Edit tour
Windows
Analysis Report
SecuriteInfo.com.Trojan.DownLoader47.43477.29852.19410.exe
Overview
General Information
Detection
LummaC, Vidar
Score: | 100 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Antivirus detection for URL or domain
Found malware configuration
Suricata IDS alerts for network traffic
Yara detected AntiVM3
Yara detected LummaC Stealer
Yara detected Powershell download and execute
Yara detected Vidar
Yara detected Vidar stealer
AI detected suspicious sample
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Country aware sample found (crashes after keyboard check)
Found evasive API chain checking for user administrative privileges
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
LummaC encrypted strings found
Machine Learning detection for dropped file
Machine Learning detection for sample
Sample uses string decryption to hide its real strings
Searches for specific processes (likely to inject)
Sigma detected: Silenttrinity Stager Msbuild Activity
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
AV process strings found (often used to terminate AV products)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to detect sandboxes (mouse cursor move detection)
Contains functionality to dynamically determine API calls
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to record screenshots
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Downloads executable code via HTTP
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Extensive use of GetProcAddress (often used to hide API calls)
Found dropped PE file which has not been started or loaded
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
PE / OLE file has an invalid certificate
PE file contains an invalid checksum
PE file contains sections with non-standard names
Queries information about the installed CPU (vendor, model number etc)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Uses the keyboard layout for branch decision (may execute only for specific keyboard layouts)
Yara detected Credential Stealer
Classification
- System is w10x64
- SecuriteInfo.com.Trojan.DownLoader47.43477.29852.19410.exe (PID: 4712 cmdline:
"C:\Users\ user\Deskt op\Securit eInfo.com. Trojan.Dow nLoader47. 43477.2985 2.19410.ex e" MD5: AF5BFAA4908459155ADE24245AAB4A1B) - MSBuild.exe (PID: 1568 cmdline:
"C:\Window s\Microsof t.NET\Fram ework\v4.0 .30319\MSB uild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232) - MSBuild.exe (PID: 4788 cmdline:
"C:\Window s\Microsof t.NET\Fram ework\v4.0 .30319\MSB uild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232) - AKEGIIJDGH.exe (PID: 6008 cmdline:
"C:\Progra mData\AKEG IIJDGH.exe " MD5: F56A4A7B59E1E81087BB64A4A70FB32F) - MSBuild.exe (PID: 764 cmdline:
"C:\Window s\Microsof t.NET\Fram ework\v4.0 .30319\MSB uild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232) - MSBuild.exe (PID: 5680 cmdline:
"C:\Window s\Microsof t.NET\Fram ework\v4.0 .30319\MSB uild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232) - WerFault.exe (PID: 2796 cmdline:
C:\Windows \SysWOW64\ WerFault.e xe -u -p 6 008 -s 300 MD5: C31336C1EFC2CCB44B4326EA793040F2) - cmd.exe (PID: 6608 cmdline:
"C:\Window s\system32 \cmd.exe" /c timeout /t 10 & r d /s /q "C :\ProgramD ata\BKFIJJ EGHDAE" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 2140 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - timeout.exe (PID: 6448 cmdline:
timeout /t 10 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3) - WerFault.exe (PID: 3176 cmdline:
C:\Windows \SysWOW64\ WerFault.e xe -u -p 4 712 -s 304 MD5: C31336C1EFC2CCB44B4326EA793040F2)
- cleanup
Name | Description | Attribution | Blogpost URLs | Link |
---|---|---|---|---|
Lumma Stealer, LummaC2 Stealer | Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell. | No Attribution |
Name | Description | Attribution | Blogpost URLs | Link |
---|---|---|---|---|
Vidar | Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser. | No Attribution |
{"C2 url": ["drawwyobstacw.sbs", "resinedyw.sbs", "mathcucom.sbs", "ehticsprocw.sbs", "enlargkiw.sbs", "allocatinow.sbs", "condifendteu.sbs", "vennurviot.sbs"], "Build id": "H8NgCl--"}
{"C2 url": ["https://steamcommunity.com/profiles/76561199786602107", "https://t.me/maslengdsa"], "Botnet": "8ecc9c7eaebfdf2a8cc0586d7419d6ea"}
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_Vidar_1 | Yara detected Vidar stealer | Joe Security | ||
JoeSecurity_Vidar_2 | Yara detected Vidar | Joe Security |
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_Vidar_1 | Yara detected Vidar stealer | Joe Security | ||
JoeSecurity_AntiVM_3 | Yara detected AntiVM_3 | Joe Security | ||
JoeSecurity_CredentialStealer | Yara detected Credential Stealer | Joe Security | ||
JoeSecurity_Vidar_1 | Yara detected Vidar stealer | Joe Security | ||
JoeSecurity_AntiVM_3 | Yara detected AntiVM_3 | Joe Security | ||
Click to see the 8 entries |
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_Vidar_1 | Yara detected Vidar stealer | Joe Security | ||
JoeSecurity_AntiVM_3 | Yara detected AntiVM_3 | Joe Security | ||
JoeSecurity_Vidar_1 | Yara detected Vidar stealer | Joe Security | ||
JoeSecurity_AntiVM_3 | Yara detected AntiVM_3 | Joe Security | ||
JoeSecurity_Vidar_1 | Yara detected Vidar stealer | Joe Security | ||
Click to see the 5 entries |
System Summary |
---|
Source: | Author: Kiran kumar s, oscd.community: |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-10-08T20:47:42.995479+0200 | 2054653 | 1 | A Network Trojan was detected | 192.168.2.5 | 49886 | 188.114.96.3 | 443 | TCP |
2024-10-08T20:47:43.993818+0200 | 2054653 | 1 | A Network Trojan was detected | 192.168.2.5 | 49894 | 188.114.96.3 | 443 | TCP |
2024-10-08T20:47:45.176633+0200 | 2054653 | 1 | A Network Trojan was detected | 192.168.2.5 | 49902 | 188.114.97.3 | 443 | TCP |
2024-10-08T20:47:46.305352+0200 | 2054653 | 1 | A Network Trojan was detected | 192.168.2.5 | 49911 | 104.21.33.249 | 443 | TCP |
2024-10-08T20:47:47.431215+0200 | 2054653 | 1 | A Network Trojan was detected | 192.168.2.5 | 49917 | 172.67.205.156 | 443 | TCP |
2024-10-08T20:47:48.766658+0200 | 2054653 | 1 | A Network Trojan was detected | 192.168.2.5 | 49923 | 172.67.140.193 | 443 | TCP |
2024-10-08T20:47:50.049508+0200 | 2054653 | 1 | A Network Trojan was detected | 192.168.2.5 | 49936 | 104.21.79.35 | 443 | TCP |
2024-10-08T20:47:51.088531+0200 | 2054653 | 1 | A Network Trojan was detected | 192.168.2.5 | 49942 | 188.114.96.3 | 443 | TCP |
2024-10-08T20:47:53.679779+0200 | 2054653 | 1 | A Network Trojan was detected | 192.168.2.5 | 49957 | 172.67.206.204 | 443 | TCP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-10-08T20:47:42.995479+0200 | 2049836 | 1 | A Network Trojan was detected | 192.168.2.5 | 49886 | 188.114.96.3 | 443 | TCP |
2024-10-08T20:47:43.993818+0200 | 2049836 | 1 | A Network Trojan was detected | 192.168.2.5 | 49894 | 188.114.96.3 | 443 | TCP |
2024-10-08T20:47:45.176633+0200 | 2049836 | 1 | A Network Trojan was detected | 192.168.2.5 | 49902 | 188.114.97.3 | 443 | TCP |
