality to dynamically determine API calls
HTTP GET or POST without a user agent
Downloads executable code via HTTP
Contains long sleeps (>= 3 min)
Drops PE files
Tries to load missing DLLs
Uses a known web browser user agent for HTTP communication
Drops PE files to the windows directory (C:\Windows)
Checks if the current process is being debugged
Checks for available system drives (often done to infect USB drives)
Creates a process in suspended mode (likely to inject code)
Changes the start page of internet explorer
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Deletes files inside the Windows folder
Creates files inside the system directory
PE file contains sections with non-standard names
Contains functionality to call native functions
Found dropped PE file which has not been started or loaded
Contains functionality which may be used to detect a debugger (GetProcessHeap)
PE file contains executable resources (Code or Archives)
Changes the window title of internet explorer
Enables debug privileges
Is looking for software installed on the system
Queries information about the installed CPU (vendor, model number etc)
AV process strings found (often used to terminate AV products)
PE file does not import any functions
Sample file is different than original file name gathered from version info
Uses net.exe to stop services
PE file contains an invalid checksum
Allocates memory with a write watch (potentially for evading sandboxes)
File is packed with WinRar
Detected TCP or UDP traffic on non-standard ports
Potential key logger detected (key state polling based)
Enables security privileges
Uses taskkill to terminate processes
Found evaded block containing many API calls
Creates or modifies windows services
Queries disk information (often used to detect virtual machines)
Classification
- System is w10x64
- 63416c4d.exe (PID: 1308 cmdline:
"C:\Users\ user\Deskt op\63416c4 d.exe" MD5: 179E9C53D04C3B66D135BC6BD4480B75) - 63416c4d.exe (PID: 5576 cmdline:
"C:\Users\ user\Deskt op\63416c4 d.exe" MD5: 179E9C53D04C3B66D135BC6BD4480B75) - Endermanch@Antivirus.exe (PID: 508 cmdline:
"C:\Users\ user\Deskt op\Enderma nch@Antivi rus.exe" MD5: C7E9746B1B039B8BD1106BCA3038C38F) - net.exe (PID: 1248 cmdline:
net stop w scsvc MD5: DD0561156F62BC1958CE0E370B23711B) - Endermanch@AntivirusPlatinum.exe (PID: 3384 cmdline:
"C:\Users\ user\Deskt op\Enderma nch@Antivi rusPlatinu m.exe" MD5: 382430DD7EAE8945921B7FEAB37ED36B) - 302746537.exe (PID: 5020 cmdline:
"C:\WINDOW S\30274653 7.exe" MD5: 8703FF2E53C6FD3BC91294EF9204BACA) - cmd.exe (PID: 2220 cmdline:
C:\Windows \system32\ cmd.exe /c ""C:\User s\user\App Data\Local \Temp\4792 .tmp\30274 6537.bat" " MD5: F3BDBE3BB6F734E357235F4D5898582D) - conhost.exe (PID: 3476 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496) - regsvr32.exe (PID: 2748 cmdline:
regsvr32 / s c:\windo ws\comctl3 2.ocx MD5: 426E7499F6A7346F0410DEAD0805586B) - regsvr32.exe (PID: 5868 cmdline:
regsvr32 / s c:\windo ws\mscomct l.ocx MD5: 426E7499F6A7346F0410DEAD0805586B) - antivirus-platinum.exe (PID: 3564 cmdline:
c:\windows \antivirus -platinum. exe MD5: CD1800322CCFC425014A8394B01A4B3D) - attrib.exe (PID: 3396 cmdline:
attrib +h c:\windows \antivirus -platinum. exe MD5: A5540E9F87D4CB083BDF8269DEC1CFF9) - Endermanch@AntivirusPro2017.exe (PID: 5396 cmdline:
"C:\Users\ user\Deskt op\Enderma nch@Antivi rusPro2017 .exe" MD5: 7DFBFBA1E4E64A946CB096BFC937FBAD) - Endermanch@AnViPC2009.exe (PID: 2344 cmdline:
"C:\Users\ user\Deskt op\Enderma nch@AnViPC 2009.exe" MD5: 910DD666C83EFD3496F21F9F211CDC1F) - avpc2009.exe (PID: 5488 cmdline:
"C:\Progra m Files (x 86)\antivi ruspc2009\ avpc2009.e xe" MD5: C18A7323332B3292A8E0F1C81DF65698) - Endermanch@BadRabbit.exe (PID: 4812 cmdline:
"C:\Users\ user\Deskt op\Enderma nch@BadRab bit.exe" MD5: FBBDC39AF1139AEBBA4DA004475E8839) - conhost.exe (PID: 5144 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496) - rundll32.exe (PID: 2032 cmdline:
C:\Windows \system32\ rundll32.e xe C:\Wind ows\infpub .dat,#1 15 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D) - cmd.exe (PID: 492 cmdline:
/c schtask s /Delete /F /TN rha egal MD5: F3BDBE3BB6F734E357235F4D5898582D) - conhost.exe (PID: 3780 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496) - schtasks.exe (PID: 4880 cmdline:
schtasks / Delete /F /TN rhaega l MD5: 15FF7D8324231381BAD48A052F85DF04) - cmd.exe (PID: 5692 cmdline:
/c schtask s /Create /RU SYSTEM /SC ONSTA RT /TN rha egal /TR " C:\Windows \system32\ cmd.exe /C Start \"\ " \"C:\Win dows\dispc i.exe\" -i d 37876731 05 && exit " MD5: F3BDBE3BB6F734E357235F4D5898582D) - conhost.exe (PID: 5788 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496) - schtasks.exe (PID: 6064 cmdline:
schtasks / Create /RU SYSTEM /S C ONSTART /TN rhaega l /TR "C:\ Windows\sy stem32\cmd .exe /C St art \"\" \ "C:\Window s\dispci.e xe\" -id 3 787673105 && exit" MD5: 15FF7D8324231381BAD48A052F85DF04) - cmd.exe (PID: 6132 cmdline:
/c schtask s /Create /SC once / TN drogon /RU SYSTEM /TR "C:\W indows\sys tem32\shut down.exe / r /t 0 /f" /ST 15:11 :00 MD5: F3BDBE3BB6F734E357235F4D5898582D) - conhost.exe (PID: 5244 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496) - schtasks.exe (PID: 5512 cmdline:
schtasks / Create /SC once /TN drogon /RU SYSTEM /T R "C:\Wind ows\system 32\shutdow n.exe /r / t 0 /f" /S T 15:11:00 MD5: 15FF7D8324231381BAD48A052F85DF04) - 97B6.tmp (PID: 5328 cmdline:
"C:\Window s\97B6.tmp " \\.\pipe \{4D5863FE -4A03-4434 -BE8D-DD8F 955E9431} MD5: 347AC3B6B791054DE3E5720A7144A977) - conhost.exe (PID: 3620 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496) - cmd.exe (PID: 4104 cmdline:
/c wevtuti l cl Setup & wevtuti l cl Syste m & wevtut il cl Secu rity & wev tutil cl A pplication & fsutil usn delete journal /D C: MD5: F3BDBE3BB6F734E357235F4D5898582D) - conhost.exe (PID: 4808 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496) - wevtutil.exe (PID: 3952 cmdline:
wevtutil c l Setup MD5: 27C3944EC1E3CAD62641ECBCEB107EE9) - cmd.exe (PID: 3424 cmdline:
/c schtask s /Delete /F /TN dro gon MD5: F3BDBE3BB6F734E357235F4D5898582D) - Endermanch@Birele.exe (PID: 5180 cmdline:
"C:\Users\ user\Deskt op\Enderma nch@Birele .exe" MD5: 41789C704A0EECFDD0048B4B4193E752) - taskkill.exe (PID: 3668 cmdline:
taskkill / F /IM expl orer.exe MD5: 15E2E0ACD891510C6268CB8899F2A1A1) - conhost.exe (PID: 4084 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496) - Endermanch@Cerber5.exe (PID: 1300 cmdline:
"C:\Users\ user\Deskt op\Enderma nch@Cerber 5.exe" MD5: FE1BC60A95B2C2D77CD5D232296A7FA4) - netsh.exe (PID: 5652 cmdline:
C:\Windows \system32\ netsh.exe advfirewal l set allp rofiles st ate on MD5: A0AA3322BB46BBFC36AB9DC1DBBBB807) - conhost.exe (PID: 5668 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496) - netsh.exe (PID: 6104 cmdline:
C:\Windows \system32\ netsh.exe advfirewal l reset MD5: A0AA3322BB46BBFC36AB9DC1DBBBB807) - conhost.exe (PID: 5504 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496) - Endermanch@DeriaLock.exe (PID: 628 cmdline:
"C:\Users\ user\Deskt op\Enderma nch@DeriaL ock.exe" MD5: 0A7B70EFBA0AA93D4BC0857B87AC2FCB) - Endermanch@FakeAdwCleaner.exe (PID: 3872 cmdline:
"C:\Users\ user\Deskt op\Enderma nch@FakeAd wCleaner.e xe" MD5: 248AADD395FFA7FFB1670392A9398454) - 6AdwCleaner.exe (PID: 3512 cmdline:
"C:\Users\ user\AppDa ta\Local\6 AdwCleaner .exe" MD5: 87E4959FEFEC297EBBF42DE79B5C88F6) - Endermanch@HappyAntivirus.exe (PID: 5768 cmdline:
"C:\Users\ user\Deskt op\Enderma nch@HappyA ntivirus.e xe" MD5: CB02C0438F3F4DDABCE36F8A26B0B961) - Endermanch@InfinityCrypt.exe (PID: 3472 cmdline:
"C:\Users\ user\Deskt op\Enderma nch@Infini tyCrypt.ex e" MD5: B805DB8F6A84475EF76B795B0D1ED6AE) - Endermanch@InternetSecurityGuard.exe (PID: 4992 cmdline:
"C:\Users\ user\Deskt op\Enderma nch@Intern etSecurity Guard.exe" MD5: 04155ED507699B4E37532E8371192C0B)
- svchost.exe (PID: 4664 cmdline:
C:\Windows \System32\ svchost.ex e -k Local SystemNetw orkRestric ted -p -s NcbService MD5: 32569E403279B3FD2EDB7EBD036273FA)
- svchost.exe (PID: 5192 cmdline:
c:\windows \system32\ svchost.ex e -k local service -p -s CDPSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)
- svchost.exe (PID: 5428 cmdline:
c:\windows \system32\ svchost.ex e -k netwo rkservice -p -s DoSv c MD5: 32569E403279B3FD2EDB7EBD036273FA)
- svchost.exe (PID: 3084 cmdline:
c:\windows \system32\ svchost.ex e -k unist acksvcgrou p MD5: 32569E403279B3FD2EDB7EBD036273FA)
- svchost.exe (PID: 3956 cmdline:
C:\Windows \System32\ svchost.ex e -k Netwo rkService -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
- SgrmBroker.exe (PID: 2596 cmdline:
C:\Windows \system32\ SgrmBroker .exe MD5: D3170A3F3A9626597EEE1888686E3EA6)
- svchost.exe (PID: 1420 cmdline:
c:\windows \system32\ svchost.ex e -k netsv cs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
- svchost.exe (PID: 240 cmdline:
c:\windows \system32\ svchost.ex e -k wusvc s -p -s Wa aSMedicSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)
- svchost.exe (PID: 2788 cmdline:
c:\windows \system32\ svchost.ex e -k local servicenet workrestri cted -p -s wscsvc MD5: 32569E403279B3FD2EDB7EBD036273FA) - MpCmdRun.exe (PID: 3404 cmdline:
"C:\Progra m Files\Wi ndows Defe nder\mpcmd run.exe" - wdenable MD5: A267555174BFA53844371226F482B86B) - conhost.exe (PID: 1020 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
- cmd.exe (PID: 2812 cmdline:
C:\Windows \system32\ cmd.exe /C Start "" "C:\Window s\dispci.e xe" -id 37 87673105 & & exit MD5: 4E2ACF4F8A396486AB4268C94A6A245F) - conhost.exe (PID: 3360 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
- cleanup
⊘No configs have been found
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
BadRabbit_Gen | Detects BadRabbit Ransomware | Florian Roth |
| |
sig_8ebc97e05c8e1073bda2efb6f4d00ad7e789260afa2c276f0c72740b838a0a93 | Bad Rabbit Ransomware | Christiaan Beek |
