Windows
Analysis Report
Urgent inquiry for quotation .exe
Overview
General Information
Detection
Score: | 100 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Classification
- System is w10x64
- Urgent inquiry for quotation .exe (PID: 3164 cmdline:
"C:\Users\ user\Deskt op\Urgent inquiry fo r quotatio n .exe" MD5: D64843EA87D7ABBE765B51AAE7BDD99B) - name.exe (PID: 2108 cmdline:
"C:\Users\ user\Deskt op\Urgent inquiry fo r quotatio n .exe" MD5: D64843EA87D7ABBE765B51AAE7BDD99B) - RegSvcs.exe (PID: 2304 cmdline:
"C:\Users\ user\Deskt op\Urgent inquiry fo r quotatio n .exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94) - conhost.exe (PID: 2056 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
- wscript.exe (PID: 5568 cmdline:
"C:\Window s\System32 \WScript.e xe" "C:\Us ers\user\A ppData\Roa ming\Micro soft\Windo ws\Start M enu\Progra ms\Startup \name.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80) - name.exe (PID: 5228 cmdline:
"C:\Users\ user\AppDa ta\Local\d irectory\n ame.exe" MD5: D64843EA87D7ABBE765B51AAE7BDD99B) - RegSvcs.exe (PID: 4080 cmdline:
"C:\Users\ user\AppDa ta\Local\d irectory\n ame.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)
- cleanup
Name | Description | Attribution | Blogpost URLs | Link |
---|---|---|---|---|
404 Keylogger, Snake Keylogger | Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram. | No Attribution |
{"C2 url": "https://api.telegram.org/bot7323823089:AAFBRsTW94zIpSoDS8yfGsotlQLqF2I6TU0/sendMessage"}
{"Exfil Mode": "SMTP", "Bot Token": "7323823089:AAFBRsTW94zIpSoDS8yfGsotlQLqF2I6TU0", "Chat id": "5013849544", "Email ID": "sales-nguyen@vvtrade.vn", "Password": "qVyP6qyv6MQCmZJBRs4t", "Host": "mail.vvtrade.vn", "Port": "587", "Version": "4.4"}
{"Exfil Mode": "Telegram", "Username": "sales-nguyen@vvtrade.vn", "Password": "qVyP6qyv6MQCmZJBRs4t", "Host": "mail.vvtrade.vn", "Port": "587", "Token": "7323823089:AAFBRsTW94zIpSoDS8yfGsotlQLqF2I6TU0", "Chat_id": "5013849544", "Version": "4.4"}
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_SnakeKeylogger | Yara detected Snake Keylogger | Joe Security | ||
JoeSecurity_SnakeKeylogger | Yara detected Snake Keylogger | Joe Security | ||
JoeSecurity_CredentialStealer | Yara detected Credential Stealer | Joe Security | ||
JoeSecurity_CredentialStealer | Yara detected Credential Stealer | Joe Security | ||
JoeSecurity_CredentialStealer | Yara detected Credential Stealer | Joe Security | ||
Click to see the 31 entries |
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_CredentialStealer | Yara detected Credential Stealer | Joe Security | ||
JoeSecurity_GenericDownloader_1 | Yara detected Generic Downloader | Joe Security | ||
JoeSecurity_VIPKeylogger | Yara detected VIP Keylogger | Joe Security | ||
JoeSecurity_TelegramRAT | Yara detected Telegram RAT | Joe Security | ||
Windows_Trojan_SnakeKeylogger_af3faa65 | unknown | unknown |
| |
Click to see the 21 entries |
System Summary |
---|
Source: | Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: |
Source: | Author: frack113: |
Source: | Author: Michael Haag: |
Data Obfuscation |
---|
Source: | Author: Joe Security: |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-10-08T08:52:04.463304+0200 | 2803305 | 3 | Unknown Traffic | 192.168.2.4 | 49732 | 188.114.96.3 | 443 | TCP |
2024-10-08T08:52:05.534418+0200 | 2803305 | 3 | Unknown Traffic | 192.168.2.4 | 49734 | 188.114.96.3 | 443 | TCP |
2024-10-08T08:52:12.179383+0200 | 2803305 | 3 | Unknown Traffic | 192.168.2.4 | 49746 | 188.114.96.3 | 443 | TCP |
2024-10-08T08:52:15.619966+0200 | 2803305 | 3 | Unknown Traffic | 192.168.2.4 | 49751 | 188.114.96.3 | 443 | TCP |
2024-10-08T08:52:18.845945+0200 | 2803305 | 3 | Unknown Traffic | 192.168.2.4 | 49761 | 188.114.96.3 | 443 | TCP |
2024-10-08T08:52:21.096341+0200 | 2803305 | 3 | Unknown Traffic | 192.168.2.4 | 49767 | 188.114.96.3 | 443 | TCP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-10-08T08:52:03.033395+0200 | 2803274 | 2 | Potentially Bad Traffic | 192.168.2.4 | 49730 | 193.122.130.0 | 80 | TCP |
2024-10-08T08:52:03.892001+0200 | 2803274 | 2 | Potentially Bad Traffic | 192.168.2.4 | 49730 | 193.122.130.0 | 80 | TCP |
2024-10-08T08:52:04.970144+0200 | 2803274 | 2 | Potentially Bad Traffic | 192.168.2.4 | 49733 | 193.122.130.0 | 80 | TCP |
2024-10-08T08:52:06.064044+0200 | 2803274 | 2 | Potentially Bad Traffic | 192.168.2.4 | 49735 | 193.122.130.0 | 80 | TCP |
2024-10-08T08:52:14.282834+0200 | 2803274 | 2 | Potentially Bad Traffic | 192.168.2.4 | 49748 | 193.122.130.0 | 80 | TCP |
2024-10-08T08:52:15.048271+0200 | 2803274 | 2 | Potentially Bad Traffic | 192.168.2.4 | 49748 | 193.122.130.0 | 80 | TCP |
2024-10-08T08:52:16.107487+0200 | 2803274 | 2 | Potentially Bad Traffic | 192.168.2.4 | 49753 | 193.122.130.0 | 80 | TCP |
Click to jump to signature section
AV Detection |
---|
Source: | Malware Configuration Extractor: | ||
Source: | Malware Configuration Extractor: | ||
Source: | Malware Configuration Extractor: |
Source: | Virustotal: | Perma Link | ||
Source: | Virustotal: | Perma Link | ||
Source: | Virustotal: | Perma Link | ||
Source: | Virustotal: | Perma Link | ||
Source: | Virustotal: | Perma Link |
Source: | ReversingLabs: | |||
Source: | Virustotal: | Perma Link |
Source: | ReversingLabs: | |||
Source: | Virustotal: | Perma Link |
Source: | Integrated Neural Analysis Model: |
Source: | Joe Sandbox ML: |
Source: | Joe Sandbox ML: |
Location Tracking |
---|
Source: | DNS query: |
Source: | Static PE information: |
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: |
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: |
Source: | Binary string: | ||
Source: | Binary string: |
Source: | Code function: | 0_2_00452126 | |
Source: | Code function: | 0_2_0045C999 | |
Source: | Code function: | 0_2_00436ADE | |
Source: | Code function: | 0_2_00434BEE | |
Source: | Code function: | 0_2_00436D2D | |
Source: | Code function: | 0_2_00442E1F | |
Source: | Code function: | 0_2_0045DD7C | |
Source: | Code function: | 0_2_0044BD29 | |
Source: | Code function: | 0_2_00475FE5 | |
Source: | Code function: | 0_2_0044BF8D | |
Source: | Code function: | 1_2_00452126 | |
Source: | Code function: | 1_2_0045C999 | |
Source: | Code function: | 1_2_00436ADE | |
Source: | Code function: | 1_2_00434BEE | |
Source: | Code function: | 1_2_00436D2D | |
Source: | Code function: | 1_2_00442E1F | |
Source: | Code function: | 1_2_0045DD7C | |
Source: | Code function: | 1_2_0044BD29 | |
Source: | Code function: | 1_2_00475FE5 | |
Source: | Code function: | 1_2_0044BF8D | |
Source: | Code function: | 4_2_00452126 | |
Source: | Code function: | 4_2_0045C999 | |
Source: | Code function: | 4_2_00436ADE | |
Source: | Code function: | 4_2_00434BEE | |
Source: | Code function: | 4_2_00436D2D | |
Source: | Code function: | 4_2_00442E1F | |
Source: | Code function: | 4_2_0045DD7C | |
Source: | Code function: | 4_2_0044BD29 | |
Source: | Code function: | 4_2_00475FE5 | |
Source: | Code function: | 4_2_0044BF8D |
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior |
Source: | Code function: | 2_2_014CF630 | |
Source: | Code function: | 2_2_014CFA88 | |
Source: | Code function: | 2_2_06BD2DC8 | |
Source: | Code function: | 2_2_06BD0B30 | |
Source: | Code function: | 2_2_06BD0B30 | |
Source: | Code function: | 2_2_06BD2968 | |
Source: | Code function: | 2_2_06BDE6B0 | |
Source: | Code function: | 2_2_06BDDE00 | |
Source: | Code function: | 2_2_06BDEF60 | |
Source: | Code function: | 2_2_06BDCCA0 | |
Source: | Code function: | 2_2_06BD2DBF | |
Source: | Code function: | 2_2_06BDD550 | |
Source: | Code function: | 2_2_06BDE258 | |
Source: | Code function: | 2_2_06BDF3B8 | |
Source: | Code function: | 2_2_06BDEB08 | |
Source: | Code function: | 2_2_06BDD0F8 | |
Source: | Code function: | 2_2_06BDF810 | |
Source: | Code function: | 2_2_06BD0040 | |
Source: | Code function: | 2_2_06BDD9A8 | |
Source: | Code function: | 2_2_06BD310E | |
Source: | Code function: | 5_2_0294F631 | |
Source: | Code function: | 5_2_0294FA88 | |
Source: | Code function: | 5_2_05697720 | |
Source: | Code function: | 5_2_05698B58 | |
Source: | Code function: | 5_2_05690D48 | |
Source: | Code function: | 5_2_056915F8 | |
Source: | Code function: | 5_2_056965C0 | |
Source: | Code function: | 5_2_0569E588 | |
Source: | Code function: | 5_2_0569C598 | |
Source: | Code function: | 5_2_0569DC68 | |
Source: | Code function: | 5_2_0569BC78 | |
Source: | Code function: | 5_2_0569AC31 | |
Source: | Code function: | 5_2_05690498 | |
Source: | Code function: | 5_2_05692758 | |
Source: | Code function: | 5_2_0569B7E8 | |
Source: | Code function: | 5_2_0569F7C8 | |
Source: | Code function: | 5_2_0569D7D8 | |
Source: | Code function: | 5_2_05695780 | |
Source: | Code function: | 5_2_05696E70 | |
Source: | Code function: | 5_2_05694620 | |
Source: | Code function: | 5_2_0569AEC8 | |
Source: | Code function: | 5_2_05694ED0 | |
Source: | Code function: | 5_2_05691EA8 | |
Source: | Code function: | 5_2_0569EEA8 | |
Source: | Code function: | 5_2_0569CEB8 | |
Source: | Code function: | 5_2_0569C108 | |
Source: | Code function: | 5_2_056941C8 | |
Source: | Code function: | 5_2_056911A0 | |
Source: | Code function: | 5_2_05690040 | |
Source: | Code function: | 5_2_05696030 | |
Source: | Code function: | 5_2_05693008 | |
Source: | Code function: | 5_2_0569E0F8 | |
Source: | Code function: | 5_2_056908F0 | |
Source: | Code function: | 5_2_0569D348 | |
Source: | Code function: | 5_2_0569B358 | |
Source: | Code function: | 5_2_05695328 | |
Source: | Code function: | 5_2_0569F338 | |
Source: | Code function: | 5_2_05692300 | |
Source: | Code function: | 5_2_05695BD8 | |
Source: | Code function: | 5_2_05692BB0 | |
Source: | Code function: | 5_2_05694A78 | |
Source: | Code function: | 5_2_05691A50 | |
Source: | Code function: | 5_2_0569CA28 | |
Source: | Code function: | 5_2_05696A18 | |
Source: | Code function: | 5_2_0569EA18 | |
Source: | Code function: | 5_2_056972C8 |
Networking |
---|
Source: | DNS query: | ||
Source: | DNS query: |
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: |
Source: | TCP traffic: |
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: |
Source: | IP Address: | ||
Source: | IP Address: | ||
Source: | IP Address: | ||
Source: | IP Address: |
Source: | ASN Name: | ||
Source: | ASN Name: | ||
Source: | ASN Name: |
Source: | JA3 fingerprint: | ||
Source: | JA3 fingerprint: |
Source: | DNS query: | ||
Source: | DNS query: |
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: |
Source: | TCP traffic: |
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: |
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: |
Source: | UDP traffic detected without corresponding DNS query: | ||
Source: | UDP traffic detected without corresponding DNS query: | ||
Source: | UDP traffic detected without corresponding DNS query: | ||
Source: | UDP traffic detected without corresponding DNS query: | ||
Source: | UDP traffic detected without corresponding DNS query: |
Source: | Code function: | 0_2_0044289D |
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: |
Source: | DNS traffic detected: | ||
Source: | DNS traffic detected: | ||
Source: | DNS traffic detected: | ||
Source: | DNS traffic detected: |
Source: | HTTP traffic detected: |
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: |
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: |
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: |
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: |
Source: | Code function: | 0_2_00459FFF |
Source: | Code function: | 0_2_00459FFF | |
Source: | Code function: | 1_2_00459FFF | |
Source: | Code function: | 4_2_00459FFF |
Source: | Code function: | 0_2_00456354 |
Source: | Code function: | 0_2_0047C08E | |
Source: | Code function: | 1_2_0047C08E | |
Source: | Code function: | 4_2_0047C08E |
System Summary |
---|
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: |
Source: | Static PE information: |
Source: | COM Object queried: | Jump to behavior |
Source: | Code function: | 0_2_00434D50 |
Source: | Code function: | 0_2_004461ED |
Source: | Code function: | 0_2_004364AA | |
Source: | Code function: | 1_2_004364AA | |
Source: | Code function: | 4_2_004364AA |
Source: | Code function: | 0_2_00409A40 | |
Source: | Code function: | 0_2_00412038 | |
Source: | Code function: | 0_2_0047E1FA | |
Source: | Code function: | 0_2_0041A46B | |
Source: | Code function: | 0_2_0041240C | |
Source: | Code function: | 0_2_004045E0 | |
Source: | Code function: | 0_2_00412818 | |
Source: | Code function: | 0_2_0047CBF0 | |
Source: | Code function: | 0_2_0044EBBC | |
Source: | Code function: | 0_2_00412C38 | |
Source: | Code function: | 0_2_0044ED9A | |
Source: | Code function: | 0_2_00424F70 | |
Source: | Code function: | 0_2_0041AF0D | |
Source: | Code function: | 0_2_00427161 | |
Source: | Code function: | 0_2_004212BE | |
Source: | Code function: | 0_2_00443390 | |
Source: | Code function: | 0_2_00443391 | |
Source: | Code function: | 0_2_0041D750 | |
Source: | Code function: | 0_2_004037E0 | |
Source: | Code function: | 0_2_00427859 | |
Source: | Code function: | 0_2_0040F890 | |
Source: | Code function: | 0_2_0042397B | |
Source: | Code function: | 0_2_00411B63 | |
Source: | Code function: | 0_2_00423EBF | |
Source: | Code function: | 0_2_03F68038 | |
Source: | Code function: | 1_2_00409A40 | |
Source: | Code function: | 1_2_00412038 | |
Source: | Code function: | 1_2_0047E1FA | |
Source: | Code function: | 1_2_0041A46B | |
Source: | Code function: | 1_2_0041240C | |
Source: | Code function: | 1_2_004045E0 | |
Source: | Code function: | 1_2_00412818 | |
Source: | Code function: | 1_2_0047CBF0 | |
Source: | Code function: | 1_2_0044EBBC | |
Source: | Code function: | 1_2_00412C38 | |
Source: | Code function: | 1_2_00490D70 | |
Source: | Code function: | 1_2_0044ED9A | |
Source: | Code function: | 1_2_00424F70 | |
Source: | Code function: | 1_2_0041AF0D | |
Source: | Code function: | 1_2_00427161 | |
Source: | Code function: | 1_2_004212BE | |
Source: | Code function: | 1_2_00443390 | |
Source: | Code function: | 1_2_00443391 | |
Source: | Code function: | 1_2_0041D750 | |
Source: | Code function: | 1_2_004037E0 | |
Source: | Code function: | 1_2_00427859 | |
Source: | Code function: | 1_2_0040F890 | |
Source: | Code function: | 1_2_0042397B | |
Source: | Code function: | 1_2_00411B63 | |
Source: | Code function: | 1_2_00423EBF | |
Source: | Code function: | 1_2_03F98038 | |
Source: | Code function: | 1_2_03F94786 | |
Source: | Code function: | 1_2_03F94571 | |
Source: | Code function: | 2_2_014CC19B | |
Source: | Code function: | 2_2_014C5370 | |
Source: | Code function: | 2_2_014CD278 | |
Source: | Code function: | 2_2_014CC468 | |
Source: | Code function: | 2_2_014CC738 | |
Source: | Code function: | 2_2_014CE988 | |
Source: | Code function: | 2_2_014C69A0 | |
Source: | Code function: | 2_2_014CCA08 | |
Source: | Code function: | 2_2_014C9DE0 | |
Source: | Code function: | 2_2_014CCCD8 | |
Source: | Code function: | 2_2_014C6FC8 | |
Source: | Code function: | 2_2_014CCFAA | |
Source: | Code function: | 2_2_014C3E09 | |
Source: | Code function: | 2_2_014CF630 | |
Source: | Code function: | 2_2_014CE97A | |
Source: | Code function: | 2_2_014C29E0 | |
Source: | Code function: | 2_2_014CFA88 | |
Source: | Code function: | 2_2_06BD1E80 | |
Source: | Code function: | 2_2_06BD17A0 | |
Source: | Code function: | 2_2_06BD9C18 | |
Source: | Code function: | 2_2_06BD9548 | |
Source: | Code function: | 2_2_06BD8BA0 | |
Source: | Code function: | 2_2_06BD0B30 | |
Source: | Code function: | 2_2_06BD5028 | |
Source: | Code function: | 2_2_06BD2968 | |
Source: | Code function: | 2_2_06BDE6B0 | |
Source: | Code function: | 2_2_06BDE6AF | |
Source: | Code function: | 2_2_06BDDE00 | |
Source: | Code function: | 2_2_06BD1E70 | |
Source: | Code function: | 2_2_06BD178F | |
Source: | Code function: | 2_2_06BDEF60 | |
Source: | Code function: | 2_2_06BDEF51 | |
Source: | Code function: | 2_2_06BDCCA0 | |
Source: | Code function: | 2_2_06BDCC8F | |
Source: | Code function: | 2_2_06BDFC68 | |
Source: | Code function: | 2_2_06BDDDFF | |
Source: | Code function: | 2_2_06BDD550 | |
Source: | Code function: | 2_2_06BDD540 | |
Source: | Code function: | 2_2_06BDEAF8 | |
Source: | Code function: | 2_2_06BDE258 | |
Source: | Code function: | 2_2_06BDE249 | |
Source: | Code function: | 2_2_06BDF3B8 | |
Source: | Code function: | 2_2_06BDF3A8 | |
Source: | Code function: | 2_2_06BD8B90 | |
Source: | Code function: | 2_2_06BD9328 | |
Source: | Code function: | 2_2_06BD0B20 | |
Source: | Code function: | 2_2_06BDEB08 | |
Source: | Code function: | 2_2_06BDD0F8 | |
Source: | Code function: | 2_2_06BD5018 | |
Source: | Code function: | 2_2_06BDF810 | |
Source: | Code function: | 2_2_06BD0006 | |
Source: | Code function: | 2_2_06BDF801 | |
Source: | Code function: | 2_2_06BD0040 | |
Source: | Code function: | 2_2_06BDD9A8 | |
Source: | Code function: | 2_2_06BDD999 | |
