Windows
Analysis Report
Hesaphareketi-01.exe
Overview
General Information
Detection
Score: | 100 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Classification
- System is w10x64
- Hesaphareketi-01.exe (PID: 7632 cmdline:
"C:\Users\ user\Deskt op\Hesapha reketi-01. exe" MD5: 5F04BF05EEC447538A2C6C18A1AF5C9E) - RegSvcs.exe (PID: 7728 cmdline:
"C:\Users\ user\Deskt op\Hesapha reketi-01. exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)
- cleanup
Name | Description | Attribution | Blogpost URLs | Link |
---|---|---|---|---|
404 Keylogger, Snake Keylogger | Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram. | No Attribution |
{"Exfil Mode": "FTP", "Username": "chuks@lifechangerscare.com", "Password": "b4ST8!7!uFT9POP", "FTP Server": "ftp://ftp.lifechangerscare.com/"}
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_CredentialStealer | Yara detected Credential Stealer | Joe Security | ||
JoeSecurity_GenericDownloader_1 | Yara detected Generic Downloader | Joe Security | ||
JoeSecurity_VIPKeylogger | Yara detected VIP Keylogger | Joe Security | ||
JoeSecurity_TelegramRAT | Yara detected Telegram RAT | Joe Security | ||
Windows_Trojan_SnakeKeylogger_af3faa65 | unknown | unknown |
| |
Click to see the 16 entries |
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_CredentialStealer | Yara detected Credential Stealer | Joe Security | ||
JoeSecurity_VIPKeylogger | Yara detected VIP Keylogger | Joe Security | ||
JoeSecurity_TelegramRAT | Yara detected Telegram RAT | Joe Security | ||
Windows_Trojan_SnakeKeylogger_af3faa65 | unknown | unknown |
| |
MAL_Envrial_Jan18_1 | Detects Encrial credential stealer malware | Florian Roth |
| |
Click to see the 15 entries |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-10-03T09:11:28.596889+0200 | 2803305 | 3 | Unknown Traffic | 192.168.2.11 | 49707 | 188.114.97.3 | 443 | TCP |
2024-10-03T09:11:29.894890+0200 | 2803305 | 3 | Unknown Traffic | 192.168.2.11 | 49709 | 188.114.97.3 | 443 | TCP |
2024-10-03T09:11:37.906213+0200 | 2803305 | 3 | Unknown Traffic | 192.168.2.11 | 49723 | 188.114.97.3 | 443 | TCP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-10-03T09:11:27.016520+0200 | 2803274 | 2 | Potentially Bad Traffic | 192.168.2.11 | 49705 | 132.226.247.73 | 80 | TCP |
2024-10-03T09:11:28.016584+0200 | 2803274 | 2 | Potentially Bad Traffic | 192.168.2.11 | 49705 | 132.226.247.73 | 80 | TCP |
2024-10-03T09:11:29.292858+0200 | 2803274 | 2 | Potentially Bad Traffic | 192.168.2.11 | 49708 | 132.226.247.73 | 80 | TCP |
Click to jump to signature section
AV Detection |
---|
Source: | URL Reputation: | ||
Source: | URL Reputation: |
Source: | Malware Configuration Extractor: |
Source: | Virustotal: | Perma Link | ||
Source: | ReversingLabs: |
Source: | Integrated Neural Analysis Model: |
Source: | Joe Sandbox ML: |
Location Tracking |
---|
Source: | DNS query: |
Source: | Static PE information: |
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: |
Source: | HTTPS traffic detected: |
Source: | Binary string: | ||
Source: | Binary string: |
Source: | Code function: | 0_2_00452126 | |
Source: | Code function: | 0_2_0045C999 | |
Source: | Code function: | 0_2_00436ADE | |
Source: | Code function: | 0_2_00434BEE | |
Source: | Code function: | 0_2_0045DD7C | |
Source: | Code function: | 0_2_0044BD29 | |
Source: | Code function: | 0_2_00436D2D | |
Source: | Code function: | 0_2_00442E1F | |
Source: | Code function: | 0_2_00475FE5 | |
Source: | Code function: | 0_2_0044BF8D |
Source: | Code function: | 2_2_00ECF2C0 | |
Source: | Code function: | 2_2_00ECF4AC | |
Source: | Code function: | 2_2_00ECF961 | |
Source: | Code function: | 2_2_063C2DC8 | |
Source: | Code function: | 2_2_063C0B30 | |
Source: | Code function: | 2_2_063C0B30 | |
Source: | Code function: | 2_2_063C2968 | |
Source: | Code function: | 2_2_063CDE00 | |
Source: | Code function: | 2_2_063CE6B0 | |
Source: | Code function: | 2_2_063CEF60 | |
Source: | Code function: | 2_2_063CCCA0 | |
Source: | Code function: | 2_2_063CD550 | |
Source: | Code function: | 2_2_063C2DC2 | |
Source: | Code function: | 2_2_063CE258 | |
Source: | Code function: | 2_2_063CEB08 | |
Source: | Code function: | 2_2_063CF3B8 | |
Source: | Code function: | 2_2_063CF810 | |
Source: | Code function: | 2_2_063C0040 | |
Source: | Code function: | 2_2_063CD0F8 | |
Source: | Code function: | 2_2_063C310E | |
Source: | Code function: | 2_2_063CD9A8 |
Networking |
---|
Source: | DNS query: |
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: |
Source: | TCP traffic: |
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: |
Source: | IP Address: | ||
Source: | IP Address: | ||
Source: | IP Address: |
Source: | ASN Name: | ||
Source: | ASN Name: | ||
Source: | ASN Name: |
Source: | JA3 fingerprint: | ||
Source: | JA3 fingerprint: |
Source: | DNS query: | ||
Source: | DNS query: |
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: |
Source: | FTP traffic detected: |
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: |
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: |
Source: | UDP traffic detected without corresponding DNS query: | ||
Source: | UDP traffic detected without corresponding DNS query: | ||
Source: | UDP traffic detected without corresponding DNS query: | ||
Source: | UDP traffic detected without corresponding DNS query: |
Source: | Code function: | 0_2_0044289D |
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: |
Source: | DNS traffic detected: | ||
Source: | DNS traffic detected: | ||
Source: | DNS traffic detected: | ||
Source: | DNS traffic detected: |
Source: | HTTP traffic detected: |
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: |
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: |
Source: | HTTPS traffic detected: |
Source: | Code function: | 0_2_0046C5D0 |
Source: | Code function: | 0_2_00459FFF |
Source: | Code function: | 0_2_0046C5D0 |
Source: | Code function: | 0_2_00456354 |
Source: | Code function: | 0_2_0047C08E |
System Summary |
---|
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: |
Source: | Code function: | 0_2_00434D50 |
Source: | Code function: | 0_2_004461ED |
Source: | Code function: | 0_2_004364AA |
Source: | Code function: | 0_2_00409A40 | |
Source: | Code function: | 0_2_00412038 | |
Source: | Code function: | 0_2_00427161 | |
Source: | Code function: | 0_2_0047E1FA | |
Source: | Code function: | 0_2_004212BE | |
Source: | Code function: | 0_2_00443390 | |
Source: | Code function: | 0_2_00443391 | |
Source: | Code function: | 0_2_0041A46B | |
Source: | Code function: | 0_2_0041240C | |
Source: | Code function: | 0_2_00446566 | |
Source: | Code function: | 0_2_004045E0 | |
Source: | Code function: | 0_2_0041D750 | |
Source: | Code function: | 0_2_004037E0 | |
Source: | Code function: | 0_2_00427859 | |
Source: | Code function: | 0_2_00412818 | |
Source: | Code function: | 0_2_0040F890 | |
Source: | Code function: | 0_2_0042397B | |
Source: | Code function: | 0_2_00411B63 | |
Source: | Code function: | 0_2_0047CBF0 | |
Source: | Code function: | 0_2_0044EBBC | |
Source: | Code function: | 0_2_00412C38 | |
Source: | Code function: | 0_2_00490D70 | |
Source: | Code function: | 0_2_0044ED9A | |
Source: | Code function: | 0_2_00423EBF | |
Source: | Code function: | 0_2_00424F70 | |
Source: | Code function: | 0_2_0041AF0D | |
Source: | Code function: | 0_2_03F4BE60 | |
Source: | Code function: | 2_2_00ECA088 | |
Source: | Code function: | 2_2_00ECC1A8 | |
Source: | Code function: | 2_2_00ECD288 | |
Source: | Code function: | 2_2_00EC5380 | |
Source: | Code function: | 2_2_00ECC478 | |
Source: | Code function: | 2_2_00ECC748 | |
Source: | Code function: | 2_2_00EC69B0 | |
Source: | Code function: | 2_2_00ECE988 | |
Source: | Code function: | 2_2_00EC2A78 | |
Source: | Code function: | 2_2_00ECCA18 | |
Source: | Code function: | 2_2_00ECCCE8 | |
Source: | Code function: | 2_2_00ECCFB8 | |
Source: | Code function: | 2_2_00ECC738 | |
Source: | Code function: | 2_2_00ECF961 | |
Source: | Code function: | 2_2_00ECE97B | |
Source: | Code function: | 2_2_00ECCA08 | |
Source: | Code function: | 2_2_00EC3E09 | |
Source: | Code function: | 2_2_063C1E80 | |
Source: | Code function: | 2_2_063C17A0 | |
Source: | Code function: | 2_2_063C9C70 | |
Source: | Code function: | 2_2_063CFC68 | |
Source: | Code function: | 2_2_063C9548 | |
Source: | Code function: | 2_2_063C0B30 | |
Source: | Code function: | 2_2_063C5028 | |
Source: | Code function: | 2_2_063C2968 | |
Source: | Code function: | 2_2_063CDE00 | |
Source: | Code function: | 2_2_063C1E70 | |
Source: | Code function: | 2_2_063CE6B0 | |
Source: | Code function: | 2_2_063CE6AF | |
Source: | Code function: | 2_2_063CEF60 | |
Source: | Code function: | 2_2_063CEF51 | |
Source: | Code function: | 2_2_063C178F | |
Source: | Code function: | 2_2_063CCCA0 | |
Source: | Code function: | 2_2_063CD550 | |
Source: | Code function: | 2_2_063CD540 | |
Source: | Code function: | 2_2_063CDDFF | |
Source: | Code function: | 2_2_063CE258 | |
Source: | Code function: | 2_2_063CE24A | |
Source: | Code function: | 2_2_063CEAF8 | |
Source: | Code function: | 2_2_063C9328 | |
Source: | Code function: | 2_2_063C0B20 | |
Source: | Code function: | 2_2_063CEB08 | |
Source: | Code function: | 2_2_063CF3B8 | |
Source: | Code function: | 2_2_063C8BA0 | |
Source: | Code function: | 2_2_063C8B91 | |
Source: | Code function: | 2_2_063C9BFA | |
Source: | Code function: | 2_2_063C5022 | |
Source: | Code function: | 2_2_063C001E | |
Source: | Code function: | 2_2_063CF810 | |
Source: | Code function: | 2_2_063CF802 | |
Source: | Code function: | 2_2_063C0040 | |
Source: | Code function: | 2_2_063CD0F8 | |
Source: | Code function: | 2_2_063C295A | |
Source: | Code function: | 2_2_063CD9A8 | |
Source: | Code function: | 2_2_063CD999 |
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: |
Source: | Static PE information: |
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: |
Source: | Cryptographic APIs: | ||
Source: | Cryptographic APIs: | ||
Source: | Cryptographic APIs: |
Source: | Classification label: |
Source: | Code function: | 0_2_0044AF5C |
Source: | Code function: | 0_2_00464422 | |
Source: | Code function: | 0_2_004364AA |
Source: | Code function: | 0_2_0045D517 |
Source: | Code function: | 0_2_0043701F |
Source: | Code function: | 0_2_0047A999 |
Source: | Code function: | 0_2_0043614F |
Source: | Mutant created: |
Source: | File created: | Jump to behavior |
Source: | Command line argument: | 0_2_0040D7F0 |
Source: | Static PE information: |
Source: | File read: | Jump to behavior |