| |
cerber3 | Cerber3 | pekeinfo |
| |
JoeSecurity_infinitylock | Yara detected InfinityLock Ransomware | Joe Security | ||
MALWARE_Win_InfinityLock | Detects InfinityLock ransomware | ditekSHen |
| |
Click to see the 11 entries |
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_infinitylock | Yara detected InfinityLock Ransomware | Joe Security | ||
mimikatz | mimikatz | Benjamin DELPY (gentilkiwi) |
| |
JoeSecurity_DeriaLock | Yara detected DeriaLock Ransomware | Joe Security | ||
cerber3 | Cerber3 | pekeinfo |
| |
sig_8ebc97e05c8e1073bda2efb6f4d00ad7e789260afa2c276f0c72740b838a0a93 | Bad Rabbit Ransomware | Christiaan Beek |
| |
Click to see the 16 entries |
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
Cerber | Cerber Payload | kevoreilly |
| |
cerber3 | Cerber3 | pekeinfo |
| |
BadRabbit_Gen | Detects BadRabbit Ransomware | Florian Roth |
| |
INDICATOR_TOOL_ENC_DiskCryptor | Detect DiskCryptor open encryption solution that offers encryption of all disk partitions | ditekSHen |
| |
Cerber | Cerber Payload | kevoreilly |
| |
Click to see the 46 entries |
Data Obfuscation |
---|
Source: | Author: Joe Security: |
Timestamp: | 192.168.2.793.107.12.05828468932023626 09/29/22-14:53:29.957727 |
SID: | 2023626 |
Source Port: | 58284 |
Destination Port: | 6893 |
Protocol: | UDP |
Classtype: | A Network Trojan was detected |
Timestamp: | 192.168.2.7185.53.177.5349796802809804 09/29/22-14:53:34.107091 |
SID: | 2809804 |
Source Port: | 49796 |
Destination Port: | 80 |
Protocol: | TCP |
Classtype: | A Network Trojan was detected |
Click to jump to signature section
Show All Signature Results
AV Detection |
---|
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: |
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: |
Source: | ReversingLabs: | |||
Source: | Virustotal: | Perma Link | ||
Source: | Metadefender: | Perma Link |
Source: | Avira: |
Source: | ReversingLabs: | |||
Source: | Metadefender: | Perma Link | ||
Source: | ReversingLabs: | |||
Source: | Metadefender: | Perma Link | ||
Source: | ReversingLabs: | |||
Source: | Metadefender: | Perma Link | ||
Source: | ReversingLabs: | |||
Source: | Metadefender: | Perma Link | ||
Source: | ReversingLabs: | |||
Source: | Metadefender: | Perma Link | ||
Source: | ReversingLabs: | |||
Source: | Metadefender: | Perma Link | ||
Source: | ReversingLabs: | |||
Source: | Metadefender: | Perma Link | ||
Source: | ReversingLabs: | |||
Source: | Metadefender: | Perma Link | ||
Source: | ReversingLabs: | |||
Source: | Metadefender: | Perma Link | ||
Source: | ReversingLabs: | |||
Source: | Metadefender: | Perma Link | ||
Source: | ReversingLabs: | |||
Source: | Metadefender: | Perma Link | ||
Source: | ReversingLabs: | |||
Source: | Metadefender: | Perma Link | ||
Source: | ReversingLabs: | |||
Source: | Metadefender: | Perma Link | ||
Source: | ReversingLabs: | |||
Source: | Metadefender: | Perma Link | ||
Source: | ReversingLabs: | |||
Source: | Metadefender: | Perma Link | ||
Source: | Metadefender: | Perma Link | ||
Source: | ReversingLabs: | |||
Source: | ReversingLabs: | |||
Source: | Metadefender: | Perma Link | ||
Source: | ReversingLabs: | |||
Source: | Metadefender: | Perma Link | ||
Source: | ReversingLabs: | |||
