Edit tour
Windows
Analysis Report
1st.Setup_patched.exe
Overview
General Information
| Sample name: | 1st.Setup_patched.exe |
| Analysis ID: | 1664108 |
| MD5: | 2154ece4944b0f4cba3f7d2e51b84ca3 |
| SHA1: | e0b92429b8fbca2f4ac6dbde773bd6c1aee0d720 |
| SHA256: | d469e0ee5af5bab895b2dd07f0808ce4c8bc959da5e39f3529b705e469eff268 |
| Tags: | de-pumpedexeLummaStealeruser-aachum |
| Infos: |  |
 | |
Detection
LummaC Stealer
| Score: | 100 |
| Range: | 0 - 100 |
| Confidence: | 100% |
Signatures
Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected LummaC Stealer
C2 URLs / IPs found in malware configuration
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Sample uses string decryption to hide its real strings
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
AV process strings found (often used to terminate AV products)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to create guard pages, often used to hinder reverse usering and debugging
Contains functionality to dynamically determine API calls
Contains functionality to query locales information (e.g. system language)
Contains functionality to query network adapater information
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Detected potential crypto function
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Searches for user specific document files
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Classification
- System is w10x64
1st.Setup_patched.exe (PID: 7344 cmdline: "C:\Users\ user\Deskt op\1st.Set up_patched .exe" MD5: 2154ECE4944B0F4CBA3F7D2E51B84CA3)
- cleanup
{"C2 url": ["winetersgard.digital/agbb", "jawdedmirror.run/ewqd", "changeaie.top/geps", "lonfgshadow.live/xawi", "liftally.top/xasj", "nighetwhisper.top/lekd", "salaccgfa.top/gsooz", "zestmodp.top/zeda", "owlflright.digital/qopy"], "Build id": "0c6b489a6b13a62212d66cc74988ee70017fee228bf6"}| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_LummaCStealer_3 | Yara detected LummaC Stealer | Joe Security |
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_LummaCStealer_4 | Yara detected LummaC Stealer | Joe Security |
⊘No Sigma rule has matched
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2025-04-13T17:06:28.154230+0200 | 2028371 | 3 | Unknown Traffic | 192.168.2.6 | 49691 | 104.21.13.126 | 443 | TCP |
| 2025-04-13T17:06:31.131004+0200 | 2028371 | 3 | Unknown Traffic | 192.168.2.6 | 49693 | 104.21.13.126 | 443 | TCP |
| 2025-04-13T17:06:33.577954+0200 | 2028371 | 3 | Unknown Traffic | 192.168.2.6 | 49694 | 104.21.13.126 | 443 | TCP |
| 2025-04-13T17:06:34.790472+0200 | 2028371 | 3 | Unknown Traffic | 192.168.2.6 | 49695 | 104.21.13.126 | 443 | TCP |
| 2025-04-13T17:06:38.799505+0200 | 2028371 | 3 | Unknown Traffic | 192.168.2.6 | 49696 | 104.21.13.126 | 443 | TCP |
| 2025-04-13T17:06:40.410690+0200 | 2028371 | 3 | Unknown Traffic | 192.168.2.6 | 49697 | 104.21.13.126 | 443 | TCP |
| 2025-04-13T17:06:42.814821+0200 | 2028371 | 3 | Unknown Traffic | 192.168.2.6 | 49698 | 104.21.13.126 | 443 | TCP |
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | Malware Configuration Extractor: | ||
| Source: | Virustotal: | Perma Link | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | Code function: | 0_3_0354F3B1 | |
| Source: | Code function: | 0_3_0354A19B | |
| Source: | Code function: | 0_3_0354F68D | |
| Source: | Code function: | 0_2_0047A190 | |
| Source: | Code function: | 0_2_0047A2D0 | |
| Source: | Static PE information: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
| Source: | Code function: | 0_2_0047ABB0 | |
| Source: | Code function: | 0_2_004F2D50 | |
| Source: | Code function: | 0_2_0048CDE0 | |
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Code function: | 0_3_0355FAE0 | |
| Source: | Code function: | 0_3_035808D0 | |
| Source: | Code function: | 0_3_035800B0 | |
| Source: | Code function: | 0_3_03541748 | |
| Source: | Code function: | 0_3_0357EF70 | |
| Source: | Code function: | 0_3_03574680 | |
| Source: | Code function: | 0_3_03574680 | |
| Source: | Code function: | 0_3_035505B0 | |
| Source: | Code function: | 0_3_035505B0 | |
| Source: | Code function: | 0_3_0357FCB0 | |
| Source: | Code function: | 0_3_0357FCB0 | |
| Source: | Code function: | 0_3_03540B40 | |
| Source: | Code function: | 0_3_03579BD0 | |