Source: | Code function: | 2_2_06BD295B | |
Source: | Code function: | 4_2_00409A40 | |
Source: | Code function: | 4_2_00412038 | |
Source: | Code function: | 4_2_0047E1FA | |
Source: | Code function: | 4_2_0041A46B | |
Source: | Code function: | 4_2_0041240C | |
Source: | Code function: | 4_2_004045E0 | |
Source: | Code function: | 4_2_00412818 | |
Source: | Code function: | 4_2_0047CBF0 | |
Source: | Code function: | 4_2_0044EBBC | |
Source: | Code function: | 4_2_00412C38 | |
Source: | Code function: | 4_2_0044ED9A | |
Source: | Code function: | 4_2_00424F70 | |
Source: | Code function: | 4_2_0041AF0D | |
Source: | Code function: | 4_2_00427161 | |
Source: | Code function: | 4_2_004212BE | |
Source: | Code function: | 4_2_00443390 | |
Source: | Code function: | 4_2_00443391 | |
Source: | Code function: | 4_2_0041D750 | |
Source: | Code function: | 4_2_004037E0 | |
Source: | Code function: | 4_2_00427859 | |
Source: | Code function: | 4_2_0040F890 | |
Source: | Code function: | 4_2_0042397B | |
Source: | Code function: | 4_2_00411B63 | |
Source: | Code function: | 4_2_00423EBF | |
Source: | Code function: | 4_2_03F88038 | |
Source: | Code function: | 5_2_0294D278 | |
Source: | Code function: | 5_2_02945370 | |
Source: | Code function: | 5_2_0294A088 | |
Source: | Code function: | 5_2_02947118 | |
Source: | Code function: | 5_2_0294C146 | |
Source: | Code function: | 5_2_0294C738 | |
Source: | Code function: | 5_2_0294C468 | |
Source: | Code function: | 5_2_0294CA08 | |
Source: | Code function: | 5_2_0294E988 | |
Source: | Code function: | 5_2_029469A0 | |
Source: | Code function: | 5_2_0294CFAA | |
Source: | Code function: | 5_2_0294CCD8 | |
Source: | Code function: | 5_2_0294F631 | |
Source: | Code function: | 5_2_02943A91 | |
Source: | Code function: | 5_2_0294FA88 | |
Source: | Code function: | 5_2_029429EC | |
Source: | Code function: | 5_2_0294E97A | |
Source: | Code function: | 5_2_02943E09 | |
Source: | Code function: | 5_2_05697D78 | |
Source: | Code function: | 5_2_05697720 | |
Source: | Code function: | 5_2_05698B58 | |
Source: | Code function: | 5_2_0569E578 | |
Source: | Code function: | 5_2_05690D48 | |
Source: | Code function: | 5_2_05690D38 | |
Source: | Code function: | 5_2_056915E9 | |
Source: | Code function: | 5_2_056915F8 | |
Source: | Code function: | 5_2_056965C0 | |
Source: | Code function: | 5_2_0569E588 | |
Source: | Code function: | 5_2_0569C588 | |
Source: | Code function: | 5_2_0569C598 | |
Source: | Code function: | 5_2_0569DC68 | |
Source: | Code function: | 5_2_05693460 | |
Source: | Code function: | 5_2_0569BC67 | |
Source: | Code function: | 5_2_0569BC78 | |
Source: | Code function: | 5_2_0569FC48 | |
Source: | Code function: | 5_2_0569FC58 | |
Source: | Code function: | 5_2_0569DC57 | |
Source: | Code function: | 5_2_05690488 | |
Source: | Code function: | 5_2_05690498 | |
Source: | Code function: | 5_2_05692748 | |
Source: | Code function: | 5_2_05692758 | |
Source: | Code function: | 5_2_05697711 | |
Source: | Code function: | 5_2_0569B7E8 | |
Source: | Code function: | 5_2_05692FF8 | |
Source: | Code function: | 5_2_0569D7C9 | |
Source: | Code function: | 5_2_0569F7C8 | |
Source: | Code function: | 5_2_0569D7D8 | |
Source: | Code function: | 5_2_0569B7DA | |
Source: | Code function: | 5_2_0569F7B9 | |
Source: | Code function: | 5_2_05695780 | |
Source: | Code function: | 5_2_05696E60 | |
Source: | Code function: | 5_2_05696E70 | |
Source: | Code function: | 5_2_05694620 | |
Source: | Code function: | 5_2_05694613 | |
Source: | Code function: | 5_2_0569AEC8 | |
Source: | Code function: | 5_2_05694EC3 | |
Source: | Code function: | 5_2_05694ED0 | |
Source: | Code function: | 5_2_05691EA8 | |
Source: | Code function: | 5_2_0569EEA8 | |
Source: | Code function: | 5_2_0569CEA7 | |
Source: | Code function: | 5_2_0569CEB8 | |
Source: | Code function: | 5_2_0569AEB7 | |
Source: | Code function: | 5_2_05691E98 | |
Source: | Code function: | 5_2_0569EE97 | |
Source: | Code function: | 5_2_0569C108 | |
Source: | Code function: | 5_2_056941C8 | |
Source: | Code function: | 5_2_056911A0 | |
Source: | Code function: | 5_2_056941B8 | |
Source: | Code function: | 5_2_05691190 | |
Source: | Code function: | 5_2_05690040 | |
Source: | Code function: | 5_2_05696020 | |
Source: | Code function: | 5_2_05696030 | |
Source: | Code function: | 5_2_05693008 | |
Source: | Code function: | 5_2_05690006 | |
Source: | Code function: | 5_2_0569E0E8 | |
Source: | Code function: | 5_2_056908E1 | |
Source: | Code function: | 5_2_0569A0E0 | |
Source: | Code function: | 5_2_0569E0F8 | |
Source: | Code function: | 5_2_0569C0F8 | |
Source: | Code function: | 5_2_056908F0 | |
Source: | Code function: | 5_2_0569A0D0 | |
Source: | Code function: | 5_2_05698B49 | |
Source: | Code function: | 5_2_0569D348 | |
Source: | Code function: | 5_2_0569B348 | |
Source: | Code function: | 5_2_0569B358 | |
Source: | Code function: | 5_2_05695328 | |
Source: | Code function: | 5_2_0569F328 | |
Source: | Code function: | 5_2_0569F338 | |
Source: | Code function: | 5_2_0569D337 | |
Source: | Code function: | 5_2_05692300 | |
Source: | Code function: | 5_2_05695318 | |
Source: | Code function: | 5_2_05695BCB | |
Source: | Code function: | 5_2_05695BD8 | |
Source: | Code function: | 5_2_05692BA1 | |
Source: | Code function: | 5_2_05692BB0 | |
Source: | Code function: | 5_2_05694A68 | |
Source: | Code function: | 5_2_05694A78 | |
Source: | Code function: | 5_2_05691A40 | |
Source: | Code function: | 5_2_05691A50 | |
Source: | Code function: | 5_2_0569CA28 | |
Source: | Code function: | 5_2_05696A0B | |
Source: | Code function: | 5_2_0569EA07 | |
Source: | Code function: | 5_2_05696A18 | |
Source: | Code function: | 5_2_0569EA18 | |
Source: | Code function: | 5_2_0569CA17 | |
Source: | Code function: | 5_2_056922F1 | |
Source: | Code function: | 5_2_056972C8 | |
Source: | Code function: | 5_2_056972B8 |
Source: | Static PE information: |
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: |
Source: | Cryptographic APIs: | ||
Source: | Cryptographic APIs: | ||
Source: | Cryptographic APIs: | ||
Source: | Cryptographic APIs: | ||
Source: | Cryptographic APIs: | ||
Source: | Cryptographic APIs: |
Source: | Base64 encoded string: | ||
Source: | Base64 encoded string: |
Source: | Classification label: |
Source: | Code function: | 0_2_0044AF5C |
Source: | Code function: | 0_2_00464422 | |
Source: | Code function: | 0_2_004364AA | |
Source: | Code function: | 1_2_00464422 | |
Source: | Code function: | 1_2_004364AA | |
Source: | Code function: | 4_2_00464422 | |
Source: | Code function: | 4_2_004364AA |
Source: | Code function: | 0_2_0045D517 |
Source: | Code function: | 0_2_0043701F |
Source: | Code function: | 0_2_0047A999 |
Source: | Code function: | 0_2_0043614F |
Source: | File created: | Jump to behavior |
Source: | Mutant created: | ||
Source: | Mutant created: |
Source: | File created: | Jump to behavior |
Source: | Process created: |
Source: | Static PE information: |
Source: | File read: | Jump to behavior |
Source: | Key opened: | Jump to behavior |
Source: | ReversingLabs: | ||
Source: | Virustotal: |
Source: | File read: | Jump to behavior |
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior |
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior |
Source: | Key value queried: | Jump to behavior |
Source: | Key opened: | Jump to behavior |
Source: | Static file information: |
Source: | Binary string: | ||
Source: | Binary string: |
Source: | Code function: | 0_2_0040EB70 |
Source: | Static PE information: | ||
Source: | Static PE information: |
Source: | Code function: | 0_2_004171E4 | |
Source: | Code function: | 1_2_004171E4 | |
Source: | Code function: | 2_2_014C9D55 | |
Source: | Code function: | 2_2_06BD9244 | |
Source: | Code function: | 4_2_004171E4 |
Source: | File created: | Jump to dropped file |
Boot Survival |
---|
Source: | File created: | Jump to dropped file |
Source: | File created: | Jump to behavior |
Source: | File created: | Jump to behavior |
Source: | Code function: | 0_2_004772DE | |
Source: | Code function: | 0_2_004375B0 | |
Source: | Code function: | 1_2_004772DE | |
Source: | Code function: | 1_2_004375B0 | |
Source: | Code function: | 4_2_004772DE | |
Source: | Code function: | 4_2_004375B0 |
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior |
Malware Analysis System Evasion |
---|
Source: | Code function: | 0_2_00444078 | |
Source: | Code function: | 1_2_00444078 | |
Source: | Code function: | 4_2_00444078 |
Source: | API/Special instruction interceptor: | ||
Source: | API/Special instruction interceptor: |
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior |
Source: | Window found: | Jump to behavior |
Source: | Window / User API: | Jump to behavior | ||
Source: | Window / User API: | Jump to behavior | ||
Source: | Window / User API: | Jump to behavior | ||
Source: | Window / User API: | Jump to behavior |
Source: | API coverage: | ||
Source: | API coverage: | ||
Source: | API coverage: |
Source: | Last function: |
Source: | Code function: | 0_2_00452126 | |
Source: | Code function: | 0_2_0045C999 | |
Source: | Code function: | 0_2_00436ADE | |
Source: | Code function: | 0_2_00434BEE | |
Source: | Code function: | 0_2_00436D2D | |
Source: | Code function: | 0_2_00442E1F | |
Source: | Code function: | 0_2_0045DD7C | |
Source: | Code function: | 0_2_0044BD29 | |
Source: | Code function: | 0_2_00475FE5 | |
Source: | Code function: | 0_2_0044BF8D | |
Source: | Code function: | 1_2_00452126 | |
Source: | Code function: | 1_2_0045C999 | |
Source: | Code function: | 1_2_00436ADE | |
Source: | Code function: | 1_2_00434BEE | |
Source: | Code function: | 1_2_00436D2D | |
Source: | Code function: | 1_2_00442E1F | |
Source: | Code function: | 1_2_0045DD7C | |
Source: | Code function: | 1_2_0044BD29 | |
Source: | Code function: | 1_2_00475FE5 | |
Source: | Code function: | 1_2_0044BF8D | |
Source: | Code function: | 4_2_00452126 | |
Source: | Code function: | 4_2_0045C999 | |
Source: | Code function: | 4_2_00436ADE | |
Source: | Code function: | 4_2_00434BEE | |
Source: | Code function: | 4_2_00436D2D | |
Source: | Code function: | 4_2_00442E1F | |
Source: | Code function: | 4_2_0045DD7C | |
Source: | Code function: | 4_2_0044BD29 | |
Source: | Code function: | 4_2_00475FE5 | |
Source: | Code function: | 4_2_0044BF8D |
Source: | Code function: | 0_2_0040E470 |
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior |
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior |
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: |
Source: | Code function: | 2_2_06BD9548 |
Source: | Code function: | 0_2_0045A259 |
Source: | Code function: | 0_2_0040D6D0 |
Source: | Code function: | 0_2_0040EB70 |
Source: | Code function: | 0_2_03F66868 | |
Source: | Code function: | 0_2_03F67F28 | |
Source: | Code function: | 0_2_03F67EC8 | |
Source: | Code function: | 1_2_03F96868 | |
Source: | Code function: | 1_2_03F97F28 | |
Source: | Code function: | 1_2_03F97EC8 | |
Source: | Code function: | 4_2_03F86868 | |
Source: | Code function: | 4_2_03F87F28 | |
Source: | Code function: | 4_2_03F87EC8 |
Source: | Code function: | 0_2_00426DA1 |
Source: | Code function: | 0_2_0042202E | |
Source: | Code function: | 0_2_004230F5 | |
Source: | Code function: | 0_2_00417D93 | |
Source: | Code function: | 0_2_00421FA7 | |
Source: | Code function: | 1_2_0042202E | |
Source: | Code function: | 1_2_004230F5 | |
Source: | Code function: | 1_2_00417D93 | |
Source: | Code function: | 1_2_00421FA7 | |
Source: | Code function: | 4_2_0042202E | |
Source: | Code function: | 4_2_004230F5 | |
Source: | Code function: | 4_2_00417D93 | |
Source: | Code function: | 4_2_00421FA7 |
Source: | Memory allocated: | Jump to behavior |
HIPS / PFW / Operating System Protection Evasion |
---|
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior |
Source: | Memory written: | Jump to behavior | ||
Source: | Memory written: | Jump to behavior |
Source: | Code function: | 0_2_0043916A |
Source: | Code function: | 0_2_0040D6D0 |
Source: | Code function: | 0_2_004375B0 |
Source: | Code function: | 0_2_00436431 |
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior |
Source: | Code function: | 0_2_00445DD3 |
Source: | Binary or memory string: | ||
Source: | Binary or memory string: |
Source: | Code function: | 0_2_00410D10 |
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior |
Source: | Code function: | 0_2_004223BC |
Source: | Code function: | 0_2_004711D2 |
Source: | Code function: | 0_2_0042039F |
Source: | Code function: | 0_2_0040E470 |
Source: | Key value queried: | Jump to behavior |
Source: | WMI Queries: | ||
Source: | WMI Queries: |
Stealing of Sensitive Information |
---|
Source: | File source: | ||
Source: | File source: |
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: |
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: |
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior |
Source: | File opened: | Jump to behavior | ||
Source: | Key opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | Key opened: | Jump to behavior |
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: |
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: |
Remote Access Functionality |
---|
Source: | File source: | ||
Source: | File source: |
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: |
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: |
Source: | Code function: | 0_2_004741BB | |
Source: | Code function: | 0_2_0046483C | |
Source: | Code function: | 0_2_0047AD92 | |
Source: | Code function: | 1_2_004741BB | |
Source: | Code function: | 1_2_0046483C | |
Source: | Code function: | 1_2_0047AD92 | |
Source: | Code function: | 4_2_004741BB | |
Source: | Code function: | 4_2_0046483C | |
Source: | Code function: | 4_2_0047AD92 |
Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Gather Victim Identity Information | 111 Scripting | 2 Valid Accounts | 1 Windows Management Instrumentation | 111 Scripting | 1 Exploitation for Privilege Escalation | 11 Disable or Modify Tools | 1 OS Credential Dumping | 2 System Time Discovery | Remote Services | 11 Archive Collected Data | 1 Web Service | Exfiltration Over Other Network Medium | 1 System Shutdown/Reboot |
Credentials | Domains | Default Accounts | 1 Native API | 1 DLL Side-Loading | 1 DLL Side-Loading | 11 Deobfuscate/Decode Files or Information | 21 Input Capture | 1 Account Discovery | Remote Desktop Protocol | 1 Data from Local System | 4 Ingress Tool Transfer | Exfiltration Over Bluetooth | Network Denial of Service |
Email Addresses | DNS Server | Domain Accounts | At | 2 Valid Accounts | 2 Valid Accounts | 31 Obfuscated Files or Information | Security Account Manager | 3 File and Directory Discovery | SMB/Windows Admin Shares | 1 Email Collection | 11 Encrypted Channel | Automated Exfiltration | Data Encrypted for Impact |
Employee Names | Virtual Private Server | Local Accounts | Cron | 2 Registry Run Keys / Startup Folder | 21 Access Token Manipulation | 1 DLL Side-Loading | NTDS | 127 System Information Discovery | Distributed Component Object Model | 21 Input Capture | 1 Non-Standard Port | Traffic Duplication | Data Destruction |
Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | 212 Process Injection | 1 Masquerading | LSA Secrets | 331 Security Software Discovery | SSH | 2 Clipboard Data | 4 Non-Application Layer Protocol | Scheduled Transfer | Data Encrypted for Impact |
Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | 2 Registry Run Keys / Startup Folder | 2 Valid Accounts | Cached Domain Credentials | 11 Virtualization/Sandbox Evasion | VNC | GUI Input Capture | 25 Application Layer Protocol | Data Transfer Size Limits | Service Stop |
DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | 11 Virtualization/Sandbox Evasion | DCSync | 2 Process Discovery | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
Network Trust Dependencies | Serverless | Drive-by Compromise | Container Orchestration Job | Scheduled Task/Job | Scheduled Task/Job | 21 Access Token Manipulation | Proc Filesystem | 11 Application Window Discovery | Cloud Services | Credential API Hooking | Application Layer Protocol | Exfiltration Over Alternative Protocol | Defacement |
Network Topology | Malvertising | Exploit Public-Facing Application | Command and Scripting Interpreter | At | At | 212 Process Injection | /etc/passwd and /etc/shadow | 1 System Owner/User Discovery | Direct Cloud VM Connections | Data Staged | Web Protocols | Exfiltration Over Symmetric Encrypted Non-C2 Protocol | Internal Defacement |
IP Addresses | Compromise Infrastructure | Supply Chain Compromise | PowerShell | Cron | Cron | Dynamic API Resolution | Network Sniffing | 1 System Network Configuration Discovery | Shared Webroot | Local Data Staging | File Transfer Protocols | Exfiltration Over Asymmetric Encrypted Non-C2 Protocol | External Defacement |
This section contains all screenshots as thumbnails, including those not shown in the slideshow.