Source: | Key opened: | Jump to behavior |
Source: | Binary or memory string: |
Source: | Virustotal: | ||
Source: | ReversingLabs: |
Source: | File read: | Jump to behavior |
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | Jump to behavior |
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior |
Source: | Key value queried: | Jump to behavior |
Source: | Key opened: | Jump to behavior |
Source: | Static file information: |
Source: | Binary string: | ||
Source: | Binary string: |
Source: | Code function: | 0_2_0040EB70 |
Source: | Static PE information: |
Source: | Code function: | 0_2_004171E4 |
Source: | Code function: | 0_2_004772DE | |
Source: | Code function: | 0_2_004375B0 |
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior |
Malware Analysis System Evasion |
---|
Source: | Code function: | 0_2_00444078 |
Source: | API/Special instruction interceptor: |
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior |
Source: | Window / User API: | Jump to behavior | ||
Source: | Window / User API: | Jump to behavior |
Source: | API coverage: |
Source: | Code function: | 0_2_00452126 | |
Source: | Code function: | 0_2_0045C999 | |
Source: | Code function: | 0_2_00436ADE | |
Source: | Code function: | 0_2_00434BEE | |
Source: | Code function: | 0_2_0045DD7C | |
Source: | Code function: | 0_2_0044BD29 | |
Source: | Code function: | 0_2_00436D2D | |
Source: | Code function: | 0_2_00442E1F | |
Source: | Code function: | 0_2_00475FE5 | |
Source: | Code function: | 0_2_0044BF8D |
Source: | Code function: | 0_2_0040E470 |
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior |
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: |
Source: | Code function: | 2_2_063C9548 |
Source: | Code function: | 0_2_0045A259 |
Source: | Code function: | 0_2_0040D6D0 |
Source: | Code function: | 0_2_0040EB70 |
Source: | Code function: | 0_2_03F4A6B0 | |
Source: | Code function: | 0_2_03F4BD50 | |
Source: | Code function: | 0_2_03F4BCF0 |
Source: | Code function: | 0_2_00426DA1 |
Source: | Code function: | 0_2_0042202E | |
Source: | Code function: | 0_2_004230F5 | |
Source: | Code function: | 0_2_00417D93 | |
Source: | Code function: | 0_2_00421FA7 |
Source: | Memory allocated: | Jump to behavior |
HIPS / PFW / Operating System Protection Evasion |
---|
Source: | Section loaded: | Jump to behavior |
Source: | Memory written: | Jump to behavior |
Source: | Code function: | 0_2_0043916A |
Source: | Code function: | 0_2_0040D6D0 |
Source: | Code function: | 0_2_004375B0 |
Source: | Code function: | 0_2_00436431 |
Source: | Process created: | Jump to behavior |
Source: | Code function: | 0_2_00445DD3 |
Source: | Binary or memory string: | ||
Source: | Binary or memory string: |
Source: | Code function: | 0_2_00410D10 |
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior |
Source: | Code function: | 0_2_004223BC |
Source: | Code function: | 0_2_004711D2 |
Source: | Code function: | 0_2_0042039F |
Source: | Code function: | 0_2_0040E470 |
Source: | Key value queried: | Jump to behavior |
Stealing of Sensitive Information |
---|
Source: | File source: |
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: |
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: |
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior |
Source: | File opened: | Jump to behavior | ||
Source: | Key opened: | Jump to behavior |
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: |
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: |
Remote Access Functionality |
---|
Source: | File source: |
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: |
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: |
Source: | Code function: | 0_2_004741BB | |
Source: | Code function: | 0_2_0046483C | |
Source: | Code function: | 0_2_0047AD92 |
Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Gather Victim Identity Information | Acquire Infrastructure | 2 Valid Accounts | 1 Native API | 1 DLL Side-Loading | 1 Exploitation for Privilege Escalation | 11 Disable or Modify Tools | 1 OS Credential Dumping | 2 System Time Discovery | Remote Services | 11 Archive Collected Data | 1 Web Service | 1 Exfiltration Over Alternative Protocol | 1 System Shutdown/Reboot |
Credentials | Domains | Default Accounts | 2 Command and Scripting Interpreter | 2 Valid Accounts | 1 DLL Side-Loading | 11 Deobfuscate/Decode Files or Information | 21 Input Capture | 1 Account Discovery | Remote Desktop Protocol | 1 Data from Local System | 4 Ingress Tool Transfer | Exfiltration Over Bluetooth | Network Denial of Service |
Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | 2 Valid Accounts | 3 Obfuscated Files or Information | Security Account Manager | 2 File and Directory Discovery | SMB/Windows Admin Shares | 1 Email Collection | 11 Encrypted Channel | Automated Exfiltration | Data Encrypted for Impact |
Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | 21 Access Token Manipulation | 1 DLL Side-Loading | NTDS | 127 System Information Discovery | Distributed Component Object Model | 21 Input Capture | 1 Non-Standard Port | Traffic Duplication | Data Destruction |
Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | 212 Process Injection | 2 Valid Accounts | LSA Secrets | 221 Security Software Discovery | SSH | 3 Clipboard Data | 3 Non-Application Layer Protocol | Scheduled Transfer | Data Encrypted for Impact |
Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | 11 Virtualization/Sandbox Evasion | Cached Domain Credentials | 11 Virtualization/Sandbox Evasion | VNC | GUI Input Capture | 24 Application Layer Protocol | Data Transfer Size Limits | Service Stop |
DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | 21 Access Token Manipulation | DCSync | 2 Process Discovery | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
Network Trust Dependencies | Serverless | Drive-by Compromise | Container Orchestration Job | Scheduled Task/Job | Scheduled Task/Job | 212 Process Injection | Proc Filesystem | 11 Application Window Discovery | Cloud Services | Credential API Hooking | Application Layer Protocol | Exfiltration Over Alternative Protocol | Defacement |
Network Topology | Malvertising | Exploit Public-Facing Application | Command and Scripting Interpreter | At | At | HTML Smuggling | /etc/passwd and /etc/shadow | 1 System Owner/User Discovery | Direct Cloud VM Connections | Data Staged | Web Protocols | Exfiltration Over Symmetric Encrypted Non-C2 Protocol | Internal Defacement |
IP Addresses | Compromise Infrastructure | Supply Chain Compromise | PowerShell | Cron | Cron | Dynamic API Resolution | Network Sniffing | 1 System Network Configuration Discovery | Shared Webroot | Local Data Staging | File Transfer Protocols | Exfiltration Over Asymmetric Encrypted Non-C2 Protocol | External Defacement |
This section contains all screenshots as thumbnails, including those not shown in the slideshow.
Source | Detection | Scanner | Label | Link |
---|---|---|---|---|
58% | Virustotal | Browse | ||
50% | ReversingLabs | Win32.Trojan.SnakeStealer | ||
100% | Joe Sandbox ML |
Source | Detection | Scanner | Label | Link |
---|---|---|---|---|
0% | Virustotal | Browse | ||
0% | Virustotal | Browse | ||
2% | Virustotal | Browse | ||
0% | Virustotal | Browse | ||
0% | Virustotal | Browse | ||
0% | Virustotal | Browse |
Source | Detection | Scanner | Label | Link |
---|---|---|---|---|
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
100% | URL Reputation | malware | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
100% | URL Reputation | malware | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
3% | Virustotal | Browse | ||
0% | Virustotal | Browse | ||
1% | Virustotal | Browse | ||
0% | Virustotal | Browse | ||
2% | Virustotal | Browse | ||
0% | Virustotal | Browse | ||
1% | Virustotal | Browse | ||
0% | Virustotal | Browse | ||
0% | Virustotal | Browse | ||
0% | Virustotal | Browse |
Name | IP | Active | Malicious | Antivirus Detection | Reputation |
---|---|---|---|---|---|
lifechangerscare.com | 216.252.233.118 | true | true |
| unknown |
reallyfreegeoip.org | 188.114.97.3 | true | true |
| unknown |
api.telegram.org | 149.154.167.220 | true | true |
| unknown |
checkip.dyndns.com | 132.226.247.73 | true | false |
| unknown |
ftp.lifechangerscare.com | unknown | unknown | true |
| unknown |
checkip.dyndns.org | unknown | unknown | true |
| unknown |
Name | Malicious | Antivirus Detection | Reputation |
---|---|---|---|
false | unknown | ||
false |
| unknown | |
false |
| unknown |
Name | Source | Malicious | Antivirus Detection | Reputation |
---|---|---|---|---|
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
true |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
true |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false | unknown | |||
false |
| unknown | ||
false |
| unknown |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
---|---|---|---|---|---|---|
149.154.167.220 | api.telegram.org | United Kingdom | 62041 | TELEGRAMRU | true | |
188.114.97.3 | reallyfreegeoip.org | European Union | 13335 | CLOUDFLARENETUS | true | |
216.252.233.118 | lifechangerscare.com | Switzerland | 47965 | SATLYNX_AGCZ | true | |
132.226.247.73 | checkip.dyndns.com | United States | 16989 | UTMEMUS | false |
Joe Sandbox version: | 41.0.0 Charoite |
Analysis ID: | 1524787 |
Start date and time: | 2024-10-03 09:10:18 +02:00 |
Joe Sandbox product: | CloudBasic |
Overall analysis duration: | 0h 8m 32s |
Hypervisor based Inspection enabled: | false |
Report type: | full |
Cookbook file name: | default.jbs |
Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
Number of analysed new started processes analysed: | 9 |
Number of new started drivers analysed: | 0 |
Number of existing processes analysed: | 0 |
Number of existing drivers analysed: | 0 |
Number of injected processes analysed: | 0 |
Technologies: |
|
Analysis Mode: | default |
Analysis stop reason: | Timeout |
Sample name: | Hesaphareketi-01.exe |
Detection: | MAL |
Classification: | mal100.troj.spyw.evad.winEXE@3/1@4/4 |
EGA Information: |
|
HCA Information: |
|
Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, backgroundTaskHost.exe
- Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
- Not all processes where analyzed, report is missing behavior information
- Report size exceeded maximum capacity and may have missing disassembly code.
- Report size getting too big, too many NtOpenKeyEx calls found.
- Report size getting too big, too many NtQueryValueKey calls found.
- Report size getting too big, too many NtReadVirtualMemory calls found.