2024-10-08T20:47:46.305352+0200 | 2049836 | 1 | A Network Trojan was detected | 192.168.2.5 | 49911 | 104.21.33.249 | 443 | TCP |
2024-10-08T20:47:47.431215+0200 | 2049836 | 1 | A Network Trojan was detected | 192.168.2.5 | 49917 | 172.67.205.156 | 443 | TCP |
2024-10-08T20:47:48.766658+0200 | 2049836 | 1 | A Network Trojan was detected | 192.168.2.5 | 49923 | 172.67.140.193 | 443 | TCP |
2024-10-08T20:47:50.049508+0200 | 2049836 | 1 | A Network Trojan was detected | 192.168.2.5 | 49936 | 104.21.79.35 | 443 | TCP |
2024-10-08T20:47:51.088531+0200 | 2049836 | 1 | A Network Trojan was detected | 192.168.2.5 | 49942 | 188.114.96.3 | 443 | TCP |
2024-10-08T20:47:53.679779+0200 | 2049836 | 1 | A Network Trojan was detected | 192.168.2.5 | 49957 | 172.67.206.204 | 443 | TCP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-10-08T20:47:21.875917+0200 | 2044247 | 1 | Malware Command and Control Activity Detected | 95.164.90.97 | 80 | 192.168.2.5 | 49755 | TCP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-10-08T20:47:22.619086+0200 | 2051831 | 1 | Malware Command and Control Activity Detected | 95.164.90.97 | 80 | 192.168.2.5 | 49755 | TCP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-10-08T20:47:21.245058+0200 | 2049087 | 1 | A Network Trojan was detected | 192.168.2.5 | 49755 | 95.164.90.97 | 80 | TCP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-10-08T20:47:40.112889+0200 | 2803304 | 3 | Unknown Traffic | 192.168.2.5 | 49875 | 147.45.44.104 | 80 | TCP |
Click to jump to signature section
Show All Signature Results
AV Detection |
---|
Source: | URL Reputation: | ||
Source: | URL Reputation: |
Source: | Malware Configuration Extractor: | ||
Source: | Malware Configuration Extractor: |
Source: | Integrated Neural Analysis Model: |
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: |
Source: | Joe Sandbox ML: |
Source: | String decryptor: | ||
Source: | String decryptor: | ||
Source: | String decryptor: | ||
Source: | String decryptor: | ||
Source: | String decryptor: | ||
Source: | String decryptor: | ||
Source: | String decryptor: | ||
Source: | String decryptor: | ||
Source: | String decryptor: | ||
Source: | String decryptor: | ||
Source: | String decryptor: | ||
Source: | String decryptor: | ||
Source: | String decryptor: | ||
Source: | String decryptor: | ||
Source: | String decryptor: |
Source: | Code function: | 2_2_004080A1 | |
Source: | Code function: | 2_2_00408048 | |
Source: | Code function: | 2_2_00411E32 | |
Source: | Code function: | 2_2_0040A7AD | |
Source: | Code function: | 2_2_6C9E6C80 | |
Source: | Code function: | 2_2_6CBAA9A0 | |
Source: | Code function: | 2_2_6CBA44C0 | |
Source: | Code function: | 2_2_6CB74420 | |
Source: | Code function: | 2_2_6CBA4440 | |
Source: | Code function: | 2_2_6CBF25B0 |
Source: | Static PE information: |
Source: | HTTPS traffic detected: |
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: |
Source: | Static PE information: |
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: |
Source: | Code function: | 0_2_00C5BFD4 | |
Source: | Code function: | 2_2_00416013 | |
Source: | Code function: | 2_2_0041547D | |
Source: | Code function: | 2_2_00409CF1 | |
Source: | Code function: | 2_2_00414D08 | |
Source: | Code function: | 2_2_00401D80 | |
Source: | Code function: | 2_2_0040D59B | |
Source: | Code function: | 2_2_0040B5B4 | |
Source: | Code function: | 2_2_0040BF22 | |
Source: | Code function: | 2_2_0040B914 | |
Source: | Code function: | 2_2_00415B4D | |
Source: | Code function: | 2_2_0040CD0C | |