| Source: | Code function: | 0_3_0353F3F6 | |
| Source: | Code function: | 0_3_0355EBE0 | |
| Source: | Code function: | 0_3_0354A3A3 | |
| Source: | Code function: | 0_3_0357D250 | |
| Source: | Code function: | 0_3_03552270 | |
| Source: | Code function: | 0_3_0354AA0B | |
| Source: | Code function: | 0_3_03559230 | |
| Source: | Code function: | 0_3_0353CAC0 | |
| Source: | Code function: | 0_3_03580AC0 | |
| Source: | Code function: | 0_3_0353B2B0 | |
| Source: | Code function: | 0_3_0354BAAF | |
| Source: | Code function: | 0_3_0354D16C | |
| Source: | Code function: | 0_3_03552969 | |
| Source: | Code function: | 0_3_03575910 | |
| Source: | Code function: | 0_3_0357F850 | |
| Source: | Code function: | 0_3_0357F850 | |
| Source: | Code function: | 0_3_03553815 | |
| Source: | Code function: | 0_3_0357A810 | |
| Source: | Code function: | 0_3_03552E12 | |
| Source: | Code function: | 0_3_0353A8C0 | |
| Source: | Code function: | 0_3_03554F4C | |
| Source: | Code function: | 0_3_03554965 | |
| Source: | Code function: | 0_3_035787F0 | |
| Source: | Code function: | 0_3_03540789 | |
| Source: | Code function: | 0_3_0354AE42 | |
| Source: | Code function: | 0_3_03552E12 | |
| Source: | Code function: | 0_3_0357C620 | |
| Source: | Code function: | 0_3_03539EC0 | |
| Source: | Code function: | 0_3_03539EC0 | |
| Source: | Code function: | 0_3_0354FD50 | |
| Source: | Code function: | 0_3_03553565 | |
| Source: | Code function: | 0_3_03531DE0 | |
| Source: | Code function: | 0_3_035794F0 | |
| Source: | Code function: | 0_3_03553C80 | |
| Source: | Code function: | 0_3_03553C80 | |
| Source: | Code function: | 0_3_0354DCB8 | |
Networking | |
|---|
| Source: | URLs: | ||
| Source: | URLs: | ||
| Source: | URLs: | ||
| Source: | URLs: | ||
| Source: | URLs: | ||
| Source: | URLs: | ||
| Source: | URLs: | ||
| Source: | URLs: | ||
| Source: | URLs: | ||
| Source: | ASN Name: | ||
| Source: | JA3 fingerprint: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | Code function: | 0_2_00434050 | |
| Source: | DNS traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Code function: | 0_3_0356EBC0 | |
| Source: | Code function: | 0_3_0356EBC0 | |
| Source: | Code function: | 0_3_03080B72 | |
| Source: | Code function: | 0_3_030810E8 | |
| Source: | Code function: | 0_3_0308066E | |
| Source: | Code function: | 0_3_03080CD8 | |
| Source: | Code function: | 0_3_0353DBF0 | |
| Source: | Code function: | 0_3_03533AF0 | |
| Source: | Code function: | 0_3_0355FAE0 | |
| Source: | Code function: | 0_3_03558870 | |
| Source: | Code function: | 0_3_03541748 | |
| Source: | Code function: | 0_3_0357EF70 | |
| Source: | Code function: | 0_3_0353B720 | |
| Source: | Code function: | 0_3_035437B3 | |
| Source: | Code function: | 0_3_03574680 | |
| Source: | Code function: | 0_3_03541EB6 | |
| Source: | Code function: | 0_3_0354DEA5 | |
| Source: | Code function: | 0_3_03544D44 | |
| Source: | Code function: | 0_3_035505B0 | |
| Source: | Code function: | 0_3_03541C1A | |
| Source: | Code function: | 0_3_03578430 | |
| Source: | Code function: | 0_3_0357FCB0 | |
| Source: | Code function: | 0_3_03573B50 | |
| Source: | Code function: | 0_3_03540B40 | |
| Source: | Code function: | 0_3_03538B60 | |
| Source: | Code function: | 0_3_0354236D | |
| Source: | Code function: | 0_3_0353B300 | |
| Source: | Code function: | 0_3_03579BD0 | |
| Source: | Code function: | 0_3_0353C3E0 | |
| Source: | Code function: | 0_3_0355EBE0 | |
| Source: | Code function: | 0_3_0357D250 | |
| Source: | Code function: | 0_3_03541A7C | |
| Source: | Code function: | 0_3_0353FA00 | |
| Source: | Code function: | 0_3_03559230 | |
| Source: | Code function: | 0_3_03545A29 | |
| Source: | Code function: | 0_3_03554A28 | |
| Source: | Code function: | 0_3_0353CAC0 | |
| Source: | Code function: | 0_3_035562A0 | |
| Source: | Code function: | 0_3_03533150 | |
| Source: | Code function: | 0_3_03555170 | |
| Source: | Code function: | 0_3_0354D16C | |
| Source: | Code function: | 0_3_03552969 | |
| Source: | Code function: | 0_3_03575910 | |
| Source: | Code function: | 0_3_0357E920 | |
| Source: | Code function: | 0_3_035379D0 | |
| Source: | Code function: | 0_3_0357F850 | |
| Source: | Code function: | 0_3_03559840 | |
| Source: | Code function: | 0_3_0353C010 | |