Source | Detection | Scanner | Label | Link |
---|---|---|---|---|
26% | ReversingLabs | Win32.Trojan.Generic | ||
29% | Virustotal | Browse | ||
100% | Joe Sandbox ML |
Source | Detection | Scanner | Label | Link |
---|---|---|---|---|
100% | Joe Sandbox ML | |||
26% | ReversingLabs | Win32.Trojan.Generic | ||
29% | Virustotal | Browse |
Source | Detection | Scanner | Label | Link |
---|---|---|---|---|
0% | Virustotal | Browse | ||
2% | Virustotal | Browse | ||
0% | Virustotal | Browse | ||
0% | Virustotal | Browse | ||
0% | Virustotal | Browse |
Source | Detection | Scanner | Label | Link |
---|---|---|---|---|
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
1% | Virustotal | Browse | ||
2% | Virustotal | Browse | ||
0% | Virustotal | Browse | ||
1% | Virustotal | Browse | ||
4% | Virustotal | Browse | ||
0% | Virustotal | Browse | ||
1% | Virustotal | Browse | ||
18% | Virustotal | Browse | ||
15% | Virustotal | Browse | ||
2% | Virustotal | Browse | ||
0% | Virustotal | Browse | ||
7% | Virustotal | Browse | ||
14% | Virustotal | Browse | ||
0% | Virustotal | Browse | ||
2% | Virustotal | Browse | ||
7% | Virustotal | Browse | ||
0% | Virustotal | Browse |
Name | IP | Active | Malicious | Antivirus Detection | Reputation |
---|---|---|---|---|---|
reallyfreegeoip.org | 188.114.96.3 | true | true |
| unknown |
api.telegram.org | 149.154.167.220 | true | true |
| unknown |
mail.vvtrade.vn | 118.69.190.131 | true | true |
| unknown |
checkip.dyndns.com | 193.122.130.0 | true | false |
| unknown |
checkip.dyndns.org | unknown | unknown | true |
| unknown |
Name | Malicious | Antivirus Detection | Reputation |
---|---|---|---|
false | unknown | ||
false | unknown | ||
false |
| unknown | |
false | unknown | ||
false |
| unknown |
Name | Source | Malicious | Antivirus Detection | Reputation |
---|---|---|---|---|
false |
| unknown | ||
true |
| unknown | ||
true |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false | unknown | |||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false | unknown | |||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
---|---|---|---|---|---|---|
149.154.167.220 | api.telegram.org | United Kingdom | 62041 | TELEGRAMRU | true | |
188.114.96.3 | reallyfreegeoip.org | European Union | 13335 | CLOUDFLARENETUS | true | |
193.122.130.0 | checkip.dyndns.com | United States | 31898 | ORACLE-BMC-31898US | false | |
118.69.190.131 | mail.vvtrade.vn | Viet Nam | 18403 | FPT-AS-APTheCorporationforFinancingPromotingTechnolo | true |
Joe Sandbox version: | 41.0.0 Charoite |
Analysis ID: | 1528667 |
Start date and time: | 2024-10-08 08:51:05 +02:00 |
Joe Sandbox product: | CloudBasic |
Overall analysis duration: | 0h 10m 11s |
Hypervisor based Inspection enabled: | false |
Report type: | full |
Cookbook file name: | default.jbs |
Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
Number of analysed new started processes analysed: | 11 |
Number of new started drivers analysed: | 0 |
Number of existing processes analysed: | 0 |
Number of existing drivers analysed: | 0 |
Number of injected processes analysed: | 0 |
Technologies: |
|
Analysis Mode: | default |
Analysis stop reason: | Timeout |
Sample name: | Urgent inquiry for quotation .exe |
Detection: | MAL |
Classification: | mal100.troj.spyw.expl.evad.winEXE@11/3@5/4 |
EGA Information: |
|
HCA Information: |
|
Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
- Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
- Execution Graph export aborted for target RegSvcs.exe, PID 4080 because it is empty
- Not all processes where analyzed, report is missing behavior information
- Report size exceeded maximum capacity and may have missing behavior information.
- Report size exceeded maximum capacity and may have missing disassembly code.
- Report size getting too big, too many NtOpenKeyEx calls found.
- Report size getting too big, too many NtProtectVirtualMemory calls found.
- Report size getting too big, too many NtQueryValueKey calls found.
- Report size getting too big, too many NtReadVirtualMemory calls found.
Time | Type | Description |
---|---|---|
02:52:02 | API Interceptor | |
07:52:01 | Autostart |
Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
---|---|---|---|---|---|---|
149.154.167.220 | Get hash | malicious | GuLoader, Snake Keylogger | Browse | ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse | |||
Get hash | malicious | MassLogger RAT | Browse | |||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse | |||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse | |||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse | |||
Get hash | malicious | MassLogger RAT, Snake Keylogger, VIP Keylogger | Browse | |||
Get hash | malicious | GuLoader, Snake Keylogger | Browse | |||
Get hash | malicious | AgentTesla | Browse | |||
Get hash | malicious | DarkTortilla, Snake Keylogger | Browse | |||
188.114.96.3 | Get hash | malicious | FormBook | Browse |
| |
Get hash | malicious | Pony | Browse |
| ||
Get hash | malicious | FormBook | Browse |
| ||
Get hash | malicious | HTMLPhisher | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | RHADAMANTHYS | Browse |
| ||
193.122.130.0 | Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| |
Get hash | malicious | MassLogger RAT, Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger | Browse |
|
Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
---|---|---|---|---|---|---|
reallyfreegeoip.org | Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| |
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger | Browse |
| ||
Get hash | malicious | MassLogger RAT | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | MassLogger RAT, Snake Keylogger, VIP Keylogger | Browse |
| ||
mail.vvtrade.vn | Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| |
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | GuLoader, Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
checkip.dyndns.com | Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| |
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger | Browse |
| ||
Get hash | malicious | MassLogger RAT | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | MassLogger RAT, Snake Keylogger, VIP Keylogger | Browse |
| ||
api.telegram.org | Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| |
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | MassLogger RAT | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | MassLogger RAT, Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
Get hash | malicious | AgentTesla | Browse |
| ||
Get hash | malicious | DarkTortilla, Snake Keylogger | Browse |
|
Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
---|---|---|---|---|---|---|
TELEGRAMRU | Get hash | malicious | LummaC, Vidar | Browse |
| |
Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
Get hash | malicious | LummaC, Vidar | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | LummaC, Vidar | Browse |
| ||
Get hash | malicious | LummaC, Vidar | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | MassLogger RAT | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
CLOUDFLARENETUS | Get hash | malicious | LummaC | Browse |
| |
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | AgentTesla, PureLog Stealer | Browse |
| ||
Get hash | malicious | HTMLPhisher | Browse |
| ||
Get hash | malicious | AgentTesla, PureLog Stealer | Browse |
| ||
Get hash | malicious | AgentTesla, PureLog Stealer | Browse |
| ||
Get hash | malicious | LummaC | Browse |
| ||
Get hash | malicious | LummaC | Browse |
| ||
Get hash | malicious | FormBook | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
ORACLE-BMC-31898US | Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| |
Get hash | malicious | Snake Keylogger | Browse |
| ||
Get hash | malicious | Mirai, Okiru | Browse |
| ||
Get hash | malicious | Snake Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | MassLogger RAT, Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
FPT-AS-APTheCorporationforFinancingPromotingTechnolo | Get hash | malicious | Mirai, Okiru | Browse |
| |
Get hash | malicious | Mirai, Okiru | Browse |
| ||
Get hash | malicious | Mirai | Browse |
| ||
Get hash | malicious | Mirai, Okiru | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | HTMLPhisher | Browse |
| ||
Get hash | malicious | HTMLPhisher | Browse |
| ||
Get hash | malicious | LummaC, Vidar | Browse |
| ||
Get hash | malicious | LummaC, Vidar | Browse |
| ||
Get hash | malicious | LummaC, Stealc, Vidar | Browse |
|
Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
---|---|---|---|---|---|---|
54328bd36c14bd82ddaa0c04b25ed9ad | Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| |
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | HTMLPhisher | Browse |
| ||
Get hash | malicious | Snake Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger | Browse |
| ||
Get hash | malicious | MassLogger RAT | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | Snake Keylogger, VIP Keylogger | Browse |
| ||
Get hash | malicious | MassLogger RAT, Snake Keylogger, VIP Keylogger | Browse |
| ||
3b5074b1b5d032e5620f69f9f700ff0e | Get hash | malicious | AgentTesla, PureLog Stealer | Browse |
| |
Get hash | malicious | AgentTesla, PureLog Stealer | Browse |
| ||
Get hash | malicious | AgentTesla, PureLog Stealer | Browse |
| ||
Get hash | malicious | GuLoader, Snake Keylogger | Browse |
| ||
Get hash | malicious | RDPWrap Tool | Browse |
| ||
Get hash | malicious | RDPWrap Tool | Browse |
| ||
Get hash | malicious | RDPWrap Tool | Browse |
| ||
Get hash | malicious | Xmrig | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | XWorm | Browse |
|
Process: | C:\Users\user\Desktop\Urgent inquiry for quotation .exe |
File Type: | |
Category: | dropped |
Size (bytes): | 275456 |
Entropy (8bit): | 6.975726134834828 |
Encrypted: | false |
SSDEEP: | 3072:dKyxmk5kjBWYuR1xxnBNPzHAWOah+09piumf9M8aU3BF5u8sz9QOjy+DJ6PjilpV:NX5i0YuR1xxuBF52z9xZx2ThDbTX+A1O |
MD5: | 0DE191C41F89305DB5ED6DC20C26AFE0 |
SHA1: | 2C2C8F0707C6E243F83380ED9BA866E2C0984416 |
SHA-256: | 8839116BEAEF07FB269FF4315FFDD383B9D78C64640107F82B9BAC4ED7274EDA |
SHA-512: | DBFD70ACD049436CA9F82697DBEE43D31463724ACA54A5349351F7CC8B6A7C7BA3820A29C3AE4AE50236442254B9E85290A4532A63572A8FF968D7CA4A06A8FD |
Malicious: | false |
Reputation: | low |
Preview: |
Process: | C:\Users\user\Desktop\Urgent inquiry for quotation .exe |
File Type: | |
Category: | dropped |
Size (bytes): | 1221903 |
Entropy (8bit): | 7.443858973435057 |
Encrypted: | false |
SSDEEP: | 24576:ffmMv6Ckr7Mny5QLbSSD8uBQgr4pKTJOIJZ:f3v+7/5QL+odQkJTz |
MD5: | D64843EA87D7ABBE765B51AAE7BDD99B |
SHA1: | 41B174CD070F572616804578FB6EC462665FE61A |
SHA-256: | 98B61FB1C23C719DEEFBD27BCB2E1E33DF76FF55AA56FE8879084675C69A055B |
SHA-512: | EBAC72E15D91439EAD18757C5636F45AF38D19F78D1AFBAE92279FC8494010A1B8C6F5322E9CFB03E32200D61E6990A9A6B5E98A0972CC51B9973D185809AE06 |
Malicious: | true |
Antivirus: |
|
Reputation: | low |
Preview: |
Process: | C:\Users\user\AppData\Local\directory\name.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 268 |
Entropy (8bit): | 3.4209455304240626 |
Encrypted: | false |
SSDEEP: | 6:DMM8lfm3OOQdUfcloRKUEZ+lX1Al1AE6nriIM8lfQVn:DsO+vNloRKQ1A1z4mA2n |
MD5: | D3A871A22DFC23DD6763F6002299B13A |
SHA1: | B7934BFD389FE7FBDC08710EDABA4C16D3EED618 |
SHA-256: | FEA868420602CDAF96C19BE169F6BA44178494DB3B8F6292DCD7B8A8BB194F66 |
SHA-512: | 6166B8A0DED88F7C8F3CC1D92A44A0A112B4CFCBEEB3934005E89B32614C79BB7F7ABDBF8CF84D90D4864C425460673739935562B344AE14FFE1076F5D0F7CA9 |
Malicious: | true |
Reputation: | moderate, very likely benign file |
Preview: |
File type: | |
Entropy (8bit): | 7.443858973435057 |
TrID: |
|
File name: | Urgent inquiry for quotation .exe |
File size: | 1'221'903 bytes |
MD5: | d64843ea87d7abbe765b51aae7bdd99b |
SHA1: | 41b174cd070f572616804578fb6ec462665fe61a |
SHA256: | 98b61fb1c23c719deefbd27bcb2e1e33df76ff55aa56fe8879084675c69a055b |
SHA512: | ebac72e15d91439ead18757c5636f45af38d19f78d1afbae92279fc8494010a1b8c6f5322e9cfb03e32200d61e6990a9a6b5e98a0972cc51b9973d185809ae06 |
SSDEEP: | 24576:ffmMv6Ckr7Mny5QLbSSD8uBQgr4pKTJOIJZ:f3v+7/5QL+odQkJTz |
TLSH: | AD45F112F7D680B6E9A33974197BE326EB3575150323C5CBA7E02E778F211409B3A762 |
File Content Preview: | MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-...i...i...i.....9.k...`.:.w...`.,.....`.+.P...N%..c...N%..H...i...d...`. ./...w.:.k...w.;.h...i.8.h...`.>.h...Richi.......... |
Icon Hash: | 1733312925935517 |
Entrypoint: | 0x416310 |
Entrypoint Section: | .text |
Digitally signed: | false |
Imagebase: | 0x400000 |
Subsystem: | windows gui |
Image File Characteristics: | RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE |
DLL Characteristics: | TERMINAL_SERVER_AWARE |
Time Stamp: | 0x4B93CF87 [Sun Mar 7 16:08:39 2010 UTC] |
TLS Callbacks: | |
CLR (.Net) Version: | |
OS Version Major: | 5 |
OS Version Minor: | 0 |
File Version Major: | 5 |
File Version Minor: | 0 |
Subsystem Version Major: | 5 |
Subsystem Version Minor: | 0 |
Import Hash: | aaaa8913c89c8aa4a5d93f06853894da |
Instruction |
---|
call 00007F5FFC6C4A4Ch |
jmp 00007F5FFC6B881Eh |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
push ebp |
mov ebp, esp |
push edi |
push esi |
mov esi, dword ptr [ebp+0Ch] |
mov ecx, dword ptr [ebp+10h] |
mov edi, dword ptr [ebp+08h] |
mov eax, ecx |
mov edx, ecx |
add eax, esi |
cmp edi, esi |
jbe 00007F5FFC6B89AAh |
cmp edi, eax |
jc 00007F5FFC6B8B4Ah |
cmp ecx, 00000100h |
jc 00007F5FFC6B89C1h |
cmp dword ptr [004A94E0h], 00000000h |
je 00007F5FFC6B89B8h |
push edi |
push esi |
and edi, 0Fh |
and esi, 0Fh |
cmp edi, esi |
pop esi |
pop edi |
jne 00007F5FFC6B89AAh |
pop esi |
pop edi |
pop ebp |
jmp 00007F5FFC6B8E0Ah |
test edi, 00000003h |
jne 00007F5FFC6B89B7h |
shr ecx, 02h |
and edx, 03h |
cmp ecx, 08h |
jc 00007F5FFC6B89CCh |
rep movsd |
jmp dword ptr [00416494h+edx*4] |
nop |
mov eax, edi |
mov edx, 00000003h |
sub ecx, 04h |
jc 00007F5FFC6B89AEh |
and eax, 03h |
add ecx, eax |
jmp dword ptr [004163A8h+eax*4] |
jmp dword ptr [004164A4h+ecx*4] |
nop |
jmp dword ptr [00416428h+ecx*4] |
nop |
mov eax, E4004163h |
arpl word ptr [ecx+00h], ax |
or byte ptr [ecx+eax*2+00h], ah |
and edx, ecx |
mov al, byte ptr [esi] |
mov byte ptr [edi], al |
mov al, byte ptr [esi+01h] |
mov byte ptr [edi+01h], al |
mov al, byte ptr [esi+02h] |
shr ecx, 02h |
mov byte ptr [edi+02h], al |
add esi, 03h |
add edi, 03h |
cmp ecx, 08h |
jc 00007F5FFC6B896Eh |
Programming Language: |
|
Name | Virtual Address | Virtual Size | Is in Section |
---|---|---|---|
IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_IMPORT | 0x8cd3c | 0x154 | .rdata |
IMAGE_DIRECTORY_ENTRY_RESOURCE | 0xab000 | 0x9298 | .rsrc |
IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_DEBUG | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_TLS | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_IAT | 0x82000 | 0x840 | .rdata |
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
---|---|---|---|---|---|---|---|---|---|
.text | 0x1000 | 0x80017 | 0x80200 | 6c20c6bf686768b6f134f5bd508171bc | False | 0.5602991615853659 | data | 6.634688230255595 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
.rdata | 0x82000 | 0xd95c | 0xda00 | f979966509a93083729d23cdfd2a6f2d | False | 0.36256450688073394 | data | 4.880040824124099 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
.data | 0x90000 | 0x1a518 | 0x6800 | e5d77411f751d28c6eee48a743606795 | False | 0.1600060096153846 | data | 2.2017649896261107 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
.rsrc | 0xab000 | 0x9298 | 0x9400 | f6be76de0ef2c68f397158bf01bdef3e | False | 0.4896801097972973 | data | 5.530303089784181 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
---|---|---|---|---|---|---|
RT_ICON | 0xab5c8 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors | English | Great Britain | 0.3277027027027027 |
RT_ICON | 0xab6f0 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 192 | English | Great Britain | 0.7466216216216216 |
RT_ICON | 0xab818 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 192 | English | Great Britain | 0.3885135135135135 |
RT_ICON | 0xab940 | 0x668 | Device independent bitmap graphic, 48 x 96 x 4, image size 1152 | English | Great Britain | 0.48109756097560974 |
RT_ICON | 0xabfa8 | 0x2e8 | Device independent bitmap graphic, 32 x 64 x 4, image size 512 | English | Great Britain | 0.5672043010752689 |
RT_ICON | 0xac290 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 128 | English | Great Britain | 0.6418918918918919 |
RT_ICON | 0xac3b8 | 0xea8 | Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors | English | Great Britain | 0.7044243070362474 |
RT_ICON | 0xad260 | 0x8a8 | Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors | English | Great Britain | 0.8077617328519856 |
RT_ICON | 0xadb08 | 0x568 | Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors | English | Great Britain | 0.5903179190751445 |
RT_ICON | 0xae070 | 0x25a8 | Device independent bitmap graphic, 48 x 96 x 32, image size 9600 | English | Great Britain | 0.5503112033195021 |
RT_ICON | 0xb0618 | 0x10a8 | Device independent bitmap graphic, 32 x 64 x 32, image size 4224 | English | Great Britain | 0.6050656660412758 |
RT_ICON | 0xb16c0 | 0x468 | Device independent bitmap graphic, 16 x 32 x 32, image size 1088 | English | Great Britain | 0.7553191489361702 |
RT_MENU | 0xb1b28 | 0x50 | data | English | Great Britain | 0.9 |
RT_DIALOG | 0xb1b78 | 0xfc | data | English | Great Britain | 0.6507936507936508 |
RT_STRING | 0xb1c78 | 0x530 | data | English | Great Britain | 0.33960843373493976 |
RT_STRING | 0xb21a8 | 0x690 | data | English | Great Britain | 0.26964285714285713 |
RT_STRING | 0xb2838 | 0x43a | data | English | Great Britain | 0.3733826247689464 |
RT_STRING | 0xb2c78 | 0x5fc | data | English | Great Britain | 0.3087467362924282 |
RT_STRING | 0xb3278 | 0x65c | data | English | Great Britain | 0.34336609336609336 |
RT_STRING | 0xb38d8 | 0x388 | data | English | Great Britain | 0.377212389380531 |
RT_STRING | 0xb3c60 | 0x158 | Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0 | English | United States | 0.502906976744186 |
RT_GROUP_ICON | 0xb3db8 | 0x84 | data | English | Great Britain | 0.6439393939393939 |
RT_GROUP_ICON | 0xb3e40 | 0x14 | data | English | Great Britain | 1.15 |
RT_GROUP_ICON | 0xb3e58 | 0x14 | data | English | Great Britain | 1.25 |
RT_GROUP_ICON | 0xb3e70 | 0x14 | data | English | Great Britain | 1.25 |
RT_VERSION | 0xb3e88 | 0x19c | data | English | Great Britain | 0.5339805825242718 |
RT_MANIFEST | 0xb4028 | 0x26c | ASCII text, with CRLF line terminators | English | United States | 0.5145161290322581 |
DLL | Import |
---|---|
WSOCK32.dll | __WSAFDIsSet, setsockopt, ntohs, recvfrom, sendto, htons, select, listen, WSAStartup, bind, closesocket, connect, socket, send, WSACleanup, ioctlsocket, accept, WSAGetLastError, inet_addr, gethostbyname, gethostname, recv |
VERSION.dll | VerQueryValueW, GetFileVersionInfoW, GetFileVersionInfoSizeW |
WINMM.dll | timeGetTime, waveOutSetVolume, mciSendStringW |
COMCTL32.dll | ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, ImageList_ReplaceIcon, ImageList_Create, InitCommonControlsEx, ImageList_Destroy |
MPR.dll | WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W, WNetUseConnectionW |
WININET.dll | InternetReadFile, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetConnectW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetQueryOptionW, InternetQueryDataAvailable |