Source: | Code function: | 11_2_000EBFD4 |
Source: | Code function: | 2_2_00415182 |
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior |
Source: | Code function: | 0_2_00C7039D | |
Source: | Code function: | 0_2_00C7039D | |
Source: | Code function: | 2_2_004014AD | |
Source: | Code function: | 2_2_004014AD | |
Source: | Code function: | 11_2_001241D2 | |
Source: | Code function: | 11_2_001241D2 | |
Source: | Code function: | 11_2_001241D2 | |
Source: | Code function: | 11_2_0012E1E0 | |
Source: | Code function: | 11_2_00126240 | |
Source: | Code function: | 11_2_0012A3F0 | |
Source: | Code function: | 11_2_0012A3F0 | |
Source: | Code function: | 11_2_0012C420 | |
Source: | Code function: | 11_2_00128480 | |
Source: | Code function: | 11_2_001045E0 | |
Source: | Code function: | 11_2_0010C7B0 | |
Source: | Code function: | 11_2_0010C7B0 | |
Source: | Code function: | 11_2_001427D4 | |
Source: | Code function: | 11_2_0012E7F0 | |
Source: | Code function: | 11_2_0012A7E0 | |
Source: | Code function: | 11_2_001387E0 | |
Source: | Code function: | 11_2_0010E833 | |
Source: | Code function: | 11_2_001428A5 | |
Source: | Code function: | 11_2_0010E8E6 | |
Source: | Code function: | 11_2_00120A2E | |
Source: | Code function: | 11_2_00144B67 | |
Source: | Code function: | 11_2_00144EB4 | |
Source: | Code function: | 11_2_0012CF35 | |
Source: | Code function: | 11_2_0012CF35 | |
Source: | Code function: | 11_2_0012CFC7 | |
Source: | Code function: | 11_2_00142FC2 | |
Source: | Code function: | 11_2_00120FE7 | |
Source: | Code function: | 11_2_0012F010 | |
Source: | Code function: | 11_2_0011D070 | |
Source: | Code function: | 11_2_00129060 | |
Source: | Code function: | 11_2_0010D134 | |
Source: | Code function: | 11_2_001312AA | |
Source: | Code function: | 11_2_001452D0 | |
Source: | Code function: | 11_2_0012B395 | |
Source: | Code function: | 11_2_0011D3D0 | |
Source: | Code function: | 11_2_0013F4E0 | |
Source: | Code function: | 11_2_0012F55A | |
Source: | Code function: | 11_2_0013F640 | |
Source: | Code function: | 11_2_0010F662 | |
Source: | Code function: | 11_2_0011D663 | |
Source: | Code function: | 11_2_0011F6D0 | |
Source: | Code function: | 11_2_0010F798 | |
Source: | Code function: | 11_2_0012B803 | |
Source: | Code function: | 11_2_00131882 | |
Source: | Code function: | 11_2_00131882 | |
Source: | Code function: | 11_2_0013F990 | |
Source: | Code function: | 11_2_0012D9E2 | |
Source: | Code function: | 11_2_00105A80 | |
Source: | Code function: | 11_2_0012BAC8 | |
Source: | Code function: | 11_2_0012BB18 | |
Source: | Code function: | 11_2_00145B20 | |
Source: | Code function: | 11_2_0013FBB0 | |
Source: | Code function: | 11_2_0013FBB0 | |
Source: | Code function: | 11_2_0013BBAD | |
Source: | Code function: | 11_2_0013DCF0 | |
Source: | Code function: | 11_2_0010BD50 | |
Source: | Code function: | 11_2_00145DF0 | |
Source: | Code function: | 11_2_00145DF0 | |
Source: | Code function: | 11_2_0011DE03 | |
Source: | Code function: | 11_2_0011DE03 | |
Source: | Code function: | 11_2_0011DE03 | |
Source: | Code function: | 11_2_00129E4D | |
Source: | Code function: | 11_2_000FFEF0 | |
Source: | Code function: | 11_2_0010DFB0 | |
Source: | Code function: | 11_2_0013FFD0 | |
Source: | Code function: | 11_2_0013FFD0 | |
Source: | Code function: | 11_2_00141FC0 | |
Source: | Code function: | 13_2_0040F819 | |
Source: | Code function: | 13_2_0040F819 | |
Source: | Code function: | 13_2_004438E4 | |
Source: | Code function: | 13_2_004439B5 | |