| Source: | Code function: | 0_3_0357A810 | |
| Source: | Code function: | 0_3_0353A8C0 | |
| Source: | Code function: | 0_3_035538CD | |
| Source: | Code function: | 0_3_035390E0 | |
| Source: | Code function: | 0_3_0357C8E0 | |
| Source: | Code function: | 0_3_0354B094 | |
| Source: | Code function: | 0_3_03543F4E | |
| Source: | Code function: | 0_3_03549F05 | |
| Source: | Code function: | 0_3_03542F00 | |
| Source: | Code function: | 0_3_03552F08 | |
| Source: | Code function: | 0_3_035557CD | |
| Source: | Code function: | 0_3_035687E0 | |
| Source: | Code function: | 0_3_03531FA0 | |
| Source: | Code function: | 0_3_03545E00 | |
| Source: | Code function: | 0_3_0357C620 | |
| Source: | Code function: | 0_3_03539EC0 | |
| Source: | Code function: | 0_3_035386F0 | |
| Source: | Code function: | 0_3_0354A6B2 | |
| Source: | Code function: | 0_3_0354FEA6 | |
| Source: | Code function: | 0_3_03545500 | |
| Source: | Code function: | 0_3_0353BDE0 | |
| Source: | Code function: | 0_3_0354F599 | |
| Source: | Code function: | 0_3_0356C5A0 | |
| Source: | Code function: | 0_3_03555CD0 | |
| Source: | Code function: | 0_3_0357CCD0 | |
| Source: | Code function: | 0_3_035794F0 | |
| Source: | Code function: | 0_3_0354BCE0 | |
| Source: | Code function: | 0_3_03553C80 | |
| Source: | Code function: | 0_3_0357F4A0 | |
| Source: | Code function: | 0_2_005045BC | |
| Source: | Code function: | 0_2_00504199 | |
| Source: | Code function: | 0_2_004B4320 | |
| Source: | Code function: | 0_2_004744F0 | |
| Source: | Code function: | 0_2_004286D0 | |
| Source: | Code function: | 0_2_004C46A0 | |
| Source: | Code function: | 0_2_00508C23 | |
| Source: | Code function: | 0_2_004F4DD4 | |
| Source: | Code function: | 0_2_004D8DA0 | |
| Source: | Code function: | 0_2_004AEE40 | |
| Source: | Code function: | 0_2_0050AE9B | |
| Source: | Code function: | 0_2_00509193 | |
| Source: | Code function: | 0_2_004D9260 | |
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Static PE information: | ||
| Source: | Classification label: | ||
| Source: | Code function: | 0_3_03574680 | |
| Source: | Code function: | 0_2_00421110 | |
| Source: | Static PE information: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Virustotal: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | Static file information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Code function: | 0_2_00503016 | |
| Source: | Static PE information: | ||
| Source: | Code function: | 0_2_004F4169 | |
| Source: | Code function: | 0_2_004F88F8 | |
| Source: | Process information set: | Jump to behavior | ||
Malware Analysis System Evasion | |
|---|
| Source: | WMI Queries: | ||
| Source: | System information queried: | Jump to behavior | ||
| Source: | Code function: | 0_2_00452CA0 | |
| Source: | API coverage: | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | WMI Queries: | ||
| Source: | Code function: | 0_2_0047ABB0 | |
| Source: | Code function: | 0_2_004F2D50 | |
| Source: | Code function: | 0_2_0048CDE0 | |
| Source: | Code function: | 0_2_004F2132 | |
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Process information queried: | Jump to behavior | ||
| Source: | Code function: | 0_3_0357B240 | |
| Source: | Code function: | 0_2_004F8A95 | |
| Source: | Code function: | 0_2_00503016 | |
| Source: | Code function: | 0_2_004F2132 | |
| Source: | Code function: | 0_2_00503016 | |
| Source: | Code function: | 0_2_004EE770 | |
| Source: | Code function: | 0_2_004EE697 | |
| Source: | Code function: | 0_2_004F7282 | |
| Source: | Code function: | 0_2_00458BA0 | |
| Source: | Code function: | 0_2_004A2950 | |
| Source: | Code function: | 0_2_00506153 | |
| Source: | Code function: | 0_2_00506193 | |
| Source: | Code function: | 0_2_00506210 | |
| Source: | Code function: | 0_2_00506293 | |
| Source: | Code function: | 0_2_00506486 | |
| Source: | Code function: | 0_2_005065AE | |
| Source: | Code function: | 0_2_0050665B | |
| Source: | Code function: | 0_2_004F4650 | |
| Source: | Code function: | 0_2_005066C3 | |
| Source: | Code function: | 0_2_005050FD | |
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Code function: | 0_2_00480340 | |
| Source: | Code function: | 0_2_004A28F0 | |
| Source: | Code function: | 0_2_004F26A1 | |