PSAPI.DLL | EnumProcesses, GetModuleBaseNameW, GetProcessMemoryInfo, EnumProcessModules |
USERENV.dll | CreateEnvironmentBlock, DestroyEnvironmentBlock, UnloadUserProfile, LoadUserProfileW |
KERNEL32.dll | HeapAlloc, Sleep, GetCurrentThreadId, RaiseException, MulDiv, GetVersionExW, GetSystemInfo, MultiByteToWideChar, WideCharToMultiByte, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, DeleteFileW, FindNextFileW, lstrcmpiW, MoveFileW, CopyFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, GetProcessHeap, OutputDebugStringW, GetLocalTime, CompareStringW, CompareStringA, InterlockedIncrement, InterlockedDecrement, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionAndSpinCount, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, GetTempPathW, GetTempFileNameW, VirtualFree, FormatMessageW, GetExitCodeProcess, SetErrorMode, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, DeviceIoControl, SetFileAttributesW, GetShortPathNameW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetComputerNameW, GetWindowsDirectoryW, GetSystemDirectoryW, GetCurrentProcessId, GetCurrentThread, GetProcessIoCounters, CreateProcessW, SetPriorityClass, LoadLibraryW, VirtualAlloc, LoadLibraryExW, HeapFree, WaitForSingleObject, CreateThread, DuplicateHandle, GetLastError, CloseHandle, GetCurrentProcess, GetProcAddress, LoadLibraryA, FreeLibrary, GetModuleFileNameW, GetFullPathNameW, ExitProcess, ExitThread, GetSystemTimeAsFileTime, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, ResumeThread, GetStartupInfoW, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, SetLastError, HeapSize, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetModuleFileNameA, HeapReAlloc, HeapCreate, SetHandleCount, GetFileType, GetStartupInfoA, SetStdHandle, GetConsoleCP, GetConsoleMode, LCMapStringW, LCMapStringA, RtlUnwind, SetFilePointer, GetTimeZoneInformation, GetTimeFormatA, GetDateFormatA, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, GetTickCount, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, GetModuleHandleA, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, CreateFileA, SetEndOfFile, EnumResourceNamesW, SetEnvironmentVariableA |
USER32.dll | SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, ReleaseCapture, SetCapture, WindowFromPoint, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, CheckMenuRadioItem, CopyImage, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, PeekMessageW, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, GetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, MessageBoxW, DefWindowProcW, MoveWindow, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, GetMenuItemID, TranslateMessage, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, UnregisterHotKey, CharLowerBuffW, MonitorFromRect, keybd_event, LoadImageW, GetWindowLongW |
GDI32.dll | DeleteObject, GetObjectW, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, StrokePath, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, PolyDraw, BeginPath, Rectangle, GetDeviceCaps, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, SetViewportOrgEx |
COMDLG32.dll | GetSaveFileNameW, GetOpenFileNameW |
ADVAPI32.dll | RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegSetValueExW, RegCreateKeyExW, GetUserNameW, RegConnectRegistryW, RegEnumKeyExW, CloseServiceHandle, UnlockServiceDatabase, LockServiceDatabase, OpenSCManagerW, InitiateSystemShutdownExW, AdjustTokenPrivileges, RegCloseKey, RegQueryValueExW, RegOpenKeyExW, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, InitializeSecurityDescriptor, InitializeAcl, GetLengthSid, SetSecurityDescriptorDacl, CopySid, LogonUserW, GetTokenInformation, GetAclInformation, GetAce, AddAce, GetSecurityDescriptorDacl |
SHELL32.dll | DragQueryPoint, ShellExecuteExW, SHGetFolderPathW, DragQueryFileW, SHEmptyRecycleBinW, SHBrowseForFolderW, SHFileOperationW, SHGetPathFromIDListW, SHGetDesktopFolder, SHGetMalloc, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish |
ole32.dll | OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoInitialize, CoUninitialize, CoCreateInstance, CreateStreamOnHGlobal, CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, StringFromCLSID, IIDFromString, StringFromIID, OleInitialize, CreateBindCtx, CLSIDFromProgID, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket, OleUninitialize |
OLEAUT32.dll | SafeArrayAllocData, SafeArrayAllocDescriptorEx, SysAllocString, OleLoadPicture, SafeArrayGetVartype, SafeArrayDestroyData, SafeArrayAccessData, VarR8FromDec, VariantTimeToSystemTime, VariantClear, VariantCopy, VariantInit, SafeArrayDestroyDescriptor, LoadRegTypeLib, GetActiveObject, SafeArrayUnaccessData |
Language of compilation system | Country where language is spoken | Map |
---|---|---|
English | Great Britain | |
English | United States |
Timestamp | SID | Signature | Severity | Source IP | Source Port | Dest IP | Dest Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-10-08T08:52:03.033395+0200 | 2803274 | ETPRO MALWARE Common Downloader Header Pattern UH | 2 | 192.168.2.4 | 49730 | 193.122.130.0 | 80 | TCP |
2024-10-08T08:52:03.892001+0200 | 2803274 | ETPRO MALWARE Common Downloader Header Pattern UH | 2 | 192.168.2.4 | 49730 | 193.122.130.0 | 80 | TCP |
2024-10-08T08:52:04.463304+0200 | 2803305 | ETPRO MALWARE Common Downloader Header Pattern H | 3 | 192.168.2.4 | 49732 | 188.114.96.3 | 443 | TCP |
2024-10-08T08:52:04.970144+0200 | 2803274 | ETPRO MALWARE Common Downloader Header Pattern UH | 2 | 192.168.2.4 | 49733 | 193.122.130.0 | 80 | TCP |
2024-10-08T08:52:05.534418+0200 | 2803305 | ETPRO MALWARE Common Downloader Header Pattern H | 3 | 192.168.2.4 | 49734 | 188.114.96.3 | 443 | TCP |
2024-10-08T08:52:06.064044+0200 | 2803274 | ETPRO MALWARE Common Downloader Header Pattern UH | 2 | 192.168.2.4 | 49735 | 193.122.130.0 | 80 | TCP |
2024-10-08T08:52:12.179383+0200 | 2803305 | ETPRO MALWARE Common Downloader Header Pattern H | 3 | 192.168.2.4 | 49746 | 188.114.96.3 | 443 | TCP |
2024-10-08T08:52:14.282834+0200 | 2803274 | ETPRO MALWARE Common Downloader Header Pattern UH | 2 | 192.168.2.4 | 49748 | 193.122.130.0 | 80 | TCP |
2024-10-08T08:52:15.048271+0200 | 2803274 | ETPRO MALWARE Common Downloader Header Pattern UH | 2 | 192.168.2.4 | 49748 | 193.122.130.0 | 80 | TCP |
2024-10-08T08:52:15.619966+0200 | 2803305 | ETPRO MALWARE Common Downloader Header Pattern H | 3 | 192.168.2.4 | 49751 | 188.114.96.3 | 443 | TCP |
2024-10-08T08:52:16.107487+0200 | 2803274 | ETPRO MALWARE Common Downloader Header Pattern UH | 2 | 192.168.2.4 | 49753 | 193.122.130.0 | 80 | TCP |
2024-10-08T08:52:18.845945+0200 | 2803305 | ETPRO MALWARE Common Downloader Header Pattern H | 3 | 192.168.2.4 | 49761 | 188.114.96.3 | 443 | TCP |
2024-10-08T08:52:21.096341+0200 | 2803305 | ETPRO MALWARE Common Downloader Header Pattern H | 3 | 192.168.2.4 | 49767 | 188.114.96.3 | 443 | TCP |
Timestamp | Source Port | Dest Port | Source IP | Dest IP |
---|---|---|---|---|
Oct 8, 2024 08:52:02.406513929 CEST | 49730 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:02.411535025 CEST | 80 | 49730 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:02.413392067 CEST | 49730 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:02.413392067 CEST | 49730 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:02.418453932 CEST | 80 | 49730 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:02.878767967 CEST | 80 | 49730 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:02.882544994 CEST | 49730 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:02.887568951 CEST | 80 | 49730 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:02.986067057 CEST | 80 | 49730 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:03.033395052 CEST | 49730 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:03.063024044 CEST | 49731 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:03.063077927 CEST | 443 | 49731 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:03.063137054 CEST | 49731 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:03.072503090 CEST | 49731 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:03.072525024 CEST | 443 | 49731 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:03.570056915 CEST | 443 | 49731 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:03.570153952 CEST | 49731 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:03.575136900 CEST | 49731 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:03.575153112 CEST | 443 | 49731 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:03.575624943 CEST | 443 | 49731 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:03.624857903 CEST | 49731 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:03.671401978 CEST | 443 | 49731 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:03.736362934 CEST | 443 | 49731 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:03.736599922 CEST | 443 | 49731 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:03.736661911 CEST | 49731 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:03.741530895 CEST | 49731 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:03.744261026 CEST | 49730 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:03.749140024 CEST | 80 | 49730 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:03.846075058 CEST | 80 | 49730 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:03.851805925 CEST | 49732 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:03.851891041 CEST | 443 | 49732 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:03.851979971 CEST | 49732 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:03.852291107 CEST | 49732 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:03.852325916 CEST | 443 | 49732 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:03.892000914 CEST | 49730 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:04.333791971 CEST | 443 | 49732 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:04.335515022 CEST | 49732 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:04.335603952 CEST | 443 | 49732 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:04.463283062 CEST | 443 | 49732 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:04.463366032 CEST | 443 | 49732 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:04.463502884 CEST | 49732 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:04.464097977 CEST | 49732 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:04.467195988 CEST | 49730 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:04.467624903 CEST | 49733 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:04.472398043 CEST | 80 | 49730 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:04.472464085 CEST | 49730 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:04.472609043 CEST | 80 | 49733 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:04.472676039 CEST | 49733 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:04.472758055 CEST | 49733 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:04.477582932 CEST | 80 | 49733 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:04.928960085 CEST | 80 | 49733 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:04.929913044 CEST | 49734 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:04.930001974 CEST | 443 | 49734 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:04.930072069 CEST | 49734 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:04.930298090 CEST | 49734 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:04.930321932 CEST | 443 | 49734 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:04.970144033 CEST | 49733 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:05.183506012 CEST | 80 | 49733 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:05.183695078 CEST | 49733 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:05.402868986 CEST | 443 | 49734 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:05.404845953 CEST | 49734 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:05.404887915 CEST | 443 | 49734 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:05.534471035 CEST | 443 | 49734 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:05.534713984 CEST | 443 | 49734 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:05.534790993 CEST | 49734 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:05.535044909 CEST | 49734 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:05.537883997 CEST | 49733 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:05.539237976 CEST | 49735 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:05.543129921 CEST | 80 | 49733 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:05.543210030 CEST | 49733 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:05.544159889 CEST | 80 | 49735 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:05.544245005 CEST | 49735 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:05.544373035 CEST | 49735 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:05.549170971 CEST | 80 | 49735 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:06.009712934 CEST | 80 | 49735 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:06.011368990 CEST | 49736 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:06.011416912 CEST | 443 | 49736 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:06.011512995 CEST | 49736 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:06.011862993 CEST | 49736 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:06.011893034 CEST | 443 | 49736 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:06.064043999 CEST | 49735 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:06.471714020 CEST | 443 | 49736 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:06.473100901 CEST | 49736 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:06.473161936 CEST | 443 | 49736 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:06.596800089 CEST | 443 | 49736 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:06.596894979 CEST | 443 | 49736 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:06.597059011 CEST | 49736 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:06.597371101 CEST | 49736 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:06.601171017 CEST | 49737 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:06.606106043 CEST | 80 | 49737 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:06.606220007 CEST | 49737 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:06.606302977 CEST | 49737 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:06.611133099 CEST | 80 | 49737 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:07.063076019 CEST | 80 | 49737 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:07.064415932 CEST | 49738 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:07.064506054 CEST | 443 | 49738 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:07.064601898 CEST | 49738 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:07.064862013 CEST | 49738 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:07.064902067 CEST | 443 | 49738 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:07.110843897 CEST | 49737 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:07.527589083 CEST | 443 | 49738 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:07.528892040 CEST | 49738 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:07.528985977 CEST | 443 | 49738 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:07.685436964 CEST | 443 | 49738 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:07.685703993 CEST | 443 | 49738 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:07.685789108 CEST | 49738 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:07.686045885 CEST | 49738 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:07.689070940 CEST | 49737 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:07.689657927 CEST | 49739 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:07.694255114 CEST | 80 | 49737 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:07.694324970 CEST | 49737 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:07.694535017 CEST | 80 | 49739 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:07.694652081 CEST | 49739 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:07.694746971 CEST | 49739 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:07.699582100 CEST | 80 | 49739 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:08.180942059 CEST | 80 | 49739 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:08.182140112 CEST | 49740 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:08.182174921 CEST | 443 | 49740 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:08.182231903 CEST | 49740 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:08.182503939 CEST | 49740 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:08.182518005 CEST | 443 | 49740 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:08.235819101 CEST | 49739 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:08.643732071 CEST | 443 | 49740 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:08.645132065 CEST | 49740 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:08.645149946 CEST | 443 | 49740 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:08.768609047 CEST | 443 | 49740 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:08.768929958 CEST | 443 | 49740 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:08.768996954 CEST | 49740 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:08.769254923 CEST | 49740 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:08.771787882 CEST | 49739 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:08.772984982 CEST | 49741 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:08.777419090 CEST | 80 | 49739 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:08.777498007 CEST | 49739 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:08.778008938 CEST | 80 | 49741 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:08.778156042 CEST | 49741 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:08.778440952 CEST | 49741 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:08.783381939 CEST | 80 | 49741 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:09.284032106 CEST | 80 | 49741 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:09.285341024 CEST | 49742 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:09.285427094 CEST | 443 | 49742 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:09.285533905 CEST | 49742 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:09.285835028 CEST | 49742 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:09.285918951 CEST | 443 | 49742 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:09.329534054 CEST | 49741 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:09.790194988 CEST | 443 | 49742 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:09.795658112 CEST | 49742 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:09.795744896 CEST | 443 | 49742 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:09.939480066 CEST | 443 | 49742 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:09.939682961 CEST | 443 | 49742 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:09.939744949 CEST | 49742 