Time | Type | Description |
---|---|---|
03:11:27 | API Interceptor |
Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
---|---|---|---|---|---|---|
149.154.167.220 | Get hash | malicious | DCRat, PureLog Stealer, zgRAT | Browse | ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse | |||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse | |||
Get hash | malicious | DCRat, PureLog Stealer, zgRAT | Browse | |||
Get hash | malicious | Snake Keylogger | Browse | |||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse | |||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse | |||
Get hash | malicious | VIP Keylogger | Browse | |||
Get hash | malicious | Neshta, Oski Stealer, StormKitty, SugarDump, Vidar, XWorm | Browse | |||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse | |||
188.114.97.3 | Get hash | malicious | Snake Keylogger | Browse |
| |
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | FormBook | Browse |
| ||
Get hash | malicious | PureLog Stealer, zgRAT | Browse |
| ||
Get hash | malicious | PureLog Stealer, zgRAT | Browse |
| ||
Get hash | malicious | FormBook | Browse |
| ||
Get hash | malicious | RedLine, Xmrig | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | FormBook | Browse |
|
Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
---|---|---|---|---|---|---|
reallyfreegeoip.org | Get hash | malicious | Snake Keylogger | Browse |
| |
Get hash | malicious | Snake Keylogger | Browse |
| ||
Get hash | malicious | Cobalt Strike, Snake Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | VIP Keylogger | Browse |
| ||
api.telegram.org | Get hash | malicious | DCRat, PureLog Stealer, zgRAT | Browse |
| |
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | DCRat, PureLog Stealer, zgRAT | Browse |
| ||
Get hash | malicious | Snake Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | VIP Keylogger | Browse |
| ||
Get hash | malicious | Neshta, Oski Stealer, StormKitty, SugarDump, Vidar, XWorm | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
|
Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
---|---|---|---|---|---|---|
TELEGRAMRU | Get hash | malicious | DCRat, PureLog Stealer, zgRAT | Browse |
| |
Get hash | malicious | RedLine | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | DCRat, PureLog Stealer, zgRAT | Browse |
| ||
Get hash | malicious | Snake Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | VIP Keylogger | Browse |
| ||
Get hash | malicious | Neshta, Oski Stealer, StormKitty, SugarDump, Vidar, XWorm | Browse |
| ||
CLOUDFLARENETUS | Get hash | malicious | Unknown | Browse |
| |
Get hash | malicious | LummaC | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Snake Keylogger | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | LummaC | Browse |
| ||
Get hash | malicious | Njrat | Browse |
| ||
Get hash | malicious | RHADAMANTHYS | Browse |
| ||
SATLYNX_AGCZ | Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| |
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Mirai | Browse |
| ||
Get hash | malicious | Mirai | Browse |
| ||
Get hash | malicious | Mirai | Browse |
| ||
Get hash | malicious | Mirai | Browse |
|
Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
---|---|---|---|---|---|---|
54328bd36c14bd82ddaa0c04b25ed9ad | Get hash | malicious | Snake Keylogger | Browse |
| |
Get hash | malicious | Cobalt Strike, Snake Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | VIP Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger | Browse |
| ||
3b5074b1b5d032e5620f69f9f700ff0e | Get hash | malicious | Snake Keylogger | Browse |
| |
Get hash | malicious | Njrat | Browse |
| ||
Get hash | malicious | XWorm | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | DCRat, PureLog Stealer, zgRAT | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Amadey, Credential Flusher, Stealc | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | PureLog Stealer, Quasar, zgRAT | Browse |
|
Process: | C:\Users\user\Desktop\Hesaphareketi-01.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 276992 |
Entropy (8bit): | 6.864671006433881 |
Encrypted: | false |
SSDEEP: | 6144:1CXZ6YvcVzGMrbYhbf/hXY7mCJXkYlej9O3B8xUPKCMLGMwNk:K8DrbEfVHCJUYlT8xyKCMLGQ |
MD5: | 7D8E83658E622389FB7E2F3AB0013B93 |
SHA1: | 6F31CF662861698C9371EC16D18E1120077CF3D9 |
SHA-256: | CC7C7E11F4D1C268FC9DAAAA6F81C7927DF16A713CD716150D56D599C4103FC1 |
SHA-512: | 32C6EB99F4DB04B1CBB9C8FA97429A7DB3D69154DA84432FD840FEA80E84FCDF4CFA17EB1F7AFF69D7FF798902B4EE4BDF90ED047DFDAD3BB251E959D067B8EF |
Malicious: | false |
Reputation: | low |
Preview: |
File type: | |
Entropy (8bit): | 7.370617417298097 |
TrID: |
|
File name: | Hesaphareketi-01.exe |
File size: | 1'297'433 bytes |
MD5: | 5f04bf05eec447538a2c6c18a1af5c9e |
SHA1: | 2e60da672fa2de58f93a1ad056b60ea5685d11c1 |
SHA256: | 0a5999ba1da76aa2c62e40a870776dbecca1f506d987d57a3d5afff9580c96b4 |
SHA512: | 76e2050ab204e753de00abcf9c9ca1139c3c065e87d359d3364c5535445b37bb2866e67e434b38c89fa9058dd7ab09cc692f7c099740f5268ca96a03e792ff6e |
SSDEEP: | 24576:WfmMv6Ckr7Mny5QE/nh2pniYP1FUVNk/q:W3v+7/5QE/nM1PON5 |
TLSH: | D555E032B3D780B6D9937974197BE32AAB357D190323C48BE7E03F769E211015A2A753 |
File Content Preview: | MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-...i...i...i.....9.k...`.:.w...`.,.....`.+.P...N%..c...N%..H...i...d...`. ./...w.:.k...w.;.h...i.8.h...`.>.h...Richi.......... |
Icon Hash: | 004cd81a736c0c63 |
Entrypoint: | 0x416310 |
Entrypoint Section: | .text |
Digitally signed: | false |
Imagebase: | 0x400000 |
Subsystem: | windows gui |
Image File Characteristics: | RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE |
DLL Characteristics: | TERMINAL_SERVER_AWARE |
Time Stamp: | 0x4B93CF87 [Sun Mar 7 16:08:39 2010 UTC] |
TLS Callbacks: | |
CLR (.Net) Version: | |
OS Version Major: | 5 |
OS Version Minor: | 0 |
File Version Major: | 5 |
File Version Minor: | 0 |
Subsystem Version Major: | 5 |
Subsystem Version Minor: | 0 |
Import Hash: | aaaa8913c89c8aa4a5d93f06853894da |
Instruction |
---|
call 00007F9C411B1B0Ch |
jmp 00007F9C411A58DEh |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
push ebp |
mov ebp, esp |
push edi |
push esi |
mov esi, dword ptr [ebp+0Ch] |
mov ecx, dword ptr [ebp+10h] |
mov edi, dword ptr [ebp+08h] |
mov eax, ecx |
mov edx, ecx |
add eax, esi |
cmp edi, esi |
jbe 00007F9C411A5A6Ah |
cmp edi, eax |
jc 00007F9C411A5C0Ah |
cmp ecx, 00000100h |
jc 00007F9C411A5A81h |
cmp dword ptr [004A94E0h], 00000000h |
je 00007F9C411A5A78h |
push edi |
push esi |
and edi, 0Fh |
and esi, 0Fh |
cmp edi, esi |
pop esi |
pop edi |
jne 00007F9C411A5A6Ah |
pop esi |
pop edi |
pop ebp |
jmp 00007F9C411A5ECAh |
test edi, 00000003h |
jne 00007F9C411A5A77h |
shr ecx, 02h |
and edx, 03h |
cmp ecx, 08h |
jc 00007F9C411A5A8Ch |
rep movsd |
jmp dword ptr [00416494h+edx*4] |
nop |
mov eax, edi |
mov edx, 00000003h |
sub ecx, 04h |
jc 00007F9C411A5A6Eh |
and eax, 03h |
add ecx, eax |
jmp dword ptr [004163A8h+eax*4] |
jmp dword ptr [004164A4h+ecx*4] |
nop |
jmp dword ptr [00416428h+ecx*4] |
nop |
mov eax, E4004163h |
arpl word ptr [ecx+00h], ax |
or byte ptr [ecx+eax*2+00h], ah |
and edx, ecx |
mov al, byte ptr [esi] |
mov byte ptr [edi], al |
mov al, byte ptr [esi+01h] |
mov byte ptr [edi+01h], al |
mov al, byte ptr [esi+02h] |
shr ecx, 02h |
mov byte ptr [edi+02h], al |
add esi, 03h |
add edi, 03h |
cmp ecx, 08h |
jc 00007F9C411A5A2Eh |
Programming Language: |
|
Name | Virtual Address | Virtual Size | Is in Section |
---|---|---|---|
IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_IMPORT | 0x8cd3c | 0x154 | .rdata |
IMAGE_DIRECTORY_ENTRY_RESOURCE | 0xab000 | 0x136e8 | .rsrc |
IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_DEBUG | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_TLS | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_IAT | 0x82000 | 0x840 | .rdata |
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
---|---|---|---|---|---|---|---|---|---|
.text | 0x1000 | 0x80017 | 0x80200 | 6c20c6bf686768b6f134f5bd508171bc | False | 0.5602991615853659 | data | 6.634688230255595 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
.rdata | 0x82000 | 0xd95c | 0xda00 | f979966509a93083729d23cdfd2a6f2d | False | 0.36256450688073394 | data | 4.880040824124099 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
.data | 0x90000 | 0x1a518 | 0x6800 | e5d77411f751d28c6eee48a743606795 | False | 0.1600060096153846 | data | 2.2017649896261107 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
.rsrc | 0xab000 | 0x136e8 | 0x13800 | ab35a4d042647ed03aa849f0e3cddd74 | False | 0.10713391426282051 | data | 3.1998968823313665 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
---|---|---|---|---|---|---|
RT_ICON | 0xab448 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors | English | Great Britain | 0.3277027027027027 |
RT_ICON | 0xab570 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 192 | English | Great Britain | 0.7466216216216216 |
RT_ICON | 0xab698 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 192 | English | Great Britain | 0.3885135135135135 |
RT_ICON | 0xab7c0 | 0x10828 | Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 2835 x 2835 px/m | English | Great Britain | 0.07492901928309476 |
RT_MENU | 0xbbfe8 | 0x50 | data | English | Great Britain | 0.9 |
RT_DIALOG | 0xbc038 | 0xfc | data | English | Great Britain | 0.6507936507936508 |
RT_STRING | 0xbc138 | 0x530 | data | English | Great Britain | 0.33960843373493976 |
RT_STRING | 0xbc668 | 0x690 | data | English | Great Britain | 0.26964285714285713 |
RT_STRING | 0xbccf8 | 0x43a | data | English | Great Britain | 0.3733826247689464 |
RT_STRING | 0xbd138 | 0x5fc | data | English | Great Britain | 0.3087467362924282 |
RT_STRING | 0xbd738 | 0x65c | data | English | Great Britain | 0.34336609336609336 |
RT_STRING | 0xbdd98 | 0x388 | data | English | Great Britain | 0.377212389380531 |
RT_STRING | 0xbe120 | 0x158 | Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0 | English | United States | 0.502906976744186 |
RT_GROUP_ICON | 0xbe278 | 0x14 | data | English | Great Britain | 1.25 |
RT_GROUP_ICON | 0xbe290 | 0x14 | data | English | Great Britain | 1.15 |
RT_GROUP_ICON | 0xbe2a8 | 0x14 | data | English | Great Britain | 1.25 |
RT_GROUP_ICON | 0xbe2c0 | 0x14 | data | English | Great Britain | 1.25 |
RT_VERSION | 0xbe2d8 | 0x19c | data | English | Great Britain | 0.5339805825242718 |
RT_MANIFEST | 0xbe478 | 0x26c | ASCII text, with CRLF line terminators | English | United States | 0.5145161290322581 |
DLL | Import |
---|---|
WSOCK32.dll | __WSAFDIsSet, setsockopt, ntohs, recvfrom, sendto, htons, select, listen, WSAStartup, bind, closesocket, connect, socket, send, WSACleanup, ioctlsocket, accept, WSAGetLastError, inet_addr, gethostbyname, gethostname, recv |
VERSION.dll | VerQueryValueW, GetFileVersionInfoW, GetFileVersionInfoSizeW |
WINMM.dll | timeGetTime, waveOutSetVolume, mciSendStringW |
COMCTL32.dll | ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, ImageList_ReplaceIcon, ImageList_Create, InitCommonControlsEx, ImageList_Destroy |
MPR.dll | WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W, WNetUseConnectionW |
WININET.dll | InternetReadFile, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetConnectW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetQueryOptionW, InternetQueryDataAvailable |
PSAPI.DLL | EnumProcesses, GetModuleBaseNameW, GetProcessMemoryInfo, EnumProcessModules |
USERENV.dll | CreateEnvironmentBlock, DestroyEnvironmentBlock, UnloadUserProfile, LoadUserProfileW |
KERNEL32.dll | HeapAlloc, Sleep, GetCurrentThreadId, RaiseException, MulDiv, GetVersionExW, GetSystemInfo, MultiByteToWideChar, WideCharToMultiByte, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, DeleteFileW, FindNextFileW, lstrcmpiW, MoveFileW, CopyFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, GetProcessHeap, OutputDebugStringW, GetLocalTime, CompareStringW, CompareStringA, InterlockedIncrement, InterlockedDecrement, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionAndSpinCount, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, GetTempPathW, GetTempFileNameW, VirtualFree, FormatMessageW, GetExitCodeProcess, SetErrorMode, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, DeviceIoControl, SetFileAttributesW, GetShortPathNameW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetComputerNameW, GetWindowsDirectoryW, GetSystemDirectoryW, GetCurrentProcessId, GetCurrentThread, GetProcessIoCounters, CreateProcessW, SetPriorityClass, LoadLibraryW, VirtualAlloc, LoadLibraryExW, HeapFree, WaitForSingleObject, CreateThread, DuplicateHandle, GetLastError, CloseHandle, GetCurrentProcess, GetProcAddress, LoadLibraryA, FreeLibrary, GetModuleFileNameW, GetFullPathNameW, ExitProcess, ExitThread, GetSystemTimeAsFileTime, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, ResumeThread, GetStartupInfoW, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, SetLastError, HeapSize, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetModuleFileNameA, HeapReAlloc, HeapCreate, SetHandleCount, GetFileType, GetStartupInfoA, SetStdHandle, GetConsoleCP, GetConsoleMode, LCMapStringW, LCMapStringA, RtlUnwind, SetFilePointer, GetTimeZoneInformation, GetTimeFormatA, GetDateFormatA, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, GetTickCount, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, GetModuleHandleA, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, CreateFileA, SetEndOfFile, EnumResourceNamesW, SetEnvironmentVariableA |