| Source: | Code function: | 0_2_00476E20 | |
| Source: | Key value queried: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | WMI Queries: | ||
Stealing of Sensitive Information | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
Remote Access Functionality | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | 12 Windows Management Instrumentation | 1 DLL Side-Loading | 1 DLL Side-Loading | 21 Virtualization/Sandbox Evasion | 2 OS Credential Dumping | 2 System Time Discovery | Remote Services | 1 Archive Collected Data | 21 Encrypted Channel | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
| Credentials | Domains | Default Accounts | 2 Command and Scripting Interpreter | Boot or Logon Initialization Scripts | Boot or Logon Initialization Scripts | 1 Disable or Modify Tools | LSASS Memory | 251 Security Software Discovery | Remote Desktop Protocol | 31 Data from Local System | 1 Ingress Tool Transfer | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | 1 Native API | Logon Script (Windows) | Logon Script (Windows) | 1 Deobfuscate/Decode Files or Information | Security Account Manager | 21 Virtualization/Sandbox Evasion | SMB/Windows Admin Shares | 2 Clipboard Data | 2 Non-Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | 3 Obfuscated Files or Information | NTDS | 1 Process Discovery | Distributed Component Object Model | Input Capture | 113 Application Layer Protocol | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | Network Logon Script | 1 DLL Side-Loading | LSA Secrets | 1 Account Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
| Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | Steganography | Cached Domain Credentials | 1 System Owner/User Discovery | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
| DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | Compile After Delivery | DCSync | 1 System Network Configuration Discovery | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
| Network Trust Dependencies | Serverless | Drive-by Compromise | Container Orchestration Job | Scheduled Task/Job | Scheduled Task/Job | Indicator Removal from Tools | Proc Filesystem | 12 File and Directory Discovery | Cloud Services | Credential API Hooking | Application Layer Protocol | Exfiltration Over Alternative Protocol | Defacement |
| Network Topology | Malvertising | Exploit Public-Facing Application | Command and Scripting Interpreter | At | At | HTML Smuggling | /etc/passwd and /etc/shadow | 35 System Information Discovery | Direct Cloud VM Connections | Data Staged | Web Protocols | Exfiltration Over Symmetric Encrypted Non-C2 Protocol | Internal Defacement |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 8% | ReversingLabs | |||
| 8% | Virustotal | Browse |
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| winetersgard.digital | 104.21.13.126 | true | true | unknown |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| false | high | ||
| false | high | ||
| false | high | ||
| false | high | ||
| false | high | ||
| false | high | ||
| false | high | ||
| true |
| unknown | |
| false | high | ||
| false |
| unknown |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 104.21.13.126 | winetersgard.digital | United States | 13335 | CLOUDFLARENETUS | true |
| Joe Sandbox version: | 42.0.0 Malachite |
| Analysis ID: | 1664108 |
| Start date and time: | 2025-04-13 17:05:15 +02:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 5m 34s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 12 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | 1st.Setup_patched.exe |
| Detection: | MAL |
| Classification: | mal100.troj.spyw.evad.winEXE@1/0@2/1 |
| EGA Information: |
|
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, sppsvc.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
- Excluded IPs from analysis (whitelisted): 23.76.34.6, 172.202.163.200
- Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, c.pki.goog, fe3cr.delivery.mp.microsoft.com
- Not all processes where analyzed, report is missing behavior information
- Report size exceeded maximum capacity and may have missing disassembly code.
- Report size getting too big, too many NtOpenKeyEx calls found.
- Report size getting too big, too many NtQueryValueKey calls found.
- Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
| Time | Type | Description |
|---|---|---|
| 11:06:28 | API Interceptor |
⊘No context
⊘No context
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| CLOUDFLARENETUS | Get hash | malicious | LummaC Stealer | Browse |
| |
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| Get hash | malicious | Cobalt Strike, MSIL Logger, MassLogger RAT | Browse |
| ||
| Get hash | malicious | MSIL Logger, MassLogger RAT | Browse |
| ||
| Get hash | malicious | MSIL Logger, MassLogger RAT | Browse |
| ||
| Get hash | malicious | Cobalt Strike, MSIL Logger, MassLogger RAT | Browse |
| ||
| Get hash | malicious | Cobalt Strike, MSIL Logger, MassLogger RAT | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| a0e9f5d64349fb13191bc781f81f42e1 | Get hash | malicious | LummaC Stealer | Browse |
| |
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| Get hash | malicious | GO Backdoor, LummaC Stealer | Browse |
| ||
| Get hash | malicious | Koadic | Browse |
|
⊘No context
⊘No created / dropped files found
| File type: | |
| Entropy (8bit): | 7.049752194222297 |
| TrID: |
|
| File name: | 1st.Setup_patched.exe |
| File size: | 2'610'176 bytes |
| MD5: | 2154ece4944b0f4cba3f7d2e51b84ca3 |
| SHA1: | e0b92429b8fbca2f4ac6dbde773bd6c1aee0d720 |
| SHA256: | d469e0ee5af5bab895b2dd07f0808ce4c8bc959da5e39f3529b705e469eff268 |
| SHA512: | ae3177c46430aa1a3bf17757e1dcd266e5af3611cc8433a80c5d6f34ce27085d91f594accf75b07d899116c9a32850273669600bbb6a1a3d0f73c649242e144b |
| SSDEEP: | 49152:/jlRQE4EnWZhKTcNe5DvTP/7P8auY4rB5w8PjkMgKC+KcWWdXThsE:/T90Cp4rg81Ths |
| TLSH: | FEC58EB03BD3847DD6752970483C670DD4A86E5E5BA184CBD24C3E4D8D34AF2A93AE36 |
| File Content Preview: | MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........../...|...|...|B.C|...|B.A|...|B.@|b..|...|...|...|...|...|...|...|'..|q)]|...|q)G|...|...|...|q)B|...|Rich...|............... |
 | |
| Icon Hash: | 4570d4d4e068c6f8 |
| Entrypoint: | 0x4cea68 |
| Entrypoint Section: | .text |
| Digitally signed: | false |
| Imagebase: | 0x400000 |
| Subsystem: | windows gui |
| Image File Characteristics: | EXECUTABLE_IMAGE, 32BIT_MACHINE |
| DLL Characteristics: | DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x56B09BA2 [Tue Feb 2 12:05:54 2016 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 5 |
| OS Version Minor: | 1 |
| File Version Major: | 5 |
| File Version Minor: | 1 |
| Subsystem Version Major: | 5 |
| Subsystem Version Minor: | 1 |
| Import Hash: | 715840ee89b34b066ce8f890bc28e4eb |
| Instruction |
|---|
| call 00007FCE80B2F700h |
| jmp 00007FCE80B258D4h |
| jmp 00007FCE80B285DCh |
| cmp ecx, dword ptr [00541488h] |
| jne 00007FCE80B25A54h |
| rep ret |
| jmp 00007FCE80B28241h |
| push ebp |
| mov ebp, esp |
| mov eax, dword ptr [ebp+14h] |
| push esi |
| test eax, eax |
| je 00007FCE80B25A8Eh |
| cmp dword ptr [ebp+08h], 00000000h |
| jne 00007FCE80B25A65h |
| call 00007FCE80B29BACh |
| push 00000016h |
| pop esi |
| mov dword ptr [eax], esi |
| call 00007FCE80B2FB9Fh |
| mov eax, esi |
| jmp 00007FCE80B25A77h |
| cmp dword ptr [ebp+10h], 00000000h |
| je 00007FCE80B25A39h |
| cmp dword ptr [ebp+0Ch], eax |
| jnc 00007FCE80B25A5Bh |
| call 00007FCE80B29B8Eh |
| push 00000022h |
| jmp 00007FCE80B25A32h |
| push eax |
| push dword ptr [ebp+10h] |
| push dword ptr [ebp+08h] |
| call 00007FCE80B25C5Bh |
| add esp, 0Ch |
| xor eax, eax |
| pop esi |
| pop ebp |
| ret |
| push ebp |
| mov ebp, esp |
| push dword ptr [ebp+0Ch] |
| push 00000000h |
| push dword ptr [ebp+08h] |
| push 004D8D78h |
| call 00007FCE80B28F76h |
| add esp, 10h |
| pop ebp |
| ret |
| push ebp |
| mov ebp, esp |
| push esi |
| push dword ptr [ebp+08h] |
| mov esi, ecx |
| call 00007FCE80B25AB4h |
| mov dword ptr [esi], 00509958h |
| mov eax, esi |
| pop esi |
| pop ebp |
| retn 0004h |
| push ebp |
| mov ebp, esp |
| push esi |
| push dword ptr [ebp+08h] |
| mov esi, ecx |
| call 00007FCE80B25AB4h |
| mov dword ptr [esi], 00509958h |
| mov eax, esi |
| pop esi |
| pop ebp |
| retn 0004h |
| push ebp |
| mov ebp, esp |
| push esi |
| push dword ptr [ebp+08h] |
| mov esi, ecx |
| call 00007FCE80B25AF5h |
| Programming Language: |
|