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:09.940069914 CEST | 49742 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:09.949603081 CEST | 49741 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:09.952826023 CEST | 49743 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:09.954833984 CEST | 80 | 49741 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:09.954999924 CEST | 49741 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:09.957693100 CEST | 80 | 49743 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:09.957770109 CEST | 49743 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:09.959160089 CEST | 49743 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:09.964045048 CEST | 80 | 49743 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:10.421799898 CEST | 80 | 49743 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:10.422914028 CEST | 49744 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:10.422979116 CEST | 443 | 49744 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:10.423103094 CEST | 49744 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:10.423310995 CEST | 49744 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:10.423331022 CEST | 443 | 49744 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:10.470149994 CEST | 49743 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:10.918292046 CEST | 443 | 49744 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:10.919833899 CEST | 49744 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:10.919874907 CEST | 443 | 49744 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:11.065562010 CEST | 443 | 49744 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:11.065851927 CEST | 443 | 49744 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:11.065918922 CEST | 49744 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:11.067945004 CEST | 49744 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:11.073925018 CEST | 49743 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:11.074795961 CEST | 49745 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:11.079909086 CEST | 80 | 49743 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:11.079981089 CEST | 49743 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:11.080058098 CEST | 80 | 49745 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:11.080137014 CEST | 49745 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:11.080621958 CEST | 49745 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:11.086061954 CEST | 80 | 49745 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:11.557512999 CEST | 80 | 49745 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:11.558670044 CEST | 49746 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:11.558773994 CEST | 443 | 49746 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:11.558845997 CEST | 49746 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:11.559048891 CEST | 49746 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:11.559072018 CEST | 443 | 49746 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:11.610881090 CEST | 49745 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:12.037094116 CEST | 443 | 49746 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:12.038795948 CEST | 49746 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:12.038888931 CEST | 443 | 49746 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:12.179348946 CEST | 443 | 49746 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:12.179446936 CEST | 443 | 49746 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:12.179579020 CEST | 49746 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:12.180005074 CEST | 49746 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:12.198801994 CEST | 49745 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:12.204123020 CEST | 49747 | 443 | 192.168.2.4 | 149.154.167.220 |
Oct 8, 2024 08:52:12.204190016 CEST | 443 | 49747 | 149.154.167.220 | 192.168.2.4 |
Oct 8, 2024 08:52:12.204262972 CEST | 49747 | 443 | 192.168.2.4 | 149.154.167.220 |
Oct 8, 2024 08:52:12.206062078 CEST | 80 | 49745 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:12.206131935 CEST | 49745 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:12.206893921 CEST | 49747 | 443 | 192.168.2.4 | 149.154.167.220 |
Oct 8, 2024 08:52:12.206928015 CEST | 443 | 49747 | 149.154.167.220 | 192.168.2.4 |
Oct 8, 2024 08:52:12.849747896 CEST | 443 | 49747 | 149.154.167.220 | 192.168.2.4 |
Oct 8, 2024 08:52:12.849868059 CEST | 49747 | 443 | 192.168.2.4 | 149.154.167.220 |
Oct 8, 2024 08:52:12.852462053 CEST | 49747 | 443 | 192.168.2.4 | 149.154.167.220 |
Oct 8, 2024 08:52:12.852483988 CEST | 443 | 49747 | 149.154.167.220 | 192.168.2.4 |
Oct 8, 2024 08:52:12.852828026 CEST | 443 | 49747 | 149.154.167.220 | 192.168.2.4 |
Oct 8, 2024 08:52:12.854604006 CEST | 49747 | 443 | 192.168.2.4 | 149.154.167.220 |
Oct 8, 2024 08:52:12.895416975 CEST | 443 | 49747 | 149.154.167.220 | 192.168.2.4 |
Oct 8, 2024 08:52:13.105711937 CEST | 443 | 49747 | 149.154.167.220 | 192.168.2.4 |
Oct 8, 2024 08:52:13.105787992 CEST | 443 | 49747 | 149.154.167.220 | 192.168.2.4 |
Oct 8, 2024 08:52:13.105845928 CEST | 49747 | 443 | 192.168.2.4 | 149.154.167.220 |
Oct 8, 2024 08:52:13.110538006 CEST | 49747 | 443 | 192.168.2.4 | 149.154.167.220 |
Oct 8, 2024 08:52:13.651701927 CEST | 49748 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:13.656666994 CEST | 80 | 49748 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:13.656718016 CEST | 49748 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:13.657234907 CEST | 49748 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:13.662949085 CEST | 80 | 49748 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:14.122519970 CEST | 80 | 49748 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:14.126900911 CEST | 49748 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:14.131683111 CEST | 80 | 49748 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:14.228949070 CEST | 80 | 49748 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:14.257076979 CEST | 49749 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:14.257116079 CEST | 443 | 49749 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:14.259543896 CEST | 49749 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:14.260495901 CEST | 49749 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:14.260513067 CEST | 443 | 49749 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:14.282834053 CEST | 49748 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:14.735944986 CEST | 443 | 49749 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:14.736047983 CEST | 49749 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:14.738529921 CEST | 49749 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:14.738547087 CEST | 443 | 49749 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:14.739475012 CEST | 443 | 49749 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:14.782752991 CEST | 49749 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:14.789005995 CEST | 49749 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:14.835439920 CEST | 443 | 49749 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:14.893716097 CEST | 443 | 49749 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:14.893826008 CEST | 443 | 49749 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:14.893906116 CEST | 49749 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:14.897103071 CEST | 49749 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:14.899931908 CEST | 49748 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:14.904844999 CEST | 80 | 49748 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:15.006644964 CEST | 80 | 49748 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:15.008462906 CEST | 49751 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:15.008548975 CEST | 443 | 49751 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:15.008624077 CEST | 49751 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:15.008872032 CEST | 49751 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:15.008907080 CEST | 443 | 49751 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:15.048270941 CEST | 49748 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:15.485732079 CEST | 443 | 49751 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:15.488095999 CEST | 49751 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:15.488145113 CEST | 443 | 49751 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:15.619817019 CEST | 443 | 49751 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:15.619915009 CEST | 443 | 49751 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:15.619967937 CEST | 49751 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:15.620485067 CEST | 49751 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:15.623439074 CEST | 49748 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:15.624536991 CEST | 49753 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:15.628993034 CEST | 80 | 49748 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:15.629053116 CEST | 49748 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:15.629441977 CEST | 80 | 49753 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:15.629513025 CEST | 49753 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:15.629657030 CEST | 49753 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:15.635626078 CEST | 80 | 49753 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:16.107295036 CEST | 80 | 49753 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:16.107486963 CEST | 49753 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:16.110547066 CEST | 49755 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:16.110634089 CEST | 443 | 49755 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:16.110809088 CEST | 49755 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:16.111063004 CEST | 49755 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:16.111087084 CEST | 443 | 49755 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:16.112606049 CEST | 80 | 49753 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:16.113441944 CEST | 49753 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:16.571589947 CEST | 443 | 49755 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:16.575961113 CEST | 49755 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:16.575987101 CEST | 443 | 49755 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:16.704107046 CEST | 443 | 49755 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:16.704379082 CEST | 443 | 49755 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:16.704761982 CEST | 49755 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:16.705344915 CEST | 49755 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:16.710542917 CEST | 49757 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:16.715445995 CEST | 80 | 49757 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:16.716454029 CEST | 49757 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:16.716454029 CEST | 49757 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:16.721349955 CEST | 80 | 49757 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:17.173516989 CEST | 80 | 49757 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:17.174720049 CEST | 49758 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:17.174808979 CEST | 443 | 49758 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:17.174879074 CEST | 49758 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:17.175117016 CEST | 49758 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:17.175152063 CEST | 443 | 49758 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:17.220155954 CEST | 49757 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:17.642275095 CEST | 443 | 49758 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:17.650509119 CEST | 49758 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:17.650590897 CEST | 443 | 49758 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:17.771544933 CEST | 443 | 49758 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:17.771631002 CEST | 443 | 49758 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:17.771847010 CEST | 49758 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:17.772311926 CEST | 49758 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:17.774521112 CEST | 49757 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:17.775437117 CEST | 49760 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:17.781289101 CEST | 80 | 49757 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:17.781397104 CEST | 49757 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:17.781500101 CEST | 80 | 49760 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:17.781593084 CEST | 49760 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:17.781667948 CEST | 49760 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:17.787641048 CEST | 80 | 49760 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:18.248183966 CEST | 80 | 49760 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:18.249294996 CEST | 49761 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:18.249396086 CEST | 443 | 49761 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:18.249481916 CEST | 49761 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:18.249679089 CEST | 49761 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:18.249705076 CEST | 443 | 49761 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:18.298291922 CEST | 49760 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:18.371856928 CEST | 49735 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:18.710864067 CEST | 443 | 49761 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:18.714627981 CEST | 49761 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:18.714714050 CEST | 443 | 49761 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:18.845859051 CEST | 443 | 49761 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:18.846069098 CEST | 443 | 49761 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:18.846369028 CEST | 49761 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:18.846518993 CEST | 49761 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:18.848999023 CEST | 49760 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:18.850019932 CEST | 49763 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:18.855007887 CEST | 80 | 49763 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:18.855195999 CEST | 80 | 49760 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:18.855196953 CEST | 49763 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:18.855271101 CEST | 49763 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:18.855346918 CEST | 49760 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:18.860284090 CEST | 80 | 49763 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:18.949290037 CEST | 49764 | 587 | 192.168.2.4 | 118.69.190.131 |
Oct 8, 2024 08:52:18.954336882 CEST | 587 | 49764 | 118.69.190.131 | 192.168.2.4 |
Oct 8, 2024 08:52:18.954416990 CEST | 49764 | 587 | 192.168.2.4 | 118.69.190.131 |
Oct 8, 2024 08:52:19.348553896 CEST | 80 | 49763 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:19.350177050 CEST | 49765 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:19.350220919 CEST | 443 | 49765 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:19.350383997 CEST | 49765 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:19.350545883 CEST | 49765 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:19.350558043 CEST | 443 | 49765 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:19.392043114 CEST | 49763 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:19.831634045 CEST | 443 | 49765 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:19.838941097 CEST | 49765 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:19.838965893 CEST | 443 | 49765 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:19.981954098 CEST | 443 | 49765 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:19.982151985 CEST | 443 | 49765 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:19.982445955 CEST | 49765 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:19.982445955 CEST | 49765 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:20.009135008 CEST | 49763 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:20.010354042 CEST | 49766 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:20.014353991 CEST | 80 | 49763 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:20.014411926 CEST | 49763 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:20.015188932 CEST | 80 | 49766 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:20.015255928 CEST | 49766 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:20.015481949 CEST | 49766 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:20.020490885 CEST | 80 | 49766 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:20.323447943 CEST | 587 | 49764 | 118.69.190.131 | 192.168.2.4 |
Oct 8, 2024 08:52:20.323707104 CEST | 49764 | 587 | 192.168.2.4 | 118.69.190.131 |
Oct 8, 2024 08:52:20.331352949 CEST | 587 | 49764 | 118.69.190.131 | 192.168.2.4 |
Oct 8, 2024 08:52:20.471493006 CEST | 80 | 49766 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:20.472893953 CEST | 49767 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:20.472986937 CEST | 443 | 49767 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:20.473095894 CEST | 49767 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:20.473404884 CEST | 49767 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:20.473440886 CEST | 443 | 49767 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:20.517297983 CEST | 49766 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:20.675873041 CEST | 587 | 49764 | 118.69.190.131 | 192.168.2.4 |
Oct 8, 2024 08:52:20.677772999 CEST | 49764 | 587 | 192.168.2.4 | 118.69.190.131 |
Oct 8, 2024 08:52:20.682760000 CEST | 587 | 49764 | 118.69.190.131 | 192.168.2.4 |
Oct 8, 2024 08:52:20.946562052 CEST | 443 | 49767 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:20.948843956 CEST | 49767 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:20.948889971 CEST | 443 | 49767 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:21.026334047 CEST | 587 | 49764 | 118.69.190.131 | 192.168.2.4 |
Oct 8, 2024 08:52:21.026738882 CEST | 49764 | 587 | 192.168.2.4 | 118.69.190.131 |
Oct 8, 2024 08:52:21.031851053 CEST | 587 | 49764 | 118.69.190.131 | 192.168.2.4 |
Oct 8, 2024 08:52:21.096339941 CEST | 443 | 49767 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:21.096556902 CEST | 443 | 49767 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:21.096781015 CEST | 49767 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:21.097229958 CEST | 49767 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:21.100109100 CEST | 49766 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:21.101468086 CEST | 49768 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:21.105617046 CEST | 80 | 49766 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:21.105686903 CEST | 49766 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:21.106435061 CEST | 80 | 49768 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:21.106518030 CEST | 49768 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:21.106823921 CEST | 49768 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:21.111769915 CEST | 80 | 49768 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:21.403764009 CEST | 587 | 49764 | 118.69.190.131 | 192.168.2.4 |