USER32.dll | SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, ReleaseCapture, SetCapture, WindowFromPoint, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, CheckMenuRadioItem, CopyImage, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, PeekMessageW, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, GetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, MessageBoxW, DefWindowProcW, MoveWindow, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, GetMenuItemID, TranslateMessage, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, UnregisterHotKey, CharLowerBuffW, MonitorFromRect, keybd_event, LoadImageW, GetWindowLongW |
GDI32.dll | DeleteObject, GetObjectW, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, StrokePath, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, PolyDraw, BeginPath, Rectangle, GetDeviceCaps, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, SetViewportOrgEx |
COMDLG32.dll | GetSaveFileNameW, GetOpenFileNameW |
ADVAPI32.dll | RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegSetValueExW, RegCreateKeyExW, GetUserNameW, RegConnectRegistryW, RegEnumKeyExW, CloseServiceHandle, UnlockServiceDatabase, LockServiceDatabase, OpenSCManagerW, InitiateSystemShutdownExW, AdjustTokenPrivileges, RegCloseKey, RegQueryValueExW, RegOpenKeyExW, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, InitializeSecurityDescriptor, InitializeAcl, GetLengthSid, SetSecurityDescriptorDacl, CopySid, LogonUserW, GetTokenInformation, GetAclInformation, GetAce, AddAce, GetSecurityDescriptorDacl |
SHELL32.dll | DragQueryPoint, ShellExecuteExW, SHGetFolderPathW, DragQueryFileW, SHEmptyRecycleBinW, SHBrowseForFolderW, SHFileOperationW, SHGetPathFromIDListW, SHGetDesktopFolder, SHGetMalloc, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish |
ole32.dll | OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoInitialize, CoUninitialize, CoCreateInstance, CreateStreamOnHGlobal, CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, StringFromCLSID, IIDFromString, StringFromIID, OleInitialize, CreateBindCtx, CLSIDFromProgID, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket, OleUninitialize |
OLEAUT32.dll | SafeArrayAllocData, SafeArrayAllocDescriptorEx, SysAllocString, OleLoadPicture, SafeArrayGetVartype, SafeArrayDestroyData, SafeArrayAccessData, VarR8FromDec, VariantTimeToSystemTime, VariantClear, VariantCopy, VariantInit, SafeArrayDestroyDescriptor, LoadRegTypeLib, GetActiveObject, SafeArrayUnaccessData |
Language of compilation system | Country where language is spoken | Map |
---|---|---|
English | Great Britain | |
English | United States |
Timestamp | SID | Signature | Severity | Source IP | Source Port | Dest IP | Dest Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-10-03T09:11:27.016520+0200 | 2803274 | ETPRO MALWARE Common Downloader Header Pattern UH | 2 | 192.168.2.11 | 49705 | 132.226.247.73 | 80 | TCP |
2024-10-03T09:11:28.016584+0200 | 2803274 | ETPRO MALWARE Common Downloader Header Pattern UH | 2 | 192.168.2.11 | 49705 | 132.226.247.73 | 80 | TCP |
2024-10-03T09:11:28.596889+0200 | 2803305 | ETPRO MALWARE Common Downloader Header Pattern H | 3 | 192.168.2.11 | 49707 | 188.114.97.3 | 443 | TCP |
2024-10-03T09:11:29.292858+0200 | 2803274 | ETPRO MALWARE Common Downloader Header Pattern UH | 2 | 192.168.2.11 | 49708 | 132.226.247.73 | 80 | TCP |
2024-10-03T09:11:29.894890+0200 | 2803305 | ETPRO MALWARE Common Downloader Header Pattern H | 3 | 192.168.2.11 | 49709 | 188.114.97.3 | 443 | TCP |
2024-10-03T09:11:37.906213+0200 | 2803305 | ETPRO MALWARE Common Downloader Header Pattern H | 3 | 192.168.2.11 | 49723 | 188.114.97.3 | 443 | TCP |
Timestamp | Source Port | Dest Port | Source IP | Dest IP |
---|---|---|---|---|
Oct 3, 2024 09:11:24.993741035 CEST | 49705 | 80 | 192.168.2.11 | 132.226.247.73 |
Oct 3, 2024 09:11:24.998810053 CEST | 80 | 49705 | 132.226.247.73 | 192.168.2.11 |
Oct 3, 2024 09:11:24.998872995 CEST | 49705 | 80 | 192.168.2.11 | 132.226.247.73 |
Oct 3, 2024 09:11:24.999172926 CEST | 49705 | 80 | 192.168.2.11 | 132.226.247.73 |
Oct 3, 2024 09:11:25.004172087 CEST | 80 | 49705 | 132.226.247.73 | 192.168.2.11 |
Oct 3, 2024 09:11:26.711818933 CEST | 80 | 49705 | 132.226.247.73 | 192.168.2.11 |
Oct 3, 2024 09:11:26.712368965 CEST | 80 | 49705 | 132.226.247.73 | 192.168.2.11 |
Oct 3, 2024 09:11:26.712421894 CEST | 80 | 49705 | 132.226.247.73 | 192.168.2.11 |
Oct 3, 2024 09:11:26.712430954 CEST | 49705 | 80 | 192.168.2.11 | 132.226.247.73 |
Oct 3, 2024 09:11:26.712475061 CEST | 49705 | 80 | 192.168.2.11 | 132.226.247.73 |
Oct 3, 2024 09:11:26.712663889 CEST | 80 | 49705 | 132.226.247.73 | 192.168.2.11 |
Oct 3, 2024 09:11:26.712712049 CEST | 49705 | 80 | 192.168.2.11 | 132.226.247.73 |
Oct 3, 2024 09:11:26.717442989 CEST | 49705 | 80 | 192.168.2.11 | 132.226.247.73 |
Oct 3, 2024 09:11:26.722244024 CEST | 80 | 49705 | 132.226.247.73 | 192.168.2.11 |
Oct 3, 2024 09:11:26.970086098 CEST | 80 | 49705 | 132.226.247.73 | 192.168.2.11 |
Oct 3, 2024 09:11:27.015417099 CEST | 49706 | 443 | 192.168.2.11 | 188.114.97.3 |
Oct 3, 2024 09:11:27.015453100 CEST | 443 | 49706 | 188.114.97.3 | 192.168.2.11 |
Oct 3, 2024 09:11:27.015523911 CEST | 49706 | 443 | 192.168.2.11 | 188.114.97.3 |
Oct 3, 2024 09:11:27.016520023 CEST | 49705 | 80 | 192.168.2.11 | 132.226.247.73 |
Oct 3, 2024 09:11:27.023355961 CEST | 49706 | 443 | 192.168.2.11 | 188.114.97.3 |
Oct 3, 2024 09:11:27.023375034 CEST | 443 | 49706 | 188.114.97.3 | 192.168.2.11 |
Oct 3, 2024 09:11:27.578742027 CEST | 443 | 49706 | 188.114.97.3 | 192.168.2.11 |
Oct 3, 2024 09:11:27.578950882 CEST | 49706 | 443 | 192.168.2.11 | 188.114.97.3 |
Oct 3, 2024 09:11:27.585086107 CEST | 49706 | 443 | 192.168.2.11 | 188.114.97.3 |
Oct 3, 2024 09:11:27.585100889 CEST | 443 | 49706 | 188.114.97.3 | 192.168.2.11 |
Oct 3, 2024 09:11:27.585553885 CEST | 443 | 49706 | 188.114.97.3 | 192.168.2.11 |
Oct 3, 2024 09:11:27.625926971 CEST | 49706 | 443 | 192.168.2.11 | 188.114.97.3 |
Oct 3, 2024 09:11:27.638696909 CEST | 49706 | 443 | 192.168.2.11 | 188.114.97.3 |
Oct 3, 2024 09:11:27.683397055 CEST | 443 | 49706 | 188.114.97.3 | 192.168.2.11 |
Oct 3, 2024 09:11:27.747872114 CEST | 443 | 49706 | 188.114.97.3 | 192.168.2.11 |
Oct 3, 2024 09:11:27.747958899 CEST | 443 | 49706 | 188.114.97.3 | 192.168.2.11 |
Oct 3, 2024 09:11:27.748014927 CEST | 49706 | 443 | 192.168.2.11 | 188.114.97.3 |
Oct 3, 2024 09:11:27.753803015 CEST | 49706 | 443 | 192.168.2.11 | 188.114.97.3 |
Oct 3, 2024 09:11:27.764484882 CEST | 49705 | 80 | 192.168.2.11 | 132.226.247.73 |
Oct 3, 2024 09:11:27.769742012 CEST | 80 | 49705 | 132.226.247.73 | 192.168.2.11 |
Oct 3, 2024 09:11:27.972356081 CEST | 80 | 49705 | 132.226.247.73 | 192.168.2.11 |
Oct 3, 2024 09:11:27.975404024 CEST | 49707 | 443 | 192.168.2.11 | 188.114.97.3 |
Oct 3, 2024 09:11:27.975452900 CEST | 443 | 49707 | 188.114.97.3 | 192.168.2.11 |
Oct 3, 2024 09:11:27.975537062 CEST | 49707 | 443 | 192.168.2.11 | 188.114.97.3 |
Oct 3, 2024 09:11:27.975826025 CEST | 49707 | 443 | 192.168.2.11 | 188.114.97.3 |
Oct 3, 2024 09:11:27.975846052 CEST | 443 | 49707 | 188.114.97.3 | 192.168.2.11 |
Oct 3, 2024 09:11:28.016583920 CEST | 49705 | 80 | 192.168.2.11 | 132.226.247.73 |
Oct 3, 2024 09:11:28.449441910 CEST | 443 | 49707 | 188.114.97.3 | 192.168.2.11 |
Oct 3, 2024 09:11:28.452159882 CEST | 49707 | 443 | 192.168.2.11 | 188.114.97.3 |
Oct 3, 2024 09:11:28.452183962 CEST | 443 | 49707 | 188.114.97.3 | 192.168.2.11 |
Oct 3, 2024 09:11:28.596909046 CEST | 443 | 49707 | 188.114.97.3 | 192.168.2.11 |
Oct 3, 2024 09:11:28.597002029 CEST | 443 | 49707 | 188.114.97.3 | 192.168.2.11 |
Oct 3, 2024 09:11:28.597055912 CEST | 49707 | 443 | 192.168.2.11 | 188.114.97.3 |
Oct 3, 2024 09:11:28.605649948 CEST | 49707 | 443 | 192.168.2.11 | 188.114.97.3 |
Oct 3, 2024 09:11:28.609030008 CEST | 49705 | 80 | 192.168.2.11 | 132.226.247.73 |
Oct 3, 2024 09:11:28.610192060 CEST | 49708 | 80 | 192.168.2.11 | 132.226.247.73 |
Oct 3, 2024 09:11:28.614365101 CEST | 80 | 49705 | 132.226.247.73 | 192.168.2.11 |
Oct 3, 2024 09:11:28.614428997 CEST | 49705 | 80 | 192.168.2.11 | 132.226.247.73 |
Oct 3, 2024 09:11:28.614948988 CEST | 80 | 49708 | 132.226.247.73 | 192.168.2.11 |
Oct 3, 2024 09:11:28.615115881 CEST | 49708 | 80 | 192.168.2.11 | 132.226.247.73 |
Oct 3, 2024 09:11:28.615115881 CEST | 49708 | 80 | 192.168.2.11 | 132.226.247.73 |
Oct 3, 2024 09:11:28.619901896 CEST | 80 | 49708 | 132.226.247.73 | 192.168.2.11 |
Oct 3, 2024 09:11:29.288397074 CEST | 80 | 49708 | 132.226.247.73 | 192.168.2.11 |
Oct 3, 2024 09:11:29.292857885 CEST | 49708 | 80 | 192.168.2.11 | 132.226.247.73 |
Oct 3, 2024 09:11:29.294461966 CEST | 49709 | 443 | 192.168.2.11 | 188.114.97.3 |
Oct 3, 2024 09:11:29.294518948 CEST | 443 | 49709 | 188.114.97.3 | 192.168.2.11 |
Oct 3, 2024 09:11:29.294800997 CEST | 49709 | 443 | 192.168.2.11 | 188.114.97.3 |
Oct 3, 2024 09:11:29.294843912 CEST | 49709 | 443 | 192.168.2.11 | 188.114.97.3 |
Oct 3, 2024 09:11:29.294852018 CEST | 443 | 49709 | 188.114.97.3 | 192.168.2.11 |
Oct 3, 2024 09:11:29.298006058 CEST | 80 | 49708 | 132.226.247.73 | 192.168.2.11 |
Oct 3, 2024 09:11:29.298083067 CEST | 49708 | 80 | 192.168.2.11 | 132.226.247.73 |
Oct 3, 2024 09:11:29.760529041 CEST | 443 | 49709 | 188.114.97.3 | 192.168.2.11 |
Oct 3, 2024 09:11:29.762363911 CEST | 49709 | 443 | 192.168.2.11 | 188.114.97.3 |
Oct 3, 2024 09:11:29.762386084 CEST | 443 | 49709 | 188.114.97.3 | 192.168.2.11 |
Oct 3, 2024 09:11:29.894854069 CEST | 443 | 49709 | 188.114.97.3 | 192.168.2.11 |
Oct 3, 2024 09:11:29.894967079 CEST | 443 | 49709 | 188.114.97.3 | 192.168.2.11 |
Oct 3, 2024 09:11:29.895028114 CEST | 49709 | 443 | 192.168.2.11 | 188.114.97.3 |
Oct 3, 2024 09:11:29.895461082 CEST | 49709 | 443 | 192.168.2.11 | 188.114.97.3 |
Oct 3, 2024 09:11:29.899389982 CEST | 49710 | 80 | 192.168.2.11 | 132.226.247.73 |
Oct 3, 2024 09:11:29.904274940 CEST | 80 | 49710 | 132.226.247.73 | 192.168.2.11 |
Oct 3, 2024 09:11:29.904366970 CEST | 49710 | 80 | 192.168.2.11 | 132.226.247.73 |
Oct 3, 2024 09:11:29.904444933 CEST | 49710 | 80 | 192.168.2.11 | 132.226.247.73 |
Oct 3, 2024 09:11:29.909219027 CEST | 80 | 49710 | 132.226.247.73 | 192.168.2.11 |
Oct 3, 2024 09:11:30.576738119 CEST | 80 | 49710 | 132.226.247.73 | 192.168.2.11 |
Oct 3, 2024 09:11:30.579544067 CEST | 49711 | 443 | 192.168.2.11 | 188.114.97.3 |
Oct 3, 2024 09:11:30.579648972 CEST | 443 | 49711 | 188.114.97.3 | 192.168.2.11 |
Oct 3, 2024 09:11:30.579737902 CEST | 49711 | 443 | 192.168.2.11 | 188.114.97.3 |
Oct 3, 2024 09:11:30.580091953 CEST | 49711 | 443 | 192.168.2.11 | 188.114.97.3 |
Oct 3, 2024 09:11:30.580131054 CEST | 443 | 49711 | 188.114.97.3 | 192.168.2.11 |
Oct 3, 2024 09:11:30.625935078 CEST | 49710 | 80 | 192.168.2.11 | 132.226.247.73 |
Oct 3, 2024 09:11:31.037674904 CEST | 443 | 49711 | 188.114.97.3 | 192.168.2.11 |
Oct 3, 2024 09:11:31.039336920 CEST | 49711 | 443 | 192.168.2.11 | 188.114.97.3 |
Oct 3, 2024 09:11:31.039442062 CEST | 443 | 49711 | 188.114.97.3 | 192.168.2.11 |
Oct 3, 2024 09:11:31.173537970 CEST | 443 | 49711 | 188.114.97.3 | 192.168.2.11 |
Oct 3, 2024 09:11:31.173654079 CEST | 443 | 49711 | 188.114.97.3 | 192.168.2.11 |
Oct 3, 2024 09:11:31.173800945 CEST | 49711 | 443 | 192.168.2.11 | 188.114.97.3 |
Oct 3, 2024 09:11:31.174160957 CEST | 49711 | 443 | 192.168.2.11 | 188.114.97.3 |
Oct 3, 2024 09:11:31.177439928 CEST | 49710 | 80 | 192.168.2.11 | 132.226.247.73 |
Oct 3, 2024 09:11:31.178020954 CEST | 49712 | 80 | 192.168.2.11 | 132.226.247.73 |
Oct 3, 2024 09:11:31.182607889 CEST | 80 | 49710 | 132.226.247.73 | 192.168.2.11 |
Oct 3, 2024 09:11:31.182733059 CEST | 49710 | 80 | 192.168.2.11 | 132.226.247.73 |
Oct 3, 2024 09:11:31.182881117 CEST | 80 | 49712 | 132.226.247.73 | 192.168.2.11 |
Oct 3, 2024 09:11:31.182967901 CEST | 49712 | 80 | 192.168.2.11 | 132.226.247.73 |
Oct 3, 2024 09:11:31.183181047 CEST | 49712 | 80 | 192.168.2.11 | 132.226.247.73 |
Oct 3, 2024 09:11:31.187971115 CEST | 80 | 49712 | 132.226.247.73 | 192.168.2.11 |
Oct 3, 2024 09:11:31.865767002 CEST | 80 | 49712 | 132.226.247.73 | 192.168.2.11 |
Oct 3, 2024 09:11:31.867464066 CEST | 49713 | 443 | 192.168.2.11 | 188.114.97.3 |
Oct 3, 2024 09:11:31.867510080 CEST | 443 | 49713 | 188.114.97.3 | 192.168.2.11 |
Oct 3, 2024 09:11:31.867578983 CEST | 49713 | 443 | 192.168.2.11 | 188.114.97.3 |