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0x13e074 | 0x168 | .rdata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x151000 | 0xcfc61 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x221000 | 0x1209c | .reloc |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0x107a90 | 0x38 | .rdata |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x11fdc8 | 0x40 | .rdata |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x107000 | 0x63c | .rdata |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x1058f9 | 0x105a00 | 3e925f0f494fd1c5df00fc026faace3d | False | 0.42485087941949357 | data | 6.498235920117055 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .rdata | 0x107000 | 0x392c4 | 0x39400 | 18a304e3af6ba740db2329ce3cfc3ad8 | False | 0.3665819459606987 | data | 4.756575039188626 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .data | 0x141000 | 0xfe4c | 0xcc00 | 967fb368d2f6949aa4248aad8a840bdc | False | 0.1726983762254902 | data | 5.384939205602996 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .rsrc | 0x151000 | 0xcfc61 | 0xcfe00 | dcb911ab3706781efd4182ee90c39727 | False | 0.5120522963018641 | data | 7.070970923829321 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .reloc | 0x221000 | 0x61800 | 0x61800 | 3ff368f1e6dbd605730a8f855848d714 | False | 0.8038837139423077 | data | 7.479128945037122 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| GIF | 0x1543e0 | 0x1950 | GIF image data, version 89a, 156 x 156 | 1.0016975308641975 | ||
| GIF | 0x155d30 | 0x730 | GIF image data, version 89a, 48 x 48 | 1.0059782608695653 | ||
| GIF | 0x156460 | 0x3db | GIF image data, version 89a, 16 x 16 | 0.6524822695035462 | ||
| GIF | 0x15683c | 0x5a | GIF image data, version 89a, 48 x 48 | 1.0555555555555556 | ||
| GIF | 0x156898 | 0x166 | GIF image data, version 89a, 50 x 8 | 0.840782122905028 | ||
| GIF | 0x156a00 | 0x175 | GIF image data, version 89a, 50 x 8 | 0.9812332439678284 | ||
| GIF | 0x156b78 | 0x184 | GIF image data, version 89a, 50 x 8 | 1.0283505154639174 | ||
| GIF | 0x156cfc | 0x262 | GIF image data, version 89a, 50 x 8 | 0.7377049180327869 | ||
| GIF | 0x156f60 | 0x26f | GIF image data, version 89a, 50 x 8 | 0.7752808988764045 | ||
| GIF | 0x1571d0 | 0x269 | GIF image data, version 89a, 50 x 8 | 0.7682333873581848 | ||
| GIF | 0x15743c | 0x166 | GIF image data, version 89a, 50 x 8 | 0.840782122905028 | ||
| GIF | 0x1575a4 | 0x179 | GIF image data, version 89a, 50 x 8 | 0.9124668435013262 | ||
| GIF | 0x157720 | 0x17c | GIF image data, version 89a, 50 x 8 | 0.9131578947368421 | ||
| GIF | 0x15789c | 0x17b | GIF image data, version 89a, 50 x 8 | 0.9102902374670184 | ||
| GIF | 0x157a18 | 0x177 | GIF image data, version 89a, 50 x 8 | 0.912 | ||
| GIF | 0x157b90 | 0xfd | GIF image data, version 89a, 50 x 8 | 1.0434782608695652 | ||
| GIF | 0x157c90 | 0x26f | GIF image data, version 89a, 16 x 16 | 0.913322632423756 | ||
| GIF | 0x157f00 | 0x20d8 | GIF image data, version 89a, 156 x 156 | 0.9936964795432921 | ||
| GIF | 0x159fd8 | 0x2036 | GIF image data, version 89a, 156 x 156 | 0.9929662866844531 | ||
| GIF | 0x15c010 | 0x1f64 | GIF image data, version 89a, 156 x 156 | 0.9930313588850174 | ||
| GIF | 0x15df74 | 0x1f00 | GIF image data, version 89a, 156 x 156 | 0.9936995967741935 | ||
| GIF | 0x15fe74 | 0x1f36 | GIF image data, version 89a, 156 x 156 | 0.995369211514393 | ||
| GIF | 0x161dac | 0x205a | GIF image data, version 89a, 156 x 156 | 0.9937213233518474 | ||
| GIF | 0x163e08 | 0x2099 | GIF image data, version 89a, 156 x 156 | 0.9938885560215698 | ||
| GIF | 0x165ea4 | 0xb7 | GIF image data, version 89a, 16 x 16 | 1.010928961748634 | ||
| GIF | 0x165f5c | 0x242 | GIF image data, version 89a, 16 x 16 | 0.8806228373702422 | ||
| GIF | 0x1661a0 | 0x6c3 | GIF image data, version 89a, 48 x 48 | 0.6920854997111496 | ||
| GIF | 0x166864 | 0x45f | GIF image data, version 89a, 48 x 48 | 0.8793565683646113 | ||
| GIF | 0x166cc4 | 0x319 | GIF image data, version 89a, 32 x 32 | 0.9243379571248423 | ||
| GIF | 0x166fe0 | 0x539 | GIF image data, version 89a, 32 x 32 | 0.9603590127150337 | ||
| GIF | 0x16751c | 0x278 | GIF image data, version 89a, 22 x 22 | 0.935126582278481 | ||
| GIF | 0x167794 | 0x155 | GIF image data, version 89a, 26 x 22 | 0.8357771260997068 | ||
| GIF | 0x1678ec | 0xeb | GIF image data, version 89a, 26 x 22 | 1.0170212765957447 | ||