Oct 8, 2024 08:52:21.407527924 CEST | 49764 | 587 | 192.168.2.4 | 118.69.190.131 |
Oct 8, 2024 08:52:21.413186073 CEST | 587 | 49764 | 118.69.190.131 | 192.168.2.4 |
Oct 8, 2024 08:52:21.590361118 CEST | 80 | 49768 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:21.591672897 CEST | 49769 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:21.591722965 CEST | 443 | 49769 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:21.592124939 CEST | 49769 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:21.592382908 CEST | 49769 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:21.592401028 CEST | 443 | 49769 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:21.642047882 CEST | 49768 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:21.756900072 CEST | 587 | 49764 | 118.69.190.131 | 192.168.2.4 |
Oct 8, 2024 08:52:21.757077932 CEST | 49764 | 587 | 192.168.2.4 | 118.69.190.131 |
Oct 8, 2024 08:52:21.762074947 CEST | 587 | 49764 | 118.69.190.131 | 192.168.2.4 |
Oct 8, 2024 08:52:22.054092884 CEST | 443 | 49769 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:22.055814981 CEST | 49769 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:22.055847883 CEST | 443 | 49769 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:22.106954098 CEST | 587 | 49764 | 118.69.190.131 | 192.168.2.4 |
Oct 8, 2024 08:52:22.108037949 CEST | 587 | 49764 | 118.69.190.131 | 192.168.2.4 |
Oct 8, 2024 08:52:22.108428955 CEST | 49764 | 587 | 192.168.2.4 | 118.69.190.131 |
Oct 8, 2024 08:52:22.113950014 CEST | 49764 | 587 | 192.168.2.4 | 118.69.190.131 |
Oct 8, 2024 08:52:22.119033098 CEST | 587 | 49764 | 118.69.190.131 | 192.168.2.4 |
Oct 8, 2024 08:52:22.119947910 CEST | 49770 | 443 | 192.168.2.4 | 149.154.167.220 |
Oct 8, 2024 08:52:22.119987011 CEST | 443 | 49770 | 149.154.167.220 | 192.168.2.4 |
Oct 8, 2024 08:52:22.120064020 CEST | 49770 | 443 | 192.168.2.4 | 149.154.167.220 |
Oct 8, 2024 08:52:22.120342016 CEST | 49770 | 443 | 192.168.2.4 | 149.154.167.220 |
Oct 8, 2024 08:52:22.120352983 CEST | 443 | 49770 | 149.154.167.220 | 192.168.2.4 |
Oct 8, 2024 08:52:22.174689054 CEST | 443 | 49769 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:22.174933910 CEST | 443 | 49769 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:22.175159931 CEST | 49769 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:22.175400972 CEST | 49769 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:22.178790092 CEST | 49768 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:22.179693937 CEST | 49771 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:22.184202909 CEST | 80 | 49768 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:22.184313059 CEST | 49768 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:22.184519053 CEST | 80 | 49771 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:22.184640884 CEST | 49771 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:22.184783936 CEST | 49771 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:22.189687967 CEST | 80 | 49771 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:22.640320063 CEST | 80 | 49771 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:22.641923904 CEST | 49772 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:22.642011881 CEST | 443 | 49772 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:22.642187119 CEST | 49772 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:22.642420053 CEST | 49772 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:22.642438889 CEST | 443 | 49772 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:22.689129114 CEST | 49771 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:22.729996920 CEST | 443 | 49770 | 149.154.167.220 | 192.168.2.4 |
Oct 8, 2024 08:52:22.740901947 CEST | 49770 | 443 | 192.168.2.4 | 149.154.167.220 |
Oct 8, 2024 08:52:22.740911961 CEST | 443 | 49770 | 149.154.167.220 | 192.168.2.4 |
Oct 8, 2024 08:52:22.741023064 CEST | 49770 | 443 | 192.168.2.4 | 149.154.167.220 |
Oct 8, 2024 08:52:22.741031885 CEST | 443 | 49770 | 149.154.167.220 | 192.168.2.4 |
Oct 8, 2024 08:52:23.076457024 CEST | 443 | 49770 | 149.154.167.220 | 192.168.2.4 |
Oct 8, 2024 08:52:23.076508045 CEST | 443 | 49770 | 149.154.167.220 | 192.168.2.4 |
Oct 8, 2024 08:52:23.076704979 CEST | 49770 | 443 | 192.168.2.4 | 149.154.167.220 |
Oct 8, 2024 08:52:23.077199936 CEST | 49770 | 443 | 192.168.2.4 | 149.154.167.220 |
Oct 8, 2024 08:52:23.123681068 CEST | 443 | 49772 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:23.125782967 CEST | 49772 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:23.125865936 CEST | 443 | 49772 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:23.257435083 CEST | 443 | 49772 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:23.257642984 CEST | 443 | 49772 | 188.114.96.3 | 192.168.2.4 |
Oct 8, 2024 08:52:23.257715940 CEST | 49772 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:23.258075953 CEST | 49772 | 443 | 192.168.2.4 | 188.114.96.3 |
Oct 8, 2024 08:52:23.271298885 CEST | 49773 | 443 | 192.168.2.4 | 149.154.167.220 |
Oct 8, 2024 08:52:23.271388054 CEST | 443 | 49773 | 149.154.167.220 | 192.168.2.4 |
Oct 8, 2024 08:52:23.271393061 CEST | 49771 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:23.271806955 CEST | 49773 | 443 | 192.168.2.4 | 149.154.167.220 |
Oct 8, 2024 08:52:23.271807909 CEST | 49773 | 443 | 192.168.2.4 | 149.154.167.220 |
Oct 8, 2024 08:52:23.271889925 CEST | 443 | 49773 | 149.154.167.220 | 192.168.2.4 |
Oct 8, 2024 08:52:23.276710987 CEST | 80 | 49771 | 193.122.130.0 | 192.168.2.4 |
Oct 8, 2024 08:52:23.276773930 CEST | 49771 | 80 | 192.168.2.4 | 193.122.130.0 |
Oct 8, 2024 08:52:23.886954069 CEST | 443 | 49773 | 149.154.167.220 | 192.168.2.4 |
Oct 8, 2024 08:52:23.887154102 CEST | 49773 | 443 | 192.168.2.4 | 149.154.167.220 |
Oct 8, 2024 08:52:23.888786077 CEST | 49773 | 443 | 192.168.2.4 | 149.154.167.220 |
Oct 8, 2024 08:52:23.888817072 CEST | 443 | 49773 | 149.154.167.220 | 192.168.2.4 |
Oct 8, 2024 08:52:23.889781952 CEST | 443 | 49773 | 149.154.167.220 | 192.168.2.4 |
Oct 8, 2024 08:52:23.891508102 CEST | 49773 | 443 | 192.168.2.4 | 149.154.167.220 |
Oct 8, 2024 08:52:23.939402103 CEST | 443 | 49773 | 149.154.167.220 | 192.168.2.4 |
Oct 8, 2024 08:52:24.131530046 CEST | 443 | 49773 | 149.154.167.220 | 192.168.2.4 |
Oct 8, 2024 08:52:24.131700993 CEST | 443 | 49773 | 149.154.167.220 | 192.168.2.4 |
Oct 8, 2024 08:52:24.131983042 CEST | 49773 | 443 | 192.168.2.4 | 149.154.167.220 |
Oct 8, 2024 08:52:24.136928082 CEST | 49773 | 443 | 192.168.2.4 | 149.154.167.220 |
Oct 8, 2024 08:52:29.831378937 CEST | 49774 | 587 | 192.168.2.4 | 118.69.190.131 |
Oct 8, 2024 08:52:29.837076902 CEST | 587 | 49774 | 118.69.190.131 | 192.168.2.4 |
Oct 8, 2024 08:52:29.837572098 CEST | 49774 | 587 | 192.168.2.4 | 118.69.190.131 |
Oct 8, 2024 08:52:31.150914907 CEST | 587 | 49774 | 118.69.190.131 | 192.168.2.4 |
Oct 8, 2024 08:52:31.151134968 CEST | 49774 | 587 | 192.168.2.4 | 118.69.190.131 |
Oct 8, 2024 08:52:31.158032894 CEST | 587 | 49774 | 118.69.190.131 | 192.168.2.4 |
Oct 8, 2024 08:52:31.499053955 CEST | 587 | 49774 | 118.69.190.131 | 192.168.2.4 |
Oct 8, 2024 08:52:31.499325037 CEST | 49774 | 587 | 192.168.2.4 | 118.69.190.131 |
Oct 8, 2024 08:52:31.504251003 CEST | 587 | 49774 | 118.69.190.131 | 192.168.2.4 |
Oct 8, 2024 08:52:31.847161055 CEST | 587 | 49774 | 118.69.190.131 | 192.168.2.4 |
Oct 8, 2024 08:52:31.847651005 CEST | 49774 | 587 | 192.168.2.4 | 118.69.190.131 |
Oct 8, 2024 08:52:31.853146076 CEST | 587 | 49774 | 118.69.190.131 | 192.168.2.4 |
Oct 8, 2024 08:52:32.216043949 CEST | 587 | 49774 | 118.69.190.131 | 192.168.2.4 |
Oct 8, 2024 08:52:32.220900059 CEST | 49774 | 587 | 192.168.2.4 | 118.69.190.131 |
Oct 8, 2024 08:52:32.225827932 CEST | 587 | 49774 | 118.69.190.131 | 192.168.2.4 |
Oct 8, 2024 08:52:32.596998930 CEST | 587 | 49774 | 118.69.190.131 | 192.168.2.4 |
Oct 8, 2024 08:52:32.597466946 CEST | 49774 | 587 | 192.168.2.4 | 118.69.190.131 |
Oct 8, 2024 08:52:32.602785110 CEST | 587 | 49774 | 118.69.190.131 | 192.168.2.4 |
Oct 8, 2024 08:52:32.946053028 CEST | 587 | 49774 | 118.69.190.131 | 192.168.2.4 |
Oct 8, 2024 08:52:32.946374893 CEST | 49774 | 587 | 192.168.2.4 | 118.69.190.131 |
Oct 8, 2024 08:52:32.946770906 CEST | 587 | 49774 | 118.69.190.131 | 192.168.2.4 |
Oct 8, 2024 08:52:32.947145939 CEST | 49774 | 587 | 192.168.2.4 | 118.69.190.131 |
Oct 8, 2024 08:52:32.951220989 CEST | 587 | 49774 | 118.69.190.131 | 192.168.2.4 |
Oct 8, 2024 08:52:32.956990957 CEST | 49775 | 443 | 192.168.2.4 | 149.154.167.220 |
Oct 8, 2024 08:52:32.957087994 CEST | 443 | 49775 | 149.154.167.220 | 192.168.2.4 |
Oct 8, 2024 08:52:32.957189083 CEST | 49775 | 443 | 192.168.2.4 | 149.154.167.220 |
Oct 8, 2024 08:52:32.957401991 CEST | 49775 | 443 | 192.168.2.4 | 149.154.167.220 |
Oct 8, 2024 08:52:32.957421064 CEST | 443 | 49775 | 149.154.167.220 | 192.168.2.4 |
Oct 8, 2024 08:52:33.575690031 CEST | 443 | 49775 | 149.154.167.220 | 192.168.2.4 |
Oct 8, 2024 08:52:33.577816963 CEST | 49775 | 443 | 192.168.2.4 | 149.154.167.220 |
Oct 8, 2024 08:52:33.577900887 CEST | 443 | 49775 | 149.154.167.220 | 192.168.2.4 |
Oct 8, 2024 08:52:33.577986002 CEST | 49775 | 443 | 192.168.2.4 | 149.154.167.220 |
Oct 8, 2024 08:52:33.578011036 CEST | 443 | 49775 | 149.154.167.220 | 192.168.2.4 |
Oct 8, 2024 08:52:33.863790989 CEST | 443 | 49775 | 149.154.167.220 | 192.168.2.4 |
Oct 8, 2024 08:52:33.863976955 CEST | 443 | 49775 | 149.154.167.220 | 192.168.2.4 |
Oct 8, 2024 08:52:33.864160061 CEST | 49775 | 443 | 192.168.2.4 | 149.154.167.220 |
Oct 8, 2024 08:52:33.864417076 CEST | 49775 | 443 | 192.168.2.4 | 149.154.167.220 |
Timestamp | Source Port | Dest Port | Source IP | Dest IP |
---|---|---|---|---|
Oct 8, 2024 08:52:02.391509056 CEST | 63185 | 53 | 192.168.2.4 | 1.1.1.1 |
Oct 8, 2024 08:52:02.399041891 CEST | 53 | 63185 | 1.1.1.1 | 192.168.2.4 |
Oct 8, 2024 08:52:03.055052996 CEST | 52130 | 53 | 192.168.2.4 | 1.1.1.1 |
Oct 8, 2024 08:52:03.062537909 CEST | 53 | 52130 | 1.1.1.1 | 192.168.2.4 |
Oct 8, 2024 08:52:12.194895029 CEST | 60804 | 53 | 192.168.2.4 | 1.1.1.1 |
Oct 8, 2024 08:52:12.203574896 CEST | 53 | 60804 | 1.1.1.1 | 192.168.2.4 |
Oct 8, 2024 08:52:18.534555912 CEST | 51136 | 53 | 192.168.2.4 | 1.1.1.1 |
Oct 8, 2024 08:52:18.948417902 CEST | 53 | 51136 | 1.1.1.1 | 192.168.2.4 |
Oct 8, 2024 08:52:32.949532986 CEST | 56283 | 53 | 192.168.2.4 | 1.1.1.1 |
Oct 8, 2024 08:52:32.956332922 CEST | 53 | 56283 | 1.1.1.1 | 192.168.2.4 |
Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
---|---|---|---|---|---|---|---|---|
Oct 8, 2024 08:52:02.391509056 CEST | 192.168.2.4 | 1.1.1.1 | 0x6867 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
Oct 8, 2024 08:52:03.055052996 CEST | 192.168.2.4 | 1.1.1.1 | 0xa228 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
Oct 8, 2024 08:52:12.194895029 CEST | 192.168.2.4 | 1.1.1.1 | 0xd70c | Standard query (0) | A (IP address) | IN (0x0001) | false | |
Oct 8, 2024 08:52:18.534555912 CEST | 192.168.2.4 | 1.1.1.1 | 0xe681 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
Oct 8, 2024 08:52:32.949532986 CEST | 192.168.2.4 | 1.1.1.1 | 0xc38e | Standard query (0) | A (IP address) | IN (0x0001) | false |
Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
---|---|---|---|---|---|---|---|---|---|---|
Oct 8, 2024 08:52:02.399041891 CEST | 1.1.1.1 | 192.168.2.4 | 0x6867 | No error (0) | checkip.dyndns.com | CNAME (Canonical name) | IN (0x0001) | false | ||
Oct 8, 2024 08:52:02.399041891 CEST | 1.1.1.1 | 192.168.2.4 | 0x6867 | No error (0) | 193.122.130.0 | A (IP address) | IN (0x0001) | false | ||
Oct 8, 2024 08:52:02.399041891 CEST | 1.1.1.1 | 192.168.2.4 | 0x6867 | No error (0) | 132.226.247.73 | A (IP address) | IN (0x0001) | false | ||
Oct 8, 2024 08:52:02.399041891 CEST | 1.1.1.1 | 192.168.2.4 | 0x6867 | No error (0) | 158.101.44.242 | A (IP address) | IN (0x0001) | false | ||
Oct 8, 2024 08:52:02.399041891 CEST | 1.1.1.1 | 192.168.2.4 | 0x6867 | No error (0) | 132.226.8.169 | A (IP address) | IN (0x0001) | false | ||
Oct 8, 2024 08:52:02.399041891 CEST | 1.1.1.1 | 192.168.2.4 | 0x6867 | No error (0) | 193.122.6.168 | A (IP address) | IN (0x0001) | false | ||
Oct 8, 2024 08:52:03.062537909 CEST | 1.1.1.1 | 192.168.2.4 | 0xa228 | No error (0) | 188.114.96.3 | A (IP address) | IN (0x0001) | false | ||
Oct 8, 2024 08:52:03.062537909 CEST | 1.1.1.1 | 192.168.2.4 | 0xa228 | No error (0) | 188.114.97.3 | A (IP address) | IN (0x0001) | false | ||
Oct 8, 2024 08:52:12.203574896 CEST | 1.1.1.1 | 192.168.2.4 | 0xd70c | No error (0) | 149.154.167.220 | A (IP address) | IN (0x0001) | false | ||
Oct 8, 2024 08:52:18.948417902 CEST | 1.1.1.1 | 192.168.2.4 | 0xe681 | No error (0) | 118.69.190.131 | A (IP address) | IN (0x0001) | false | ||
Oct 8, 2024 08:52:32.956332922 CEST | 1.1.1.1 | 192.168.2.4 | 0xc38e | No error (0) | 149.154.167.220 | A (IP address) | IN (0x0001) | false |
|
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
0 | 192.168.2.4 | 49730 | 193.122.130.0 | 80 | 2304 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
Oct 8, 2024 08:52:02.413392067 CEST | 151 | OUT | |
Oct 8, 2024 08:52:02.878767967 CEST | 320 | IN | |
Oct 8, 2024 08:52:02.882544994 CEST | 127 | OUT | |
Oct 8, 2024 08:52:02.986067057 CEST | 320 | IN | |
Oct 8, 2024 08:52:03.744261026 CEST | 127 | OUT | |
Oct 8, 2024 08:52:03.846075058 CEST | 320 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
1 | 192.168.2.4 | 49733 | 193.122.130.0 | 80 | 2304 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
Oct 8, 2024 08:52:04.472758055 CEST | 127 | OUT | |
Oct 8, 2024 08:52:04.928960085 CEST | 320 | IN | |
Oct 8, 2024 08:52:05.183506012 CEST | 320 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
2 | 192.168.2.4 | 49735 | 193.122.130.0 | 80 | 2304 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
Oct 8, 2024 08:52:05.544373035 CEST | 127 | OUT | |
Oct 8, 2024 08:52:06.009712934 CEST | 320 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
3 | 192.168.2.4 | 49737 | 193.122.130.0 | 80 | 2304 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
Oct 8, 2024 08:52:06.606302977 CEST | 151 | OUT | |
Oct 8, 2024 08:52:07.063076019 CEST | 320 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
4 | 192.168.2.4 | 49739 | 193.122.130.0 | 80 | 2304 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
Oct 8, 2024 08:52:07.694746971 CEST | 151 | OUT | |
Oct 8, 2024 08:52:08.180942059 CEST | 320 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
5 | 192.168.2.4 | 49741 | 193.122.130.0 | 80 | 2304 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
Oct 8, 2024 08:52:08.778440952 CEST | 151 | OUT | |
Oct 8, 2024 08:52:09.284032106 CEST | 320 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
6 | 192.168.2.4 | 49743 | 193.122.130.0 | 80 | 2304 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
Oct 8, 2024 08:52:09.959160089 CEST | 151 | OUT | |
Oct 8, 2024 08:52:10.421799898 CEST | 320 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
7 | 192.168.2.4 | 49745 | 193.122.130.0 | 80 | 2304 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
Oct 8, 2024 08:52:11.080621958 CEST | 151 | OUT | |
Oct 8, 2024 08:52:11.557512999 CEST | 320 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
8 | 192.168.2.4 | 49748 | 193.122.130.0 | 80 | 4080 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
Oct 8, 2024 08:52:13.657234907 CEST | 151 | OUT | |
Oct 8, 2024 08:52:14.122519970 CEST | 320 | IN | |
Oct 8, 2024 08:52:14.126900911 CEST | 127 | OUT | |
Oct 8, 2024 08:52:14.228949070 CEST | 320 | IN | |
Oct 8, 2024 08:52:14.899931908 CEST | 127 | OUT | |
Oct 8, 2024 08:52:15.006644964 CEST | 320 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
9 | 192.168.2.4 | 49753 | 193.122.130.0 | 80 | 4080 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
Oct 8, 2024 08:52:15.629657030 CEST | 127 | OUT | |
Oct 8, 2024 08:52:16.107295036 CEST | 320 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
10 | 192.168.2.4 | 49757 | 193.122.130.0 | 80 | 4080 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
Oct 8, 2024 08:52:16.716454029 CEST | 151 | OUT | |
Oct 8, 2024 08:52:17.173516989 CEST | 320 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
11 | 192.168.2.4 | 49760 | 193.122.130.0 | 80 | 4080 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
Oct 8, 2024 08:52:17.781667948 CEST | 151 | OUT | |
Oct 8, 2024 08:52:18.248183966 CEST | 320 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
12 | 192.168.2.4 | 49763 | 193.122.130.0 | 80 | 4080 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
Oct 8, 2024 08:52:18.855271101 CEST | 151 | OUT | |
Oct 8, 2024 08:52:19.348553896 CEST | 320 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
13 | 192.168.2.4 | 49766 | 193.122.130.0 | 80 | 4080 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
Oct 8, 2024 08:52:20.015481949 CEST | 151 | OUT | |
Oct 8, 2024 08:52:20.471493006 CEST | 320 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
14 | 192.168.2.4 | 49768 | 193.122.130.0 | 80 | 4080 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
Oct 8, 2024 08:52:21.106823921 CEST | 151 | OUT | |
Oct 8, 2024 08:52:21.590361118 CEST | 320 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
15 | 192.168.2.4 | 49771 | 193.122.130.0 | 80 | 4080 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
Oct 8, 2024 08:52:22.184783936 CEST | 151 | OUT | |
Oct 8, 2024 08:52:22.640320063 CEST | 320 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
0 | 192.168.2.4 | 49731 | 188.114.96.3 | 443 | 2304 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-10-08 06:52:03 UTC | 84 | OUT | |
2024-10-08 06:52:03 UTC | 676 | IN | |
2024-10-08 06:52:03 UTC | 340 | IN | |
2024-10-08 06:52:03 UTC | 5 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
1 | 192.168.2.4 | 49732 | 188.114.96.3 | 443 | 2304 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-10-08 06:52:04 UTC | 60 | OUT | |
2024-10-08 06:52:04 UTC | 678 | IN | |
2024-10-08 06:52:04 UTC | 340 | IN | |
2024-10-08 06:52:04 UTC | 5 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
2 | 192.168.2.4 | 49734 | 188.114.96.3 | 443 | 2304 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-10-08 06:52:05 UTC | 60 | OUT | |
2024-10-08 06:52:05 UTC | 680 | IN | |
2024-10-08 06:52:05 UTC | 340 | IN | |
2024-10-08 06:52:05 UTC | 5 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
3 | 192.168.2.4 | 49736 | 188.114.96.3 | 443 | 2304 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-10-08 06:52:06 UTC | 84 | OUT | |
2024-10-08 06:52:06 UTC | 686 | IN | |
2024-10-08 06:52:06 UTC | 340 | IN | |
2024-10-08 06:52:06 UTC | 5 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
4 | 192.168.2.4 | 49738 | 188.114.96.3 | 443 | 2304 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-10-08 06:52:07 UTC | 84 | OUT | |
2024-10-08 06:52:07 UTC | 682 | IN | |
2024-10-08 06:52:07 UTC | 340 | IN | |
2024-10-08 06:52:07 UTC | 5 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
5 | 192.168.2.4 | 49740 | 188.114.96.3 | 443 | 2304 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-10-08 06:52:08 UTC | 84 | OUT | |