Source: | Code function: | 13_2_00443D4F | |
Source: | Code function: | 13_2_0040CE60 | |
Source: | Code function: | 13_2_0042E049 | |
Source: | Code function: | 13_2_0042E049 | |
Source: | Code function: | 13_2_00401000 | |
Source: | Code function: | 13_2_0040F0C0 | |
Source: | Code function: | 13_2_004430D0 | |
Source: | Code function: | 13_2_0042E0D7 | |
Source: | Code function: | 13_2_004410E0 | |
Source: | Code function: | 13_2_004410E0 | |
Source: | Code function: | 13_2_004320A3 | |
Source: | Code function: | 13_2_00430120 | |
Source: | Code function: | 13_2_00430120 | |
Source: | Code function: | 13_2_0041E180 | |
Source: | Code function: | 13_2_0040E244 | |
Source: | Code function: | 13_2_004252E2 | |
Source: | Code function: | 13_2_004252E2 | |
Source: | Code function: | 13_2_004252E2 | |
Source: | Code function: | 13_2_0042C2EE | |
Source: | Code function: | 13_2_0042F2F0 | |
Source: | Code function: | 13_2_004452A0 | |
Source: | Code function: | 13_2_004452A0 | |
Source: | Code function: | 13_2_00427350 | |
Source: | Code function: | 13_2_00429370 | |
Source: | Code function: | 13_2_00429370 | |
Source: | Code function: | 13_2_004463E0 | |
Source: | Code function: | 13_2_004453F0 | |
Source: | Code function: | 13_2_004453F0 | |
Source: | Code function: | 13_2_0041E4E0 | |
Source: | Code function: | 13_2_0042B500 | |
Source: | Code function: | 13_2_0042B500 | |
Source: | Code function: | 13_2_00429500 | |
Source: | Code function: | 13_2_0042D530 | |
Source: | Code function: | 13_2_004405F0 | |
Source: | Code function: | 13_2_004455B0 | |
Source: | Code function: | 13_2_004455B0 | |
Source: | Code function: | 13_2_0041E670 | |
Source: | Code function: | 13_2_004056F0 | |
Source: | Code function: | 13_2_00440750 | |
Source: | Code function: | 13_2_00410772 | |
Source: | Code function: | 13_2_00445700 | |
Source: | Code function: | 13_2_00445700 | |
Source: | Code function: | 13_2_0042E7C2 | |
Source: | Code function: | 13_2_004207E0 | |
Source: | Code function: | 13_2_004457F0 | |
Source: | Code function: | 13_2_004457F0 | |
Source: | Code function: | 13_2_0040D8C0 | |
Source: | Code function: | 13_2_0040D8C0 | |
Source: | Code function: | 13_2_0042B8F0 | |
Source: | Code function: | 13_2_004398F0 | |
Source: | Code function: | 13_2_004108A8 | |
Source: | Code function: | 13_2_0042F900 | |
Source: | Code function: | 13_2_0042C913 | |
Source: | Code function: | 13_2_00432992 | |
Source: | Code function: | 13_2_00432992 | |
Source: | Code function: | 13_2_00421A60 | |
Source: | Code function: | 13_2_00440AA0 | |
Source: | Code function: | 13_2_00445B20 | |
Source: | Code function: | 13_2_00445B20 | |
Source: | Code function: | 13_2_0042CBDC | |
Source: | Code function: | 13_2_00406B90 | |
Source: | Code function: | 13_2_0042CC28 | |
Source: | Code function: | 13_2_00446C30 | |
Source: | Code function: | 13_2_00440CC0 | |
Source: | Code function: | 13_2_00440CC0 | |
Source: | Code function: | 13_2_0043CCC5 | |
Source: | Code function: | 13_2_0042AD00 | |
Source: | Code function: | 13_2_00445E70 | |
Source: | Code function: | 13_2_0043EE00 | |
Source: | Code function: | 13_2_0041EE2E | |
Source: | Code function: | 13_2_0041EE2E | |
Source: | Code function: | 13_2_0041EE2E | |
Source: | Code function: | 13_2_00446F00 | |
Source: | Code function: | 13_2_00446F00 |
Networking |
---|
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: |
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: |
Source: | HTTP traffic detected: |