| GIF | 0x1679d8 | 0x86 | GIF image data, version 89a, 26 x 22 | 0.9104477611940298 | ||
| GIF | 0x167a60 | 0x1a6 | GIF image data, version 89a, 26 x 22 | 0.9786729857819905 | ||
| GIF | 0x167c08 | 0x17a | GIF image data, version 89a, 26 x 22 | 0.8465608465608465 | ||
| GIF | 0x167d84 | 0x98 | GIF image data, version 89a, 26 x 22 | 0.9144736842105263 | ||
| GIF | 0x167e1c | 0x537 | GIF image data, version 89a, 48 x 48 | 0.954307116104869 | ||
| GIF | 0x168354 | 0x3b57 | GIF image data, version 89a, 220 x 260 | 1.000724112961622 | ||
| GIF | 0x16beac | 0xfdb | GIF image data, version 89a, 120 x 50 | 0.9519586104951958 | ||
| GIF | 0x16ce88 | 0x208 | GIF image data, version 89a, 100 x 10 | 0.9865384615384616 | ||
| GIF | 0x16d090 | 0x1b8 | GIF image data, version 89a, 100 x 10 | 0.9931818181818182 | ||
| GIF | 0x16d248 | 0x482 | GIF image data, version 89a, 22 x 22 | 0.8708838821490468 | ||
| GIF | 0x16d6cc | 0x4da | GIF image data, version 89a, 56 x 48 | 0.8768115942028986 | ||
| GIF | 0x16dba8 | 0x297 | GIF image data, version 89a, 22 x 21 | 0.7481146304675717 | ||
| GIF | 0x16de40 | 0x2c8 | GIF image data, version 89a, 56 x 48 | 0.773876404494382 | ||
| GIF | 0x16e108 | 0x45b | GIF image data, version 89a, 22 x 21 | 0.7273542600896861 | ||
| GIF | 0x16e564 | 0x49b | GIF image data, version 89a, 56 x 48 | 0.7421543681085666 | ||
| GIF | 0x16ea00 | 0x30e | GIF image data, version 89a, 22 x 22 | 0.8925831202046036 | ||
| GIF | 0x16ed10 | 0x4e8 | GIF image data, version 89a, 56 x 48 | 0.8519108280254777 | ||
| GIF | 0x16f1f8 | 0x2b4 | GIF image data, version 89a, 20 x 21 | 0.9407514450867052 | ||
| GIF | 0x16f4ac | 0x2e1 | GIF image data, version 89a, 56 x 48 | 0.9538670284938942 | ||
| GIF | 0x16f790 | 0x466 | GIF image data, version 89a, 22 x 21 | 0.7628774422735346 | ||
| GIF | 0x16fbf8 | 0x4ba | GIF image data, version 89a, 56 x 48 | 0.7760330578512397 | ||
| GIF | 0x1700b4 | 0x49e | GIF image data, version 89a, 22 x 21 | 0.8510998307952623 | ||
| GIF | 0x170554 | 0x4ec | GIF image data, version 89a, 56 x 48 | 0.8603174603174604 | ||
| GIF | 0x170a40 | 0x68df | GIF image data, version 89a, 599 x 389 | 1.000595969754535 | ||
| GIF | 0x177320 | 0xf5e | GIF image data, version 89a, 156 x 156 | 0.9560244026436198 | ||
| PNG | 0x178280 | 0x2eac | PNG image data, 156 x 156, 8-bit/color RGBA, non-interlaced | 0.9768162035487111 | ||
| PNG | 0x17b12c | 0xefc | PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced | 0.9324817518248175 | ||
| PNG | 0x17c028 | 0x689 | PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced | 0.826658696951584 | ||
| PNG | 0x17c6b4 | 0xa4 | PNG image data, 48 x 48, 1-bit colormap, non-interlaced | 0.9390243902439024 | ||
| PNG | 0x17c758 | 0x4b5 | PNG image data, 50 x 8, 8-bit/color RGBA, non-interlaced | 0.7120331950207469 | ||
| PNG | 0x17cc10 | 0x4d7 | PNG image data, 50 x 8, 8-bit/color RGBA, non-interlaced | 0.7223567393058918 | ||
| PNG | 0x17d0e8 | 0x4f1 | PNG image data, 50 x 8, 8-bit/color RGBA, non-interlaced | 0.7256916996047431 | ||
| PNG | 0x17d5dc | 0x503 | PNG image data, 50 x 8, 8-bit/color RGBA, non-interlaced | 0.7326578332034295 | ||
| PNG | 0x17dae0 | 0x502 | PNG image data, 50 x 8, 8-bit/color RGBA, non-interlaced | 0.733229329173167 | ||
| PNG | 0x17dfe4 | 0x504 | PNG image data, 50 x 8, 8-bit/color RGBA, non-interlaced | 0.7328660436137072 | ||
| PNG | 0x17e4e8 | 0x4b5 | PNG image data, 50 x 8, 8-bit/color RGBA, non-interlaced | 0.703734439834025 | ||
| PNG | 0x17e9a0 | 0x4be | PNG image data, 50 x 8, 8-bit/color RGBA, non-interlaced | 0.7158154859967051 | ||
| PNG | 0x17ee60 | 0x4d8 | PNG image data, 50 x 8, 8-bit/color RGBA, non-interlaced | 0.7217741935483871 | ||
| PNG | 0x17f338 | 0x4dd | PNG image data, 50 x 8, 8-bit/color RGBA, non-interlaced | 0.7269076305220884 | ||
| PNG | 0x17f818 | 0x4cb | PNG image data, 50 x 8, 8-bit/color RGBA, non-interlaced | 0.7188264058679706 | ||
| PNG | 0x17fce4 | 0x4ab | PNG image data, 50 x 8, 8-bit/color RGBA, non-interlaced | 0.700418410041841 | ||
| PNG | 0x180190 | 0x665 | PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced | 0.8002443494196702 | ||
| PNG | 0x1807f8 | 0x3951 | PNG image data, 156 x 156, 8-bit/color RGBA, non-interlaced | 0.9825529884822463 | ||