Source: | Metadefender: | Perma Link | ||
Source: | ReversingLabs: | |||
Source: | Metadefender: | Perma Link | ||
Source: | ReversingLabs: | |||
Source: | Metadefender: | Perma Link | ||
Source: | ReversingLabs: | |||
Source: | Metadefender: | Perma Link | ||
Source: | ReversingLabs: | |||
Source: | Metadefender: | Perma Link | ||
Source: | ReversingLabs: | |||
Source: | Metadefender: | Perma Link | ||
Source: | ReversingLabs: | |||
Source: | Metadefender: | Perma Link | ||
Source: | ReversingLabs: | |||
Source: | Metadefender: | Perma Link | ||
Source: | ReversingLabs: | |||
Source: | Metadefender: | Perma Link | ||
Source: | ReversingLabs: | |||
Source: | Metadefender: | Perma Link | ||
Source: | ReversingLabs: | |||
Source: | Metadefender: | Perma Link | ||
Source: | ReversingLabs: | |||
Source: | Metadefender: | Perma Link | ||
Source: | ReversingLabs: | |||
Source: | Metadefender: | Perma Link | ||
Source: | ReversingLabs: | |||
Source: | Metadefender: | Perma Link | ||
Source: | ReversingLabs: | |||
Source: | Metadefender: | Perma Link | ||
Source: | ReversingLabs: | |||
Source: | Metadefender: | Perma Link | ||
Source: | ReversingLabs: | |||
Source: | Metadefender: | Perma Link | ||
Source: | ReversingLabs: | |||
Source: | Metadefender: | Perma Link |
Source: | Joe Sandbox ML: |
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: |
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: |
Exploits |
---|
Source: | TCP traffic: | ||
Source: | TCP traffic: | ||
Source: | TCP traffic: | ||
Source: | TCP traffic: | ||
Source: | TCP traffic: |
Source: | TCP traffic: | ||
Source: | TCP traffic: | ||
Source: | TCP traffic: | ||
Source: | TCP traffic: | ||
Source: | TCP traffic: |
Compliance |
---|
Source: | Unpacked PE file: |
Source: | Unpacked PE file: |
Source: | Static PE information: |
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: |
Source: | Static PE information: |
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: |
Source: | File opened: | ||
Source: | File opened: | ||
Source: | File opened: | ||
Source: | File opened: | ||
Source: | File opened: | ||
Source: | File opened: | ||
Source: | File opened: | ||
Source: | File opened: | ||
Source: | File opened: | ||
Source: | File opened: | ||
Source: | File opened: | ||
Source: | File opened: | ||
Source: | File opened: | ||
Source: | File opened: | ||
Source: | File opened: | ||
Source: | File opened: | ||
Source: | File opened: | ||
Source: | File opened: | ||
Source: | File opened: | ||
Source: | File opened: | ||
Source: | File opened: | ||
Source: | File opened: | ||
Source: | File opened: | ||
Source: | File opened: | ||
Source: | File opened: |
Source: | Code function: | 12_2_00405C10 | |
Source: | Code function: | 12_2_0040AE97 | |
Source: | Code function: | 14_2_00405BD2 | |
Source: | Code function: | 14_2_0040AE70 |
Networking |
---|
Source: | Network Connect: | ||
Source: | Network Connect: | ||
Source: | Network Connect: | ||
Source: | Network Connect: | ||
Source: | Network Connect: | ||
Source: | Network Connect: | ||
Source: | Domain query: |
Source: | Snort IDS: | ||
Source: | Snort IDS: |
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: |
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: |
Source: | HTTP traffic detected: |