2024-10-08 06:52:08 UTC | 676 | IN | |
2024-10-08 06:52:08 UTC | 340 | IN | |
2024-10-08 06:52:08 UTC | 5 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
6 | 192.168.2.4 | 49742 | 188.114.96.3 | 443 | 2304 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-10-08 06:52:09 UTC | 84 | OUT | |
2024-10-08 06:52:09 UTC | 706 | IN | |
2024-10-08 06:52:09 UTC | 340 | IN | |
2024-10-08 06:52:09 UTC | 5 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
7 | 192.168.2.4 | 49744 | 188.114.96.3 | 443 | 2304 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-10-08 06:52:10 UTC | 84 | OUT | |
2024-10-08 06:52:11 UTC | 676 | IN | |
2024-10-08 06:52:11 UTC | 340 | IN | |
2024-10-08 06:52:11 UTC | 5 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
8 | 192.168.2.4 | 49746 | 188.114.96.3 | 443 | 2304 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-10-08 06:52:12 UTC | 60 | OUT | |
2024-10-08 06:52:12 UTC | 708 | IN | |
2024-10-08 06:52:12 UTC | 340 | IN | |
2024-10-08 06:52:12 UTC | 5 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
9 | 192.168.2.4 | 49747 | 149.154.167.220 | 443 | 2304 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-10-08 06:52:12 UTC | 345 | OUT | |
2024-10-08 06:52:13 UTC | 344 | IN | |
2024-10-08 06:52:13 UTC | 55 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
10 | 192.168.2.4 | 49749 | 188.114.96.3 | 443 | 4080 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-10-08 06:52:14 UTC | 84 | OUT | |
2024-10-08 06:52:14 UTC | 672 | IN | |
2024-10-08 06:52:14 UTC | 340 | IN | |
2024-10-08 06:52:14 UTC | 5 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
11 | 192.168.2.4 | 49751 | 188.114.96.3 | 443 | 4080 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-10-08 06:52:15 UTC | 60 | OUT | |
2024-10-08 06:52:15 UTC | 674 | IN | |
2024-10-08 06:52:15 UTC | 340 | IN | |
2024-10-08 06:52:15 UTC | 5 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
12 | 192.168.2.4 | 49755 | 188.114.96.3 | 443 | 4080 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-10-08 06:52:16 UTC | 84 | OUT | |
2024-10-08 06:52:16 UTC | 682 | IN | |
2024-10-08 06:52:16 UTC | 340 | IN | |
2024-10-08 06:52:16 UTC | 5 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
13 | 192.168.2.4 | 49758 | 188.114.96.3 | 443 | 4080 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-10-08 06:52:17 UTC | 84 | OUT | |
2024-10-08 06:52:17 UTC | 684 | IN | |
2024-10-08 06:52:17 UTC | 340 | IN | |
2024-10-08 06:52:17 UTC | 5 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
14 | 192.168.2.4 | 49761 | 188.114.96.3 | 443 | 4080 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-10-08 06:52:18 UTC | 60 | OUT | |
2024-10-08 06:52:18 UTC | 676 | IN | |
2024-10-08 06:52:18 UTC | 340 | IN | |
2024-10-08 06:52:18 UTC | 5 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
15 | 192.168.2.4 | 49765 | 188.114.96.3 | 443 | 4080 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-10-08 06:52:19 UTC | 84 | OUT | |
2024-10-08 06:52:19 UTC | 686 | IN | |
2024-10-08 06:52:19 UTC | 340 | IN | |
2024-10-08 06:52:19 UTC | 5 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
16 | 192.168.2.4 | 49767 | 188.114.96.3 | 443 | 4080 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-10-08 06:52:20 UTC | 60 | OUT | |
2024-10-08 06:52:21 UTC | 672 | IN | |
2024-10-08 06:52:21 UTC | 340 | IN | |
2024-10-08 06:52:21 UTC | 5 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
17 | 192.168.2.4 | 49769 | 188.114.96.3 | 443 | 4080 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-10-08 06:52:22 UTC | 84 | OUT | |
2024-10-08 06:52:22 UTC | 674 | IN | |
2024-10-08 06:52:22 UTC | 340 | IN | |
2024-10-08 06:52:22 UTC | 5 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
18 | 192.168.2.4 | 49770 | 149.154.167.220 | 443 | 2304 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-10-08 06:52:22 UTC | 374 | OUT | |
2024-10-08 06:52:22 UTC | 7024 | OUT | |
2024-10-08 06:52:23 UTC | 388 | IN | |
2024-10-08 06:52:23 UTC | 551 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
19 | 192.168.2.4 | 49772 | 188.114.96.3 | 443 | 4080 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-10-08 06:52:23 UTC | 84 | OUT | |
2024-10-08 06:52:23 UTC | 680 | IN | |
2024-10-08 06:52:23 UTC | 340 | IN | |
2024-10-08 06:52:23 UTC | 5 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
20 | 192.168.2.4 | 49773 | 149.154.167.220 | 443 | 4080 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-10-08 06:52:23 UTC | 345 | OUT | |
2024-10-08 06:52:24 UTC | 344 | IN | |
2024-10-08 06:52:24 UTC | 55 | IN |
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
21 | 192.168.2.4 | 49775 | 149.154.167.220 | 443 | 4080 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
2024-10-08 06:52:33 UTC | 374 | OUT | |
2024-10-08 06:52:33 UTC | 7024 | OUT | |
2024-10-08 06:52:33 UTC | 388 | IN | |
2024-10-08 06:52:33 UTC | 551 | IN |
Timestamp | Source Port | Dest Port | Source IP | Dest IP | Commands |
---|---|---|---|---|---|
Oct 8, 2024 08:52:20.323447943 CEST | 587 | 49764 | 118.69.190.131 | 192.168.2.4 | 220 isphost2.fptdata.vn ESMTP Exim 4.94 Tue, 08 Oct 2024 13:52:20 +0700 |
Oct 8, 2024 08:52:20.323707104 CEST | 49764 | 587 | 192.168.2.4 | 118.69.190.131 | EHLO 632922 |
Oct 8, 2024 08:52:20.675873041 CEST | 587 | 49764 | 118.69.190.131 | 192.168.2.4 | 250-isphost2.fptdata.vn Hello 632922 [8.46.123.33] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-X_PIPE_CONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP |
Oct 8, 2024 08:52:20.677772999 CEST | 49764 | 587 | 192.168.2.4 | 118.69.190.131 | AUTH login c2FsZXMtbmd1eWVuQHZ2dHJhZGUudm4= |
Oct 8, 2024 08:52:21.026334047 CEST | 587 | 49764 | 118.69.190.131 | 192.168.2.4 | 334 UGFzc3dvcmQ6 |
Oct 8, 2024 08:52:21.403764009 CEST | 587 | 49764 | 118.69.190.131 | 192.168.2.4 | 235 Authentication succeeded |
Oct 8, 2024 08:52:21.407527924 CEST | 49764 | 587 | 192.168.2.4 | 118.69.190.131 | MAIL FROM:<sales-nguyen@vvtrade.vn> |
Oct 8, 2024 08:52:21.756900072 CEST | 587 | 49764 | 118.69.190.131 | 192.168.2.4 | 250 OK |
Oct 8, 2024 08:52:21.757077932 CEST | 49764 | 587 | 192.168.2.4 | 118.69.190.131 | RCPT TO:<saleseuropower@yandex.com> |
Oct 8, 2024 08:52:22.106954098 CEST | 587 | 49764 | 118.69.190.131 | 192.168.2.4 | 550-Account sales-nguyen@vvtrade.vn currently blocked for sending to too many 550 invalid recipients |
Oct 8, 2024 08:52:31.150914907 CEST | 587 | 49774 | 118.69.190.131 | 192.168.2.4 | 220 isphost2.fptdata.vn ESMTP Exim 4.94 Tue, 08 Oct 2024 13:52:30 +0700 |
Oct 8, 2024 08:52:31.151134968 CEST | 49774 | 587 | 192.168.2.4 | 118.69.190.131 | EHLO 632922 |
Oct 8, 2024 08:52:31.499053955 CEST | 587 | 49774 | 118.69.190.131 | 192.168.2.4 | 250-isphost2.fptdata.vn Hello 632922 [8.46.123.33] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-X_PIPE_CONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP |
Oct 8, 2024 08:52:31.499325037 CEST | 49774 | 587 | 192.168.2.4 | 118.69.190.131 | AUTH login c2FsZXMtbmd1eWVuQHZ2dHJhZGUudm4= |
Oct 8, 2024 08:52:31.847161055 CEST | 587 | 49774 | 118.69.190.131 | 192.168.2.4 | 334 UGFzc3dvcmQ6 |
Oct 8, 2024 08:52:32.216043949 CEST | 587 | 49774 | 118.69.190.131 | 192.168.2.4 | 235 Authentication succeeded |
Oct 8, 2024 08:52:32.220900059 CEST | 49774 | 587 | 192.168.2.4 | 118.69.190.131 | MAIL FROM:<sales-nguyen@vvtrade.vn> |
Oct 8, 2024 08:52:32.596998930 CEST | 587 | 49774 | 118.69.190.131 | 192.168.2.4 | 250 OK |
Oct 8, 2024 08:52:32.597466946 CEST | 49774 | 587 | 192.168.2.4 | 118.69.190.131 | RCPT TO:<saleseuropower@yandex.com> |
Oct 8, 2024 08:52:32.946053028 CEST | 587 | 49774 | 118.69.190.131 | 192.168.2.4 | 550-Account sales-nguyen@vvtrade.vn currently blocked for sending to too many 550 invalid recipients |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
Target ID: | 0 |
Start time: | 02:51:57 |
Start date: | 08/10/2024 |
Path: | C:\Users\user\Desktop\Urgent inquiry for quotation .exe |
Wow64 process (32bit): | true |
Commandline: | |
Imagebase: | 0x400000 |
File size: | 1'221'903 bytes |
MD5 hash: | D64843EA87D7ABBE765B51AAE7BDD99B |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Reputation: | low |
Has exited: | true |
Target ID: | 1 |
Start time: | 02:51:58 |
Start date: | 08/10/2024 |
Path: | C:\Users\user\AppData\Local\directory\name.exe |
Wow64 process (32bit): | true |
Commandline: | |
Imagebase: | 0x400000 |
File size: | 1'221'903 bytes |
MD5 hash: | D64843EA87D7ABBE765B51AAE7BDD99B |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Yara matches: |
|
Antivirus matches: |
|
Reputation: | low |
Has exited: | true |
Target ID: | 2 |
Start time: | 02:52:00 |
Start date: | 08/10/2024 |
Path: | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Wow64 process (32bit): | true |
Commandline: | |
Imagebase: | 0xe90000 |
File size: | 45'984 bytes |
MD5 hash: | 9D352BC46709F0CB5EC974633A0C3C94 |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Yara matches: |
|
Reputation: | high |
Has exited: | false |
Target ID: | 3 |
Start time: | 02:52:10 |
Start date: | 08/10/2024 |
Path: | C:\Windows\System32\wscript.exe |
Wow64 process (32bit): | false |
Commandline: | |
Imagebase: | 0x7ff77f3c0000 |
File size: | 170'496 bytes |
MD5 hash: | A47CBE969EA935BDD3AB568BB126BC80 |
Has elevated privileges: | false |
Has administrator privileges: | false |
Programmed in: | C, C++ or other language |
Reputation: | high |
Has exited: | true |
Target ID: | 4 |
Start time: | 02:52:10 |
Start date: | 08/10/2024 |
Path: | C:\Users\user\AppData\Local\directory\name.exe |
Wow64 process (32bit): | true |
Commandline: | |
Imagebase: | 0x400000 |
File size: | 1'221'903 bytes |
MD5 hash: | D64843EA87D7ABBE765B51AAE7BDD99B |
Has elevated privileges: | false |
Has administrator privileges: | false |
Programmed in: | C, C++ or other language |
Yara matches: |
|
Reputation: | low |
Has exited: | true |
Target ID: | 5 |
Start time: | 02:52:12 |
Start date: | 08/10/2024 |
Path: | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Wow64 process (32bit): | true |
Commandline: | |
Imagebase: | 0x720000 |
File size: | 45'984 bytes |
MD5 hash: | 9D352BC46709F0CB5EC974633A0C3C94 |
Has elevated privileges: | false |
Has administrator privileges: | false |
Programmed in: | C, C++ or other language |
Yara matches: |
|
Reputation: | high |
Has exited: | false |
Target ID: | 8 |
Start time: | 02:52:18 |
Start date: | 08/10/2024 |
Path: | C:\Windows\System32\conhost.exe |
Wow64 process (32bit): | false |
Commandline: | |
Imagebase: | 0x7ff7699e0000 |
File size: | 862'208 bytes |
MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
Has elevated privileges: | true |
Has administrator privileges: | false |
Programmed in: | C, C++ or other language |
Reputation: | high |
Has exited: | true |
Execution Graph
Execution Coverage: | 2.8% |
Dynamic/Decrypted Code Coverage: | 1.1% |
Signature Coverage: | 3.3% |
Total number of Nodes: | 1594 |
Total number of Limit Nodes: | 36 |
Graph
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Control-flow Graph
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040EB70 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00410B90 Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 167registryCOMMON
Control-flow Graph
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004161C2 Relevance: 21.1, APIs: 14, Instructions: 86COMMON
Control-flow Graph
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Control-flow Graph
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004102F0 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53windowregistryCOMMON
Control-flow Graph
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004101F0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 74windowregistryCOMMON
Control-flow Graph
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00452574 Relevance: 13.7, APIs: 9, Instructions: 171COMMON
Control-flow Graph
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Control-flow Graph
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Control-flow Graph
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Control-flow Graph
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Control-flow Graph
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 03F65318 Relevance: 10.7, APIs: 7, Instructions: 151fileCOMMON
Control-flow Graph
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Control-flow Graph
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00413A88 Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE
Control-flow Graph
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 03F66DA8 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 160fileCOMMON
Control-flow Graph
APIs |
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0041171A Relevance: 6.0, APIs: 4, Instructions: 34COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 03F659F8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41processCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004734B7 Relevance: 4.7, APIs: 3, Instructions: 234COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0043526E Relevance: 4.5, APIs: 3, Instructions: 26COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040B380 Relevance: 3.3, APIs: 2, Instructions: 255COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040EFE0 Relevance: 3.1, APIs: 2, Instructions: 51fileCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004098B8 Relevance: 3.0, APIs: 2, Instructions: 32windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004098B6 Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 03F65A68 Relevance: 1.7, APIs: 1, Instructions: 157COMMON
APIs |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00410D40 Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004092C0 Relevance: 1.6, APIs: 1, Instructions: 71COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00401108 Relevance: 1.5, APIs: 1, Instructions: 36COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 03F652D8 Relevance: 1.5, APIs: 1, Instructions: 20COMMON
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0041AA31 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00444343 Relevance: 1.5, APIs: 1, Instructions: 19fileCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 03F652A8 Relevance: 1.5, APIs: 1, Instructions: 15COMMON
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040116E Relevance: 1.5, APIs: 1, Instructions: 12COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00414E06 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040D900 Relevance: 1.3, APIs: 1, Instructions: 22COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 03F66C94 Relevance: 1.3, APIs: 1, Instructions: 21sleepCOMMON
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 03F66C98 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004045E0 Relevance: 81.9, Strings: 63, Instructions: 3193COMMON
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0047C08E Relevance: 74.2, APIs: 40, Strings: 2, Instructions: 676windowkeyboardCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004375B0 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 126threadkeyboardwindowCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004461ED Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 227processCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0044BD29 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 178filestringCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0042039F Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 282timeCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00434D50 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 114fileCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00464422 Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 193threadCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040D6D0 Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 141windowCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00434BEE Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 139fileCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00444078 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 94timesleepCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00442E1F Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 134fileCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00445DD3 Relevance: 18.2, APIs: 12, Instructions: 179COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0047A999 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 288comCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004364AA Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 79shutdownCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0043614F Relevance: 16.6, APIs: 11, Instructions: 103COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0047AD92 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 251comCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00452126 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 127filesleepCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004772DE Relevance: 7.6, APIs: 5, Instructions: 67windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0045C999 Relevance: 4.6, APIs: 3, Instructions: 130fileCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00436ADE Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0045DD7C Relevance: 3.1, APIs: 2, Instructions: 56fileCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0047CBF0 Relevance: 2.9, Strings: 2, Instructions: 418COMMON