Oct 3, 2024 09:11:31.867991924 CEST | 49713 | 443 | 192.168.2.11 | 188.114.97.3 |
Oct 3, 2024 09:11:31.868004084 CEST | 443 | 49713 | 188.114.97.3 | 192.168.2.11 |
Oct 3, 2024 09:11:31.907186031 CEST | 49712 | 80 | 192.168.2.11 | 132.226.247.73 |
Oct 3, 2024 09:11:32.341605902 CEST | 443 | 49713 | 188.114.97.3 | 192.168.2.11 |
Oct 3, 2024 09:11:32.372862101 CEST | 49713 | 443 | 192.168.2.11 | 188.114.97.3 |
Oct 3, 2024 09:11:32.372905970 CEST | 443 | 49713 | 188.114.97.3 | 192.168.2.11 |
Oct 3, 2024 09:11:32.483243942 CEST | 443 | 49713 | 188.114.97.3 | 192.168.2.11 |
Oct 3, 2024 09:11:32.483361006 CEST | 443 | 49713 | 188.114.97.3 | 192.168.2.11 |
Oct 3, 2024 09:11:32.483447075 CEST | 49713 | 443 | 192.168.2.11 | 188.114.97.3 |
Oct 3, 2024 09:11:32.488832951 CEST | 49713 | 443 | 192.168.2.11 | 188.114.97.3 |
Oct 3, 2024 09:11:32.525232077 CEST | 49712 | 80 | 192.168.2.11 | 132.226.247.73 |
Oct 3, 2024 09:11:32.526096106 CEST | 49714 | 80 | 192.168.2.11 | 132.226.247.73 |
Oct 3, 2024 09:11:32.530518055 CEST | 80 | 49712 | 132.226.247.73 | 192.168.2.11 |
Oct 3, 2024 09:11:32.530577898 CEST | 49712 | 80 | 192.168.2.11 | 132.226.247.73 |
Oct 3, 2024 09:11:32.531332970 CEST | 80 | 49714 | 132.226.247.73 | 192.168.2.11 |
Oct 3, 2024 09:11:32.531465054 CEST | 49714 | 80 | 192.168.2.11 | 132.226.247.73 |
Oct 3, 2024 09:11:32.531708002 CEST | 49714 | 80 | 192.168.2.11 | 132.226.247.73 |
Oct 3, 2024 09:11:32.536658049 CEST | 80 | 49714 | 132.226.247.73 | 192.168.2.11 |
Oct 3, 2024 09:11:33.214864969 CEST | 80 | 49714 | 132.226.247.73 | 192.168.2.11 |
Oct 3, 2024 09:11:33.216249943 CEST | 49715 | 443 | 192.168.2.11 | 188.114.97.3 |
Oct 3, 2024 09:11:33.216293097 CEST | 443 | 49715 | 188.114.97.3 | 192.168.2.11 |
Oct 3, 2024 09:11:33.216449976 CEST | 49715 | 443 | 192.168.2.11 | 188.114.97.3 |
Oct 3, 2024 09:11:33.216622114 CEST | 49715 | 443 | 192.168.2.11 | 188.114.97.3 |
Oct 3, 2024 09:11:33.216648102 CEST | 443 | 49715 | 188.114.97.3 | 192.168.2.11 |
Oct 3, 2024 09:11:33.266588926 CEST | 49714 | 80 | 192.168.2.11 | 132.226.247.73 |
Oct 3, 2024 09:11:33.679920912 CEST | 443 | 49715 | 188.114.97.3 | 192.168.2.11 |
Oct 3, 2024 09:11:33.681775093 CEST | 49715 | 443 | 192.168.2.11 | 188.114.97.3 |
Oct 3, 2024 09:11:33.681807041 CEST | 443 | 49715 | 188.114.97.3 | 192.168.2.11 |
Oct 3, 2024 09:11:33.817414045 CEST | 443 | 49715 | 188.114.97.3 | 192.168.2.11 |
Oct 3, 2024 09:11:33.817512035 CEST | 443 | 49715 | 188.114.97.3 | 192.168.2.11 |
Oct 3, 2024 09:11:33.817698956 CEST | 49715 | 443 | 192.168.2.11 | 188.114.97.3 |
Oct 3, 2024 09:11:33.818052053 CEST | 49715 | 443 | 192.168.2.11 | 188.114.97.3 |
Oct 3, 2024 09:11:33.821211100 CEST | 49714 | 80 | 192.168.2.11 | 132.226.247.73 |
Oct 3, 2024 09:11:33.822475910 CEST | 49716 | 80 | 192.168.2.11 | 132.226.247.73 |
Oct 3, 2024 09:11:33.826530933 CEST | 80 | 49714 | 132.226.247.73 | 192.168.2.11 |
Oct 3, 2024 09:11:33.826606035 CEST | 49714 | 80 | 192.168.2.11 | 132.226.247.73 |
Oct 3, 2024 09:11:33.827819109 CEST | 80 | 49716 | 132.226.247.73 | 192.168.2.11 |
Oct 3, 2024 09:11:33.827955961 CEST | 49716 | 80 | 192.168.2.11 | 132.226.247.73 |
Oct 3, 2024 09:11:33.828022957 CEST | 49716 | 80 | 192.168.2.11 | 132.226.247.73 |
Oct 3, 2024 09:11:33.833487988 CEST | 80 | 49716 | 132.226.247.73 | 192.168.2.11 |
Oct 3, 2024 09:11:34.491791964 CEST | 80 | 49716 | 132.226.247.73 | 192.168.2.11 |
Oct 3, 2024 09:11:34.493675947 CEST | 49717 | 443 | 192.168.2.11 | 188.114.97.3 |
Oct 3, 2024 09:11:34.493730068 CEST | 443 | 49717 | 188.114.97.3 | 192.168.2.11 |
Oct 3, 2024 09:11:34.493813992 CEST | 49717 | 443 | 192.168.2.11 | 188.114.97.3 |
Oct 3, 2024 09:11:34.494093895 CEST | 49717 | 443 | 192.168.2.11 | 188.114.97.3 |
Oct 3, 2024 09:11:34.494107008 CEST | 443 | 49717 | 188.114.97.3 | 192.168.2.11 |
Oct 3, 2024 09:11:34.532207966 CEST | 49716 | 80 | 192.168.2.11 | 132.226.247.73 |
Oct 3, 2024 09:11:34.949771881 CEST | 443 | 49717 | 188.114.97.3 | 192.168.2.11 |
Oct 3, 2024 09:11:35.003026009 CEST | 49717 | 443 | 192.168.2.11 | 188.114.97.3 |
Oct 3, 2024 09:11:35.137332916 CEST | 49717 | 443 | 192.168.2.11 | 188.114.97.3 |
Oct 3, 2024 09:11:35.137363911 CEST | 443 | 49717 | 188.114.97.3 | 192.168.2.11 |
Oct 3, 2024 09:11:35.242717981 CEST | 443 | 49717 | 188.114.97.3 | 192.168.2.11 |
Oct 3, 2024 09:11:35.242811918 CEST | 443 | 49717 | 188.114.97.3 | 192.168.2.11 |
Oct 3, 2024 09:11:35.242888927 CEST | 49717 | 443 | 192.168.2.11 | 188.114.97.3 |
Oct 3, 2024 09:11:35.243417978 CEST | 49717 | 443 | 192.168.2.11 | 188.114.97.3 |
Oct 3, 2024 09:11:35.294665098 CEST | 49716 | 80 | 192.168.2.11 | 132.226.247.73 |
Oct 3, 2024 09:11:35.295298100 CEST | 49718 | 80 | 192.168.2.11 | 132.226.247.73 |
Oct 3, 2024 09:11:35.300014973 CEST | 80 | 49716 | 132.226.247.73 | 192.168.2.11 |
Oct 3, 2024 09:11:35.300101042 CEST | 49716 | 80 | 192.168.2.11 | 132.226.247.73 |
Oct 3, 2024 09:11:35.300355911 CEST | 80 | 49718 | 132.226.247.73 | 192.168.2.11 |
Oct 3, 2024 09:11:35.300431967 CEST | 49718 | 80 | 192.168.2.11 | 132.226.247.73 |
Oct 3, 2024 09:11:35.300543070 CEST | 49718 | 80 | 192.168.2.11 | 132.226.247.73 |
Oct 3, 2024 09:11:35.305538893 CEST | 80 | 49718 | 132.226.247.73 | 192.168.2.11 |
Oct 3, 2024 09:11:35.964544058 CEST | 80 | 49718 | 132.226.247.73 | 192.168.2.11 |
Oct 3, 2024 09:11:35.966108084 CEST | 49719 | 443 | 192.168.2.11 | 188.114.97.3 |
Oct 3, 2024 09:11:35.966155052 CEST | 443 | 49719 | 188.114.97.3 | 192.168.2.11 |
Oct 3, 2024 09:11:35.966226101 CEST | 49719 | 443 | 192.168.2.11 | 188.114.97.3 |
Oct 3, 2024 09:11:35.966479063 CEST | 49719 | 443 | 192.168.2.11 | 188.114.97.3 |
Oct 3, 2024 09:11:35.966491938 CEST | 443 | 49719 | 188.114.97.3 | 192.168.2.11 |
Oct 3, 2024 09:11:36.016554117 CEST | 49718 | 80 | 192.168.2.11 | 132.226.247.73 |
Oct 3, 2024 09:11:36.439340115 CEST | 443 | 49719 | 188.114.97.3 | 192.168.2.11 |
Oct 3, 2024 09:11:36.441615105 CEST | 49719 | 443 | 192.168.2.11 | 188.114.97.3 |
Oct 3, 2024 09:11:36.441647053 CEST | 443 | 49719 | 188.114.97.3 | 192.168.2.11 |
Oct 3, 2024 09:11:36.582163095 CEST | 443 | 49719 | 188.114.97.3 | 192.168.2.11 |
Oct 3, 2024 09:11:36.582268953 CEST | 443 | 49719 | 188.114.97.3 | 192.168.2.11 |
Oct 3, 2024 09:11:36.582340956 CEST | 49719 | 443 | 192.168.2.11 | 188.114.97.3 |
Oct 3, 2024 09:11:36.584552050 CEST | 49719 | 443 | 192.168.2.11 | 188.114.97.3 |
Oct 3, 2024 09:11:36.589176893 CEST | 49718 | 80 | 192.168.2.11 | 132.226.247.73 |
Oct 3, 2024 09:11:36.590121984 CEST | 49720 | 80 | 192.168.2.11 | 132.226.247.73 |
Oct 3, 2024 09:11:36.594436884 CEST | 80 | 49718 | 132.226.247.73 | 192.168.2.11 |
Oct 3, 2024 09:11:36.594517946 CEST | 49718 | 80 | 192.168.2.11 | 132.226.247.73 |
Oct 3, 2024 09:11:36.595086098 CEST | 80 | 49720 | 132.226.247.73 | 192.168.2.11 |
Oct 3, 2024 09:11:36.595185041 CEST | 49720 | 80 | 192.168.2.11 | 132.226.247.73 |
Oct 3, 2024 09:11:36.595329046 CEST | 49720 | 80 | 192.168.2.11 | 132.226.247.73 |
Oct 3, 2024 09:11:36.600214005 CEST | 80 | 49720 | 132.226.247.73 | 192.168.2.11 |
Oct 3, 2024 09:11:37.280227900 CEST | 80 | 49720 | 132.226.247.73 | 192.168.2.11 |
Oct 3, 2024 09:11:37.281624079 CEST | 49723 | 443 | 192.168.2.11 | 188.114.97.3 |
Oct 3, 2024 09:11:37.281683922 CEST | 443 | 49723 | 188.114.97.3 | 192.168.2.11 |
Oct 3, 2024 09:11:37.281761885 CEST | 49723 | 443 | 192.168.2.11 | 188.114.97.3 |
Oct 3, 2024 09:11:37.282061100 CEST | 49723 | 443 | 192.168.2.11 | 188.114.97.3 |
Oct 3, 2024 09:11:37.282073021 CEST | 443 | 49723 | 188.114.97.3 | 192.168.2.11 |
Oct 3, 2024 09:11:37.329118967 CEST | 49720 | 80 | 192.168.2.11 | 132.226.247.73 |
Oct 3, 2024 09:11:37.758759022 CEST | 443 | 49723 | 188.114.97.3 | 192.168.2.11 |
Oct 3, 2024 09:11:37.760778904 CEST | 49723 | 443 | 192.168.2.11 | 188.114.97.3 |
Oct 3, 2024 09:11:37.760807037 CEST | 443 | 49723 | 188.114.97.3 | 192.168.2.11 |
Oct 3, 2024 09:11:37.906223059 CEST | 443 | 49723 | 188.114.97.3 | 192.168.2.11 |
Oct 3, 2024 09:11:37.906321049 CEST | 443 | 49723 | 188.114.97.3 | 192.168.2.11 |
Oct 3, 2024 09:11:37.906413078 CEST | 49723 | 443 | 192.168.2.11 | 188.114.97.3 |
Oct 3, 2024 09:11:37.906929970 CEST | 49723 | 443 | 192.168.2.11 | 188.114.97.3 |
Oct 3, 2024 09:11:37.921838999 CEST | 49720 | 80 | 192.168.2.11 | 132.226.247.73 |
Oct 3, 2024 09:11:37.927095890 CEST | 80 | 49720 | 132.226.247.73 | 192.168.2.11 |
Oct 3, 2024 09:11:37.927156925 CEST | 49720 | 80 | 192.168.2.11 | 132.226.247.73 |
Oct 3, 2024 09:11:37.929851055 CEST | 49726 | 443 | 192.168.2.11 | 149.154.167.220 |
Oct 3, 2024 09:11:37.929893970 CEST | 443 | 49726 | 149.154.167.220 | 192.168.2.11 |
Oct 3, 2024 09:11:37.929958105 CEST | 49726 | 443 | 192.168.2.11 | 149.154.167.220 |
Oct 3, 2024 09:11:37.930506945 CEST | 49726 | 443 | 192.168.2.11 | 149.154.167.220 |
Oct 3, 2024 09:11:37.930524111 CEST | 443 | 49726 | 149.154.167.220 | 192.168.2.11 |
Oct 3, 2024 09:11:38.617686987 CEST | 443 | 49726 | 149.154.167.220 | 192.168.2.11 |
Oct 3, 2024 09:11:38.617769003 CEST | 49726 | 443 | 192.168.2.11 | 149.154.167.220 |
Oct 3, 2024 09:11:38.619647026 CEST | 49726 | 443 | 192.168.2.11 | 149.154.167.220 |
Oct 3, 2024 09:11:38.619667053 CEST | 443 | 49726 | 149.154.167.220 | 192.168.2.11 |
Oct 3, 2024 09:11:38.619929075 CEST | 443 | 49726 | 149.154.167.220 | 192.168.2.11 |
Oct 3, 2024 09:11:38.621484041 CEST | 49726 | 443 | 192.168.2.11 | 149.154.167.220 |
Oct 3, 2024 09:11:38.667411089 CEST | 443 | 49726 | 149.154.167.220 | 192.168.2.11 |
Oct 3, 2024 09:11:38.858305931 CEST | 443 | 49726 | 149.154.167.220 | 192.168.2.11 |
Oct 3, 2024 09:11:38.858370066 CEST | 443 | 49726 | 149.154.167.220 | 192.168.2.11 |
Oct 3, 2024 09:11:38.858452082 CEST | 49726 | 443 | 192.168.2.11 | 149.154.167.220 |
Oct 3, 2024 09:11:38.863049984 CEST | 49726 | 443 | 192.168.2.11 | 149.154.167.220 |
Oct 3, 2024 09:11:44.263200045 CEST | 49729 | 21 | 192.168.2.11 | 216.252.233.118 |
Oct 3, 2024 09:11:44.268080950 CEST | 21 | 49729 | 216.252.233.118 | 192.168.2.11 |
Oct 3, 2024 09:11:44.268215895 CEST | 49729 | 21 | 192.168.2.11 | 216.252.233.118 |
Oct 3, 2024 09:11:44.270211935 CEST | 49729 | 21 | 192.168.2.11 | 216.252.233.118 |
Oct 3, 2024 09:11:44.275119066 CEST | 21 | 49729 | 216.252.233.118 | 192.168.2.11 |
Oct 3, 2024 09:11:44.275191069 CEST | 49729 | 21 | 192.168.2.11 | 216.252.233.118 |
Oct 3, 2024 09:11:45.785717964 CEST | 49730 | 21 | 192.168.2.11 | 216.252.233.118 |
Oct 3, 2024 09:11:45.790692091 CEST | 21 | 49730 | 216.252.233.118 | 192.168.2.11 |
Oct 3, 2024 09:11:45.790822983 CEST | 49730 | 21 | 192.168.2.11 | 216.252.233.118 |
Oct 3, 2024 09:11:46.353188038 CEST | 21 | 49730 | 216.252.233.118 | 192.168.2.11 |
Oct 3, 2024 09:11:46.353482008 CEST | 49730 | 21 | 192.168.2.11 | 216.252.233.118 |
Oct 3, 2024 09:11:46.358289957 CEST | 21 | 49730 | 216.252.233.118 | 192.168.2.11 |
Oct 3, 2024 09:11:46.526778936 CEST | 21 | 49730 | 216.252.233.118 | 192.168.2.11 |
Oct 3, 2024 09:11:46.526973009 CEST | 49730 | 21 | 192.168.2.11 | 216.252.233.118 |
Oct 3, 2024 09:11:46.531811953 CEST | 21 | 49730 | 216.252.233.118 | 192.168.2.11 |
Oct 3, 2024 09:11:46.711788893 CEST | 21 | 49730 | 216.252.233.118 | 192.168.2.11 |
Oct 3, 2024 09:11:46.711993933 CEST | 49730 | 21 | 192.168.2.11 | 216.252.233.118 |
Oct 3, 2024 09:11:46.716996908 CEST | 21 | 49730 | 216.252.233.118 | 192.168.2.11 |
Oct 3, 2024 09:11:46.885505915 CEST | 21 | 49730 | 216.252.233.118 | 192.168.2.11 |
Oct 3, 2024 09:11:46.885699034 CEST | 49730 | 21 | 192.168.2.11 | 216.252.233.118 |
Oct 3, 2024 09:11:46.890618086 CEST | 21 | 49730 | 216.252.233.118 | 192.168.2.11 |
Oct 3, 2024 09:11:47.059062958 CEST | 21 | 49730 | 216.252.233.118 | 192.168.2.11 |
Oct 3, 2024 09:11:47.059313059 CEST | 49730 | 21 | 192.168.2.11 | 216.252.233.118 |
Oct 3, 2024 09:11:47.064148903 CEST | 21 | 49730 | 216.252.233.118 | 192.168.2.11 |
Oct 3, 2024 09:11:47.232673883 CEST | 21 | 49730 | 216.252.233.118 | 192.168.2.11 |
Oct 3, 2024 09:11:47.232850075 CEST | 49730 | 21 | 192.168.2.11 | 216.252.233.118 |
Oct 3, 2024 09:11:47.237763882 CEST | 21 | 49730 | 216.252.233.118 | 192.168.2.11 |
Oct 3, 2024 09:11:47.406223059 CEST | 21 | 49730 | 216.252.233.118 | 192.168.2.11 |
Oct 3, 2024 09:11:47.406938076 CEST | 49731 | 55243 | 192.168.2.11 | 216.252.233.118 |
Oct 3, 2024 09:11:47.411911964 CEST | 55243 | 49731 | 216.252.233.118 | 192.168.2.11 |
Oct 3, 2024 09:11:47.412051916 CEST | 49731 | 55243 | 192.168.2.11 | 216.252.233.118 |
Oct 3, 2024 09:11:47.412111044 CEST | 49730 | 21 | 192.168.2.11 | 216.252.233.118 |
Oct 3, 2024 09:11:47.416928053 CEST | 21 | 49730 | 216.252.233.118 | 192.168.2.11 |
Oct 3, 2024 09:11:47.926814079 CEST | 21 | 49730 | 216.252.233.118 | 192.168.2.11 |
Oct 3, 2024 09:11:47.935450077 CEST | 49731 | 55243 | 192.168.2.11 | 216.252.233.118 |
Oct 3, 2024 09:11:47.935451031 CEST | 49731 | 55243 | 192.168.2.11 | 216.252.233.118 |
Oct 3, 2024 09:11:47.940445900 CEST | 55243 | 49731 | 216.252.233.118 | 192.168.2.11 |