| PNG | 0x18414c | 0x3910 | PNG image data, 156 x 156, 8-bit/color RGBA, non-interlaced | 0.9828176341730559 | ||
| PNG | 0x187a5c | 0x36ac | PNG image data, 156 x 156, 8-bit/color RGBA, non-interlaced | 0.9822806516147471 | ||
| PNG | 0x18b108 | 0x35da | PNG image data, 156 x 156, 8-bit/color RGBA, non-interlaced | 0.9820832728855361 | ||
| PNG | 0x18e6e4 | 0x3632 | PNG image data, 156 x 156, 8-bit/color RGBA, non-interlaced | 0.9819806832924896 | ||
| PNG | 0x191d18 | 0x38b5 | PNG image data, 156 x 156, 8-bit/color RGBA, non-interlaced | 0.982916580560722 | ||
| PNG | 0x1955d0 | 0x3932 | PNG image data, 156 x 156, 8-bit/color RGBA, non-interlaced | 0.9826526430815462 | ||
| PNG | 0x198f04 | 0x4c7 | PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced | 0.7440719542109566 | ||
| PNG | 0x1993cc | 0x57c | PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced | 0.7841880341880342 | ||
| PNG | 0x199948 | 0xafd | PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced | 0.9047280483469605 | ||
| PNG | 0x19a448 | 0x9d6 | PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced | 0.8776806989674345 | ||
| PNG | 0x19ae20 | 0x811 | PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced | 0.85181598062954 | ||
| PNG | 0x19b634 | 0x914 | PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced | 0.867039586919105 | ||
| PNG | 0x19bf48 | 0x5f7 | PNG image data, 22 x 22, 8-bit/color RGBA, non-interlaced | 0.8048461034708579 | ||
| PNG | 0x19c540 | 0x62c | PNG image data, 26 x 22, 8-bit/color RGBA, non-interlaced | 0.7917721518987342 | ||
| PNG | 0x19cb6c | 0x598 | PNG image data, 26 x 22, 8-bit/color RGBA, non-interlaced | 0.7625698324022346 | ||
| PNG | 0x19d104 | 0x4c1 | PNG image data, 26 x 22, 8-bit/color RGBA, non-interlaced | 0.7140509449465899 | ||
| PNG | 0x19d5c8 | 0x73e | PNG image data, 26 x 22, 8-bit/color RGBA, non-interlaced | 0.8295577130528586 | ||
| PNG | 0x19dd08 | 0x64e | PNG image data, 26 x 22, 8-bit/color RGBA, non-interlaced | 0.8265179677819083 | ||
| PNG | 0x19e358 | 0x45d | PNG image data, 26 x 22, 8-bit/color RGBA, non-interlaced | 0.675022381378693 | ||
| PNG | 0x19e7b8 | 0xc62 | PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced | 0.9167192429022082 | ||
| PNG | 0x19f41c | 0x9482 | PNG image data, 220 x 260, 8-bit/color RGBA, non-interlaced | 0.9936082908096165 | ||
| PNG | 0x1a88a0 | 0xbd8 | PNG image data, 120 x 50, 8-bit/color RGBA, non-interlaced | 0.9112796833773087 | ||
| PNG | 0x1a9478 | 0x47d | PNG image data, 100 x 10, 8-bit/color RGBA, non-interlaced | 0.731940818102698 | ||
| PNG | 0x1a98f8 | 0x489 | PNG image data, 100 x 10, 8-bit/color RGBA, non-interlaced | 0.7260981912144703 | ||
| PNG | 0x1a9d84 | 0xb1a | PNG image data, 6 x 6, 8-bit/color RGBA, non-interlaced | 1.0038705137227304 | ||
| PNG | 0x1aa8a0 | 0x4c6 | PNG image data, 22 x 22, 8-bit/color RGBA, non-interlaced | 1.0090016366612111 | ||
| PNG | 0x1aad68 | 0x8b8 | PNG image data, 56 x 48, 8-bit/color RGBA, non-interlaced | 0.8575268817204301 | ||
| PNG | 0x1ab620 | 0x2a5 | PNG image data, 22 x 21, 8-bit gray+alpha, non-interlaced | 1.016248153618907 | ||
| PNG | 0x1ab8c8 | 0x779 | PNG image data, 56 x 48, 8-bit/color RGBA, non-interlaced | 0.832723470987977 | ||
| PNG | 0x1ac044 | 0x415 | PNG image data, 22 x 21, 8-bit colormap, non-interlaced | 0.9732057416267943 | ||
| PNG | 0x1ac45c | 0x84b | PNG image data, 56 x 48, 8-bit/color RGBA, non-interlaced | 0.8487988695242581 | ||
| PNG | 0x1acca8 | 0x562 | PNG image data, 22 x 22, 8-bit/color RGBA, non-interlaced | 1.0079825834542815 | ||
| PNG | 0x1ad20c | 0x96b | PNG image data, 56 x 48, 8-bit/color RGBA, non-interlaced | 0.8664454583160515 | ||
| PNG | 0x1adb78 | 0x349 | PNG image data, 20 x 21, 8-bit colormap, non-interlaced | 0.990487514863258 | ||
| PNG | 0x1adec4 | 0x75b | PNG image data, 56 x 48, 8-bit/color RGBA, non-interlaced | 0.8327137546468402 | ||
| PNG | 0x1ae620 | 0x463 | PNG image data, 22 x 21, 8-bit colormap, non-interlaced | 0.9510240427426536 | ||
| PNG | 0x1aea84 | 0x7fc | PNG image data, 56 x 48, 8-bit/color RGBA, non-interlaced | 0.8449119373776908 | ||
| PNG | 0x1af280 | 0x4dd | PNG image data, 22 x 21, 8-bit colormap, non-interlaced | 0.946987951807229 | ||
| PNG | 0x1af760 | 0x8ce | PNG image data, 56 x 48, 8-bit/color RGBA, non-interlaced | 