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040F890 Relevance: 2.1, APIs: 1, Instructions: 589COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0047E1FA Relevance: 2.0, APIs: 1, Instructions: 499COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0043916A Relevance: 1.5, APIs: 1, Instructions: 19COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004711D2 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0042202E Relevance: 1.5, APIs: 1, Instructions: 4COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00412C38 Relevance: .4, Instructions: 384COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00412818 Relevance: .4, Instructions: 378COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0041240C Relevance: .4, Instructions: 361COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00412038 Relevance: .4, Instructions: 351COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 03F68038 Relevance: .1, Instructions: 92COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 03F67EC8 Relevance: .0, Instructions: 35COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 03F67F28 Relevance: .0, Instructions: 35COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00410D10 Relevance: .0, Instructions: 19COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 03F66868 Relevance: .0, Instructions: 6COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00459384 Relevance: 79.2, APIs: 41, Strings: 4, Instructions: 480filewindowcomCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00441E05 Relevance: 49.8, APIs: 33, Instructions: 276COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0046AEAF Relevance: 40.7, APIs: 17, Strings: 6, Instructions: 417registryCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0045657D Relevance: 38.8, APIs: 19, Strings: 3, Instructions: 287windowCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00454DAA Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 203windowlibraryCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00452788 Relevance: 34.8, APIs: 23, Instructions: 344COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004700B0 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 285windowtimeCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00476A8A Relevance: 27.3, APIs: 18, Instructions: 332COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0045DE12 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 190timeCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0043737D Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 83windowCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00458D1C Relevance: 25.6, APIs: 17, Instructions: 112COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00469681 Relevance: 24.8, APIs: 13, Strings: 1, Instructions: 253windowCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004680EB Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 204windowCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0046F2B0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 185windowfileCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0045F48E Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 226windowsleepCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0045510D Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 115windowCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00415C25 Relevance: 22.7, APIs: 15, Instructions: 236COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00433BAC Relevance: 22.6, APIs: 15, Instructions: 79COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00460ABB Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 294windowtimeCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00434506 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162windowCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00435A35 Relevance: 21.1, APIs: 14, Instructions: 136timeCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00445A77 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 73windowCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004582BF Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 165registryCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004580E1 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 136registryshareCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004584D6 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 105registryCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00436582 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 79networkCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00416B12 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 57libraryloaderCOMMONLIBRARYCODE
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00437DB1 Relevance: 18.2, APIs: 12, Instructions: 180COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00436879 Relevance: 18.1, APIs: 12, Instructions: 115COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0046B39A Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 401registryCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0046F50B Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 157windowCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0046FD7F Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 143windowCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004393E2 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 109threadCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00467214 Relevance: 16.8, APIs: 11, Instructions: 313COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004507E7 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 146windowCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00448602 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 105windowCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004691F4 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 88windowCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004693F0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 87windowCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0046ECBF Relevance: 15.1, APIs: 10, Instructions: 101COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0045E912 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 353timeCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0042FE54 Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 298sleepCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0046A75F Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 179registryCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0045F2C5 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 146windowCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0043717F Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 46windowCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00456168 Relevance: 13.7, APIs: 9, Instructions: 181COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004417BC Relevance: 13.6, APIs: 9, Instructions: 142COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00445CF9 Relevance: 13.6, APIs: 9, Instructions: 69sleepkeyboardwindowCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0045427D Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 259libraryloaderCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0044AA1F Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 171networkCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0046BB59 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 168networkCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0044BBC9 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 100filestringCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0047439D Relevance: 12.3, APIs: 8, Instructions: 268COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00436EC8 Relevance: 12.1, APIs: 8, Instructions: 103COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004140DB Relevance: 12.0, APIs: 8, Instructions: 42threadCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004357AD Relevance: 12.0, APIs: 8, Instructions: 36COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00440B39 Relevance: 10.8, APIs: 7, Instructions: 261COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0045377F Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236windowCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004472C8 Relevance: 10.7, APIs: 7, Instructions: 207COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00447303 Relevance: 10.7, APIs: 7, Instructions: 192COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0044733D Relevance: 10.7, APIs: 7, Instructions: 177COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004498BD Relevance: 10.7, APIs: 7, Instructions: 159COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0046A98D Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 158registryCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0044849C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 106windowCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0047244D Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 104sleepCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00448AFF Relevance: 10.6, APIs: 7, Instructions: 98windowCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00401BE0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 90windowCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00450DB4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 76windowCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00455449 Relevance: 10.6, APIs: 7, Instructions: 75windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00415702 Relevance: 10.6, APIs: 7, Instructions: 74threadCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00439102 Relevance: 10.5, APIs: 7, Instructions: 46threadCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0041568B Relevance: 10.5, APIs: 7, Instructions: 37threadCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00434124 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 15libraryloaderCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0047B1D0 Relevance: 9.5, APIs: 6, Instructions: 489COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004336C7 Relevance: 9.3, APIs: 6, Instructions: 253COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00457838 Relevance: 9.2, APIs: 6, Instructions: 176COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00445153 Relevance: 9.1, APIs: 6, Instructions: 142COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00447B66 Relevance: 9.1, APIs: 6, Instructions: 119COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0044B474 Relevance: 9.1, APIs: 6, Instructions: 113fileCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00441077 Relevance: 9.1, APIs: 6, Instructions: 111windowCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00449063 Relevance: 9.1, APIs: 6, Instructions: 108windowCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00442582 Relevance: 9.1, APIs: 6, Instructions: 104COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00448851 Relevance: 9.1, APIs: 6, Instructions: 92windowCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00449606 Relevance: 9.1, APIs: 6, Instructions: 91windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004416D1 Relevance: 9.1, APIs: 6, Instructions: 84COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0045552E Relevance: 9.1, APIs: 6, Instructions: 78windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00467E5E Relevance: 9.1, APIs: 6, Instructions: 78COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00455080 Relevance: 9.1, APIs: 6, Instructions: 75windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00455212 Relevance: 9.1, APIs: 6, Instructions: 72windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00439326 Relevance: 9.1, APIs: 6, Instructions: 72processCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0041415E Relevance: 9.1, APIs: 6, Instructions: 71threadCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004555E0 Relevance: 9.1, APIs: 6, Instructions: 67windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004554C0 Relevance: 9.1, APIs: 6, Instructions: 61windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0043609C Relevance: 9.1, APIs: 6, Instructions: 59COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00436272 Relevance: 9.1, APIs: 6, Instructions: 59sleepCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004471EC Relevance: 9.0, APIs: 6, Instructions: 50COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0044CBD3 Relevance: 9.0, APIs: 6, Instructions: 49COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0044B64F Relevance: 9.0, APIs: 6, Instructions: 40synchronizationthreadCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0043604B Relevance: 9.0, APIs: 6, Instructions: 33serviceCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0045F132 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 128windowCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004692E4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 98windowCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004412AE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 84windowlibraryCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00443009 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 82windowCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004609BD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76windowCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0045C277 Relevance: 7.6, APIs: 5, Instructions: 105COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0044796B Relevance: 7.6, APIs: 5, Instructions: 96COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00447BAF Relevance: 7.6, APIs: 5, Instructions: 95COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00447870 Relevance: 7.6, APIs: 5, Instructions: 94windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00448837 Relevance: 7.6, APIs: 5, Instructions: 89COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00449549 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00455014 Relevance: 7.6, APIs: 5, Instructions: 78COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00445719 Relevance: 7.6, APIs: 5, Instructions: 76windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00459DCF Relevance: 7.6, APIs: 5, Instructions: 71COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00464950 Relevance: 7.6, APIs: 5, Instructions: 68networkCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0044710F Relevance: 7.6, APIs: 5, Instructions: 67COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0043770A Relevance: 7.6, APIs: 5, Instructions: 56sleepCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0046FCC6 Relevance: 7.5, APIs: 5, Instructions: 49windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004555B8 Relevance: 7.5, APIs: 5, Instructions: 45windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00455505 Relevance: 7.5, APIs: 5, Instructions: 43windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0045551F Relevance: 7.5, APIs: 5, Instructions: 42windowCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0043315E Relevance: 7.5, APIs: 5, Instructions: 33COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004140CF Relevance: 7.5, APIs: 5, Instructions: 24threadCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00415601 Relevance: 7.5, APIs: 5, Instructions: 23threadCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0041567F Relevance: 7.5, APIs: 5, Instructions: 22threadCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004667A7 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 170shareCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00438A5D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154windowCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00465D41 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 119networkCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0044A7DC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116networkCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00437CA6 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 107libraryloaderCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00451191 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00450D00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70windowCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0046BD4D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69networkCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004497A4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53windowCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004342A8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33memoryCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0043416A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004343CE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004343FD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0043442C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040EE70 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040EEE0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040ACA0 Relevance: 6.4, APIs: 4, Instructions: 368COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0041456C Relevance: 6.1, APIs: 4, Instructions: 137COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004781AE Relevance: 6.1, APIs: 4, Instructions: 135COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00441CB4 Relevance: 6.1, APIs: 4, Instructions: 112windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0045D070 Relevance: 6.1, APIs: 4, Instructions: 100fileCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0045058D Relevance: 6.1, APIs: 4, Instructions: 98COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004613E0 Relevance: 6.1, APIs: 4, Instructions: 90windowCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040E1E0 Relevance: 6.1, APIs: 4, Instructions: 82windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004727F8 Relevance: 6.1, APIs: 4, Instructions: 82COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0047721A Relevance: 6.1, APIs: 4, Instructions: 73COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00448C8B Relevance: 6.1, APIs: 4, Instructions: 73windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004588B0 Relevance: 6.1, APIs: 4, Instructions: 67networkCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00438D4E Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0043362D Relevance: 6.1, APIs: 4, Instructions: 54windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0044419B Relevance: 6.1, APIs: 4, Instructions: 53synchronizationthreadwindowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0043401C Relevance: 6.0, APIs: 4, Instructions: 50COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00436A1D Relevance: 6.0, APIs: 4, Instructions: 48COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00437AFE Relevance: 6.0, APIs: 4, Instructions: 44COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004555D6 Relevance: 6.0, APIs: 4, Instructions: 40windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0044B600 Relevance: 6.0, APIs: 4, Instructions: 33COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00447268 Relevance: 6.0, APIs: 4, Instructions: 32COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00471144 Relevance: 6.0, APIs: 4, Instructions: 28COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00471102 Relevance: 6.0, APIs: 4, Instructions: 28COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0041405D Relevance: 6.0, APIs: 4, Instructions: 19threadCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00444652 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104windowCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00448358 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99windowCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0045126C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74windowCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004515AB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00474827 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72sleepCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004647A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59networkCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004694DE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 56windowCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00442AFE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55networkCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004695F7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54windowCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0046956F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 53windowCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004560AD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36windowCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00442262 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17windowCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0044222A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17windowCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00439514 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 8windowCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|