Oct 3, 2024 09:11:47.940792084 CEST | 55243 | 49731 | 216.252.233.118 | 192.168.2.11 |
Oct 3, 2024 09:11:47.940860987 CEST | 49731 | 55243 | 192.168.2.11 | 216.252.233.118 |
Oct 3, 2024 09:11:47.969732046 CEST | 49730 | 21 | 192.168.2.11 | 216.252.233.118 |
Oct 3, 2024 09:11:48.108227968 CEST | 21 | 49730 | 216.252.233.118 | 192.168.2.11 |
Oct 3, 2024 09:11:48.157215118 CEST | 49730 | 21 | 192.168.2.11 | 216.252.233.118 |
Timestamp | Source Port | Dest Port | Source IP | Dest IP |
---|---|---|---|---|
Oct 3, 2024 09:11:24.977488995 CEST | 58085 | 53 | 192.168.2.11 | 1.1.1.1 |
Oct 3, 2024 09:11:24.985682011 CEST | 53 | 58085 | 1.1.1.1 | 192.168.2.11 |
Oct 3, 2024 09:11:27.007450104 CEST | 57172 | 53 | 192.168.2.11 | 1.1.1.1 |
Oct 3, 2024 09:11:27.014719009 CEST | 53 | 57172 | 1.1.1.1 | 192.168.2.11 |
Oct 3, 2024 09:11:37.922441959 CEST | 58918 | 53 | 192.168.2.11 | 1.1.1.1 |
Oct 3, 2024 09:11:37.929282904 CEST | 53 | 58918 | 1.1.1.1 | 192.168.2.11 |
Oct 3, 2024 09:11:44.219314098 CEST | 61438 | 53 | 192.168.2.11 | 1.1.1.1 |
Oct 3, 2024 09:11:44.261727095 CEST | 53 | 61438 | 1.1.1.1 | 192.168.2.11 |
Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
---|---|---|---|---|---|---|---|---|
Oct 3, 2024 09:11:24.977488995 CEST | 192.168.2.11 | 1.1.1.1 | 0x173 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
Oct 3, 2024 09:11:27.007450104 CEST | 192.168.2.11 | 1.1.1.1 | 0x2325 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
Oct 3, 2024 09:11:37.922441959 CEST | 192.168.2.11 | 1.1.1.1 | 0xc7b | Standard query (0) | A (IP address) | IN (0x0001) | false | |
Oct 3, 2024 09:11:44.219314098 CEST | 192.168.2.11 | 1.1.1.1 | 0x87ef | Standard query (0) | A (IP address) | IN (0x0001) | false |
Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
---|---|---|---|---|---|---|---|---|---|---|
Oct 3, 2024 09:11:24.985682011 CEST | 1.1.1.1 | 192.168.2.11 | 0x173 | No error (0) | checkip.dyndns.com | CNAME (Canonical name) | IN (0x0001) | false | ||
Oct 3, 2024 09:11:24.985682011 CEST | 1.1.1.1 | 192.168.2.11 | 0x173 | No error (0) | 132.226.247.73 | A (IP address) | IN (0x0001) | false | ||
Oct 3, 2024 09:11:24.985682011 CEST | 1.1.1.1 | 192.168.2.11 | 0x173 | No error (0) | 193.122.6.168 | A (IP address) | IN (0x0001) | false | ||
Oct 3, 2024 09:11:24.985682011 CEST | 1.1.1.1 | 192.168.2.11 | 0x173 | No error (0) | 132.226.8.169 | A (IP address) | IN (0x0001) | false | ||
Oct 3, 2024 09:11:24.985682011 CEST | 1.1.1.1 | 192.168.2.11 | 0x173 | No error (0) | 193.122.130.0 | A (IP address) | IN (0x0001) | false | ||
Oct 3, 2024 09:11:24.985682011 CEST | 1.1.1.1 | 192.168.2.11 | 0x173 | No error (0) | 158.101.44.242 | A (IP address) | IN (0x0001) | false | ||
Oct 3, 2024 09:11:27.014719009 CEST | 1.1.1.1 | 192.168.2.11 | 0x2325 | No error (0) | 188.114.97.3 | A (IP address) | IN (0x0001) | false | ||
Oct 3, 2024 09:11:27.014719009 CEST | 1.1.1.1 | 192.168.2.11 | 0x2325 | No error (0) | 188.114.96.3 | A (IP address) | IN (0x0001) | false | ||
Oct 3, 2024 09:11:37.929282904 CEST | 1.1.1.1 | 192.168.2.11 | 0xc7b | No error (0) | 149.154.167.220 | A (IP address) | IN (0x0001) | false | ||
Oct 3, 2024 09:11:44.261727095 CEST | 1.1.1.1 | 192.168.2.11 | 0x87ef | No error (0) | lifechangerscare.com | CNAME (Canonical name) | IN (0x0001) | false | ||
Oct 3, 2024 09:11:44.261727095 CEST | 1.1.1.1 | 192.168.2.11 | 0x87ef | No error (0) | 216.252.233.118 | A (IP address) | IN (0x0001) | false |
|
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
0 | 192.168.2.11 | 49705 | 132.226.247.73 | 80 | 7728 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
Oct 3, 2024 09:11:24.999172926 CEST | 151 | OUT | |
Oct 3, 2024 09:11:26.711818933 CEST | 320 | IN | |
Oct 3, 2024 09:11:26.712368965 CEST | 320 | IN | |
Oct 3, 2024 09:11:26.712421894 CEST | 320 | IN | |
Oct 3, 2024 09:11:26.712663889 CEST | 320 | IN | |
Oct 3, 2024 09:11:26.717442989 CEST | 127 | OUT | |
Oct 3, 2024 09:11:26.970086098 CEST | 320 | IN | |
Oct 3, 2024 09:11:27.764484882 CEST | 127 | OUT | |
Oct 3, 2024 09:11:27.972356081 CEST | 320 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
1 | 192.168.2.11 | 49708 | 132.226.247.73 | 80 | 7728 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
Oct 3, 2024 09:11:28.615115881 CEST | 127 | OUT | |
Oct 3, 2024 09:11:29.288397074 CEST | 320 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
2 | 192.168.2.11 | 49710 | 132.226.247.73 | 80 | 7728 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
Oct 3, 2024 09:11:29.904444933 CEST | 151 | OUT | |
Oct 3, 2024 09:11:30.576738119 CEST | 320 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
3 | 192.168.2.11 | 49712 | 132.226.247.73 | 80 | 7728 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
Oct 3, 2024 09:11:31.183181047 CEST | 151 | OUT | |
Oct 3, 2024 09:11:31.865767002 CEST | 320 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
4 | 192.168.2.11 | 49714 | 132.226.247.73 | 80 | 7728 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
Oct 3, 2024 09:11:32.531708002 CEST | 151 | OUT | |
Oct 3, 2024 09:11:33.214864969 CEST | 320 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
5 | 192.168.2.11 | 49716 | 132.226.247.73 | 80 | 7728 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
Oct 3, 2024 09:11:33.828022957 CEST | 151 | OUT | |
Oct 3, 2024 09:11:34.491791964 CEST | 320 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
6 | 192.168.2.11 | 49718 | 132.226.247.73 | 80 | 7728 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
Oct 3, 2024 09:11:35.300543070 CEST | 151 | OUT | |
Oct 3, 2024 09:11:35.964544058 CEST | 320 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
7 | 192.168.2.11 | 49720 | 132.226.247.73 | 80 | 7728 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
Oct 3, 2024 09:11:36.595329046 CEST | 151 | OUT | |
Oct 3, 2024 09:11:37.280227900 CEST | 320 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
0 | 192.168.2.11 | 49706 | 188.114.97.3 | 443 | 7728 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-10-03 07:11:27 UTC | 84 | OUT | |
2024-10-03 07:11:27 UTC | 676 | IN | |
2024-10-03 07:11:27 UTC | 340 | IN | |
2024-10-03 07:11:27 UTC | 5 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
1 | 192.168.2.11 | 49707 | 188.114.97.3 | 443 | 7728 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-10-03 07:11:28 UTC | 60 | OUT | |
2024-10-03 07:11:28 UTC | 684 | IN | |
2024-10-03 07:11:28 UTC | 340 | IN | |
2024-10-03 07:11:28 UTC | 5 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
2 | 192.168.2.11 | 49709 | 188.114.97.3 | 443 | 7728 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-10-03 07:11:29 UTC | 60 | OUT | |
2024-10-03 07:11:29 UTC | 674 | IN | |
2024-10-03 07:11:29 UTC | 340 | IN | |
2024-10-03 07:11:29 UTC | 5 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
3 | 192.168.2.11 | 49711 | 188.114.97.3 | 443 | 7728 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-10-03 07:11:31 UTC | 84 | OUT | |
2024-10-03 07:11:31 UTC | 674 | IN | |
2024-10-03 07:11:31 UTC | 340 | IN | |
2024-10-03 07:11:31 UTC | 5 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
4 | 192.168.2.11 | 49713 | 188.114.97.3 | 443 | 7728 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-10-03 07:11:32 UTC | 84 | OUT | |
2024-10-03 07:11:32 UTC | 674 | IN | |
2024-10-03 07:11:32 UTC | 340 | IN | |
2024-10-03 07:11:32 UTC | 5 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
5 | 192.168.2.11 | 49715 | 188.114.97.3 | 443 | 7728 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-10-03 07:11:33 UTC | 84 | OUT | |
2024-10-03 07:11:33 UTC | 680 | IN | |
2024-10-03 07:11:33 UTC | 340 | IN | |
2024-10-03 07:11:33 UTC | 5 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
6 | 192.168.2.11 | 49717 | 188.114.97.3 | 443 | 7728 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-10-03 07:11:35 UTC | 84 | OUT | |
2024-10-03 07:11:35 UTC | 678 | IN | |
2024-10-03 07:11:35 UTC | 340 | IN | |
2024-10-03 07:11:35 UTC | 5 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
7 | 192.168.2.11 | 49719 | 188.114.97.3 | 443 | 7728 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-10-03 07:11:36 UTC | 84 | OUT | |
2024-10-03 07:11:36 UTC | 712 | IN | |
2024-10-03 07:11:36 UTC | 340 | IN | |
2024-10-03 07:11:36 UTC | 5 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
8 | 192.168.2.11 | 49723 | 188.114.97.3 | 443 | 7728 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-10-03 07:11:37 UTC | 60 | OUT | |
2024-10-03 07:11:37 UTC | 676 | IN | |
2024-10-03 07:11:37 UTC | 340 | IN | |
2024-10-03 07:11:37 UTC | 5 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
9 | 192.168.2.11 | 49726 | 149.154.167.220 | 443 | 7728 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-10-03 07:11:38 UTC | 349 | OUT | |
2024-10-03 07:11:38 UTC | 344 | IN | |
2024-10-03 07:11:38 UTC | 55 | IN |
Timestamp | Source Port | Dest Port | Source IP | Dest IP | Commands |
---|---|---|---|---|---|
Oct 3, 2024 09:11:46.353188038 CEST | 21 | 49730 | 216.252.233.118 | 192.168.2.11 | 220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 5 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 5 of 50 allowed.220-Local time is now 03:11. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 5 of 50 allowed.220-Local time is now 03:11. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 5 of 50 allowed.220-Local time is now 03:11. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 5 of 50 allowed.220-Local time is now 03:11. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity. |
Oct 3, 2024 09:11:46.353482008 CEST | 49730 | 21 | 192.168.2.11 | 216.252.233.118 | USER chuks@lifechangerscare.com |
Oct 3, 2024 09:11:46.526778936 CEST | 21 | 49730 | 216.252.233.118 | 192.168.2.11 | 331 User chuks@lifechangerscare.com OK. Password required |
Oct 3, 2024 09:11:46.526973009 CEST | 49730 | 21 | 192.168.2.11 | 216.252.233.118 | PASS b4ST8!7!uFT9POP |
Oct 3, 2024 09:11:46.711788893 CEST | 21 | 49730 | 216.252.233.118 | 192.168.2.11 | 230 OK. Current restricted directory is / |
Oct 3, 2024 09:11:46.885505915 CEST | 21 | 49730 | 216.252.233.118 | 192.168.2.11 | 504 Unknown command |
Oct 3, 2024 09:11:46.885699034 CEST | 49730 | 21 | 192.168.2.11 | 216.252.233.118 | PWD |
Oct 3, 2024 09:11:47.059062958 CEST | 21 | 49730 | 216.252.233.118 | 192.168.2.11 | 257 "/" is your current location |
Oct 3, 2024 09:11:47.059313059 CEST | 49730 | 21 | 192.168.2.11 | 216.252.233.118 | TYPE I |
Oct 3, 2024 09:11:47.232673883 CEST | 21 | 49730 | 216.252.233.118 | 192.168.2.11 | 200 TYPE is now 8-bit binary |
Oct 3, 2024 09:11:47.232850075 CEST | 49730 | 21 | 192.168.2.11 | 216.252.233.118 | PASV |
Oct 3, 2024 09:11:47.406223059 CEST | 21 | 49730 | 216.252.233.118 | 192.168.2.11 | 227 Entering Passive Mode (216,252,233,118,215,203) |
Oct 3, 2024 09:11:47.412111044 CEST | 49730 | 21 | 192.168.2.11 | 216.252.233.118 | STOR 813435 - Cookies ID - ZyiAEnXWZP1714219683.txt |
Oct 3, 2024 09:11:47.926814079 CEST | 21 | 49730 | 216.252.233.118 | 192.168.2.11 | 150 Accepted data connection |
Oct 3, 2024 09:11:48.108227968 CEST | 21 | 49730 | 216.252.233.118 | 192.168.2.11 | 226-File successfully transferred 226-File successfully transferred226 0.182 seconds (measured here), 5.55 Kbytes per second |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
Target ID: | 0 |
Start time: | 03:11:21 |
Start date: | 03/10/2024 |
Path: | C:\Users\user\Desktop\Hesaphareketi-01.exe |
Wow64 process (32bit): | true |
Commandline: | |
Imagebase: | 0x400000 |
File size: | 1'297'433 bytes |
MD5 hash: | 5F04BF05EEC447538A2C6C18A1AF5C9E |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Yara matches: |
|
Reputation: | low |
Has exited: | true |
Target ID: | 2 |
Start time: | 03:11:24 |
Start date: | 03/10/2024 |
Path: | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Wow64 process (32bit): | true |
Commandline: | |
Imagebase: | 0x680000 |
File size: | 45'984 bytes |
MD5 hash: | 9D352BC46709F0CB5EC974633A0C3C94 |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Yara matches: |
|
Reputation: | high |
Has exited: | false |
Execution Graph
Execution Coverage: | 3.1% |
Dynamic/Decrypted Code Coverage: | 1.1% |
Signature Coverage: | 4.3% |
Total number of Nodes: | 1585 |
Total number of Limit Nodes: | 39 |
Graph
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Control-flow Graph
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040EB70 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00410B90 Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 167registryCOMMON
Control-flow Graph
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Control-flow Graph
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004102F0 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53windowregistryCOMMON
Control-flow Graph
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004101F0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 74windowregistryCOMMON
Control-flow Graph
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00452574 Relevance: 13.7, APIs: 9, Instructions: 171COMMON
Control-flow Graph
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Control-flow Graph
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Control-flow Graph
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Control-flow Graph
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 03F4AE40 Relevance: 10.7, APIs: 7, Instructions: 239fileCOMMON
Control-flow Graph
APIs |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Control-flow Graph
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Control-flow Graph
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 03F4ABF0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 151fileCOMMON
Control-flow Graph
APIs |
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00413A88 Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE
Control-flow Graph
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Control-flow Graph
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0041171A Relevance: 6.0, APIs: 4, Instructions: 34COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0043526E Relevance: 4.5, APIs: 3, Instructions: 26COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040B380 Relevance: 3.3, APIs: 2, Instructions: 255COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040EFE0 Relevance: 3.1, APIs: 2, Instructions: 51fileCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004098B8 Relevance: 3.0, APIs: 2, Instructions: 32windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004098B6 Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00410D40 Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004092C0 Relevance: 1.6, APIs: 1, Instructions: 71COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00401108 Relevance: 1.5, APIs: 1, Instructions: 36COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0041AA31 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00444343 Relevance: 1.5, APIs: 1, Instructions: 19fileCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040116E Relevance: 1.5, APIs: 1, Instructions: 12COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00414E06 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040D900 Relevance: 1.3, APIs: 1, Instructions: 22COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 03F4AAE0 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0047C08E Relevance: 74.2, APIs: 40, Strings: 2, Instructions: 676windowkeyboardCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004045E0 Relevance: 46.9, Strings: 35, Instructions: 3193COMMON
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004375B0 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 126threadkeyboardwindowCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004461ED Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 227processCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0044BD29 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 178filestringCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0042039F Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 282timeCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00434D50 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 114fileCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00464422 Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 193threadCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040D6D0 Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 141windowCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00434BEE Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 139fileCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00444078 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 94timesleepCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00445DD3 Relevance: 18.2, APIs: 12, Instructions: 179COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0047A999 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 288comCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004364AA Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 79shutdownCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0043614F Relevance: 16.6, APIs: 11, Instructions: 103COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0047AD92 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 251comCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00452126 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 127filesleepCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0046C5D0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69clipboardCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004772DE Relevance: 7.6, APIs: 5, Instructions: 67windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00446566 Relevance: 5.9, Strings: 4, Instructions: 868COMMON
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0045C999 Relevance: 4.6, APIs: 3, Instructions: 130fileCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00436ADE Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0045DD7C Relevance: 3.1, APIs: 2, Instructions: 56fileCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0047CBF0 Relevance: 2.9, Strings: 2, Instructions: 418COMMON
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040F890 Relevance: 2.1, APIs: 1, Instructions: 589COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0047E1FA Relevance: 2.0, APIs: 1, Instructions: 499COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0043916A Relevance: 1.5, APIs: 1, Instructions: 19COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004711D2 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0042202E Relevance: 1.5, APIs: 1, Instructions: 4COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00412C38 Relevance: .4, Instructions: 384COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00412818 Relevance: .4, Instructions: 378COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0041240C Relevance: .4, Instructions: 361COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00412038 Relevance: .4, Instructions: 351COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00490D70 Relevance: .1, Instructions: 113COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00410D10 Relevance: .0, Instructions: 19COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00459384 Relevance: 79.2, APIs: 41, Strings: 4, Instructions: 480filewindowcomCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0046C604 Relevance: 40.5, APIs: 22, Strings: 1, Instructions: 216clipboardCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0045657D Relevance: 38.8, APIs: 19, Strings: 3, Instructions: 287windowCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00454DAA Relevance: 38.7, APIs: 18, Strings: 4, Instructions: 203windowlibraryCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00452788 Relevance: 34.8, APIs: 23, Instructions: 344COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004700B0 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 285windowtimeCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00476A8A Relevance: 27.3, APIs: 18, Instructions: 332COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0043737D Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 83windowCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00458D1C Relevance: 25.6, APIs: 17, Instructions: 112COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00469681 Relevance: 24.8, APIs: 13, Strings: 1, Instructions: 253windowCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004680EB Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 204windowCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0046F2B0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 185windowfileCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0045F48E Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 226windowsleepCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0045510D Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 115windowCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00415C25 Relevance: 22.7, APIs: 15, Instructions: 236COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00433BAC Relevance: 22.6, APIs: 15, Instructions: 79COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00460ABB Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 294windowtimeCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00434506 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162windowCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00435A35 Relevance: 21.1, APIs: 14, Instructions: 136timeCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00445A77 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 73windowCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004582BF Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 165registryCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004580E1 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 136registryshareCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004584D6 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 105registryCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00436582 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 79networkCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00416B12 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 57libraryloaderCOMMONLIBRARYCODE
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00437DB1 Relevance: 18.2, APIs: 12, Instructions: 180COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00436879 Relevance: 18.1, APIs: 12, Instructions: 115COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0046B39A Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 401registryCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0046F50B Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 157windowCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0046FD7F Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 143windowCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004393E2 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 109threadCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00467214 Relevance: 16.8, APIs: 11, Instructions: 313COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004507E7 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 146windowCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00448602 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 105windowCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004691F4 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 88windowCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004693F0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 87windowCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0046ECBF Relevance: 15.1, APIs: 10, Instructions: 101COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0045E912 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 353timeCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0042FE54 Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 298sleepCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0046A75F Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 179registryCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0045F2C5 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 146windowCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0043717F Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 46windowCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00456168 Relevance: 13.7, APIs: 9, Instructions: 181COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004417BC Relevance: 13.6, APIs: 9, Instructions: 142COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00445CF9 Relevance: 13.6, APIs: 9, Instructions: 69sleepkeyboardwindowCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0045427D Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 259libraryloaderCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0044AA1F Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 171networkCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0046BB59 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 168networkCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0044BBC9 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 100filestringCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004140DB Relevance: 12.0, APIs: 8, Instructions: 42threadCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004357AD Relevance: 12.0, APIs: 8, Instructions: 36COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00440B39 Relevance: 10.8, APIs: 7, Instructions: 261COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0045377F Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236windowCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004472C8 Relevance: 10.7, APIs: 7, Instructions: 207COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00447303 Relevance: 10.7, APIs: 7, Instructions: 192COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0044733D Relevance: 10.7, APIs: 7, Instructions: 177COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004498BD Relevance: 10.7, APIs: 7, Instructions: 159COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0046A98D Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 158registryCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00463D7E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 141libraryloaderCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0044849C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 106windowCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0047244D Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 104sleepCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00448AFF Relevance: 10.6, APIs: 7, Instructions: 98windowCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00401BE0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 90windowCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00450DB4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 76windowCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00455449 Relevance: 10.6, APIs: 7, Instructions: 75windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00415702 Relevance: 10.6, APIs: 7, Instructions: 74threadCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00439102 Relevance: 10.5, APIs: 7, Instructions: 46threadCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0041568B Relevance: 10.5, APIs: 7, Instructions: 37threadCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00434124 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 15libraryloaderCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0047B1D0 Relevance: 9.5, APIs: 6, Instructions: 489COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004336C7 Relevance: 9.3, APIs: 6, Instructions: 253COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00457838 Relevance: 9.2, APIs: 6, Instructions: 176COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00445153 Relevance: 9.1, APIs: 6, Instructions: 142COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00447B66 Relevance: 9.1, APIs: 6, Instructions: 119COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0044B474 Relevance: 9.1, APIs: 6, Instructions: 113fileCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00441077 Relevance: 9.1, APIs: 6, Instructions: 111windowCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00449063 Relevance: 9.1, APIs: 6, Instructions: 108windowCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00442582 Relevance: 9.1, APIs: 6, Instructions: 104COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00448851 Relevance: 9.1, APIs: 6, Instructions: 92windowCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00449606 Relevance: 9.1, APIs: 6, Instructions: 91windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004416D1 Relevance: 9.1, APIs: 6, Instructions: 84COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0045552E Relevance: 9.1, APIs: 6, Instructions: 78windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00455080 Relevance: 9.1, APIs: 6, Instructions: 75windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00455212 Relevance: 9.1, APIs: 6, Instructions: 72windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00439326 Relevance: 9.1, APIs: 6, Instructions: 72processCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0041415E Relevance: 9.1, APIs: 6, Instructions: 71threadCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004555E0 Relevance: 9.1, APIs: 6, Instructions: 67windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004554C0 Relevance: 9.1, APIs: 6, Instructions: 61windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0043609C Relevance: 9.1, APIs: 6, Instructions: 59COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00436272 Relevance: 9.1, APIs: 6, Instructions: 59sleepCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004471EC Relevance: 9.0, APIs: 6, Instructions: 50COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0044CBD3 Relevance: 9.0, APIs: 6, Instructions: 49COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0044B64F Relevance: 9.0, APIs: 6, Instructions: 40synchronizationthreadCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0043604B Relevance: 9.0, APIs: 6, Instructions: 33serviceCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0045F132 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 128windowCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00437CA6 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 107libraryloaderCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004692E4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 98windowCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004412AE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 84windowlibraryCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00443009 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 82windowCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004609BD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76windowCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0045C277 Relevance: 7.6, APIs: 5, Instructions: 105COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0044796B Relevance: 7.6, APIs: 5, Instructions: 96COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00447BAF Relevance: 7.6, APIs: 5, Instructions: 95COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00447870 Relevance: 7.6, APIs: 5, Instructions: 94windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00448837 Relevance: 7.6, APIs: 5, Instructions: 89COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00449549 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00455014 Relevance: 7.6, APIs: 5, Instructions: 78COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00445719 Relevance: 7.6, APIs: 5, Instructions: 76windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00459DCF Relevance: 7.6, APIs: 5, Instructions: 71COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00464950 Relevance: 7.6, APIs: 5, Instructions: 68networkCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0044710F Relevance: 7.6, APIs: 5, Instructions: 67COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0043770A Relevance: 7.6, APIs: 5, Instructions: 56sleepCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0046FCC6 Relevance: 7.5, APIs: 5, Instructions: 49windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004555B8 Relevance: 7.5, APIs: 5, Instructions: 45windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00455505 Relevance: 7.5, APIs: 5, Instructions: 43windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0045551F Relevance: 7.5, APIs: 5, Instructions: 42windowCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0043315E Relevance: 7.5, APIs: 5, Instructions: 33COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004140CF Relevance: 7.5, APIs: 5, Instructions: 24threadCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00415601 Relevance: 7.5, APIs: 5, Instructions: 23threadCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0041567F Relevance: 7.5, APIs: 5, Instructions: 22threadCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004667A7 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 170shareCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00438A5D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154windowCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00465D41 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 119networkCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0044A7DC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116networkCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00451191 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00450D00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70windowCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0046BD4D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69networkCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004497A4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53windowCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004342A8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33memoryCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0043416A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004343CE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004343FD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0043442C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040ACA0 Relevance: 6.4, APIs: 4, Instructions: 368COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0041456C Relevance: 6.1, APIs: 4, Instructions: 137COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004781AE Relevance: 6.1, APIs: 4, Instructions: 135COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00441CB4 Relevance: 6.1, APIs: 4, Instructions: 112windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0045D070 Relevance: 6.1, APIs: 4, Instructions: 100fileCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0045058D Relevance: 6.1, APIs: 4, Instructions: 98COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004613E0 Relevance: 6.1, APIs: 4, Instructions: 90windowCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040E1E0 Relevance: 6.1, APIs: 4, Instructions: 82windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004727F8 Relevance: 6.1, APIs: 4, Instructions: 82COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0047721A Relevance: 6.1, APIs: 4, Instructions: 73COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00448C8B Relevance: 6.1, APIs: 4, Instructions: 73windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004588B0 Relevance: 6.1, APIs: 4, Instructions: 67networkCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00438D4E Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0043362D Relevance: 6.1, APIs: 4, Instructions: 54windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0044419B Relevance: 6.1, APIs: 4, Instructions: 53synchronizationthreadwindowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0043401C Relevance: 6.0, APIs: 4, Instructions: 50COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00436A1D Relevance: 6.0, APIs: 4, Instructions: 48COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00437AFE Relevance: 6.0, APIs: 4, Instructions: 44COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004555D6 Relevance: 6.0, APIs: 4, Instructions: 40windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0044B600 Relevance: 6.0, APIs: 4, Instructions: 33COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00447268 Relevance: 6.0, APIs: 4, Instructions: 32COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00471144 Relevance: 6.0, APIs: 4, Instructions: 28COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00471102 Relevance: 6.0, APIs: 4, Instructions: 28COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0041405D Relevance: 6.0, APIs: 4, Instructions: 19threadCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00444652 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104windowCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00448358 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99windowCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0045126C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74windowCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004515AB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00474827 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72sleepCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004647A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59networkCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004694DE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 56windowCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00442AFE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55networkCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004695F7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54windowCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0046956F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 53windowCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004560AD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36windowCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00442262 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17windowCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0044222A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17windowCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00439514 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 8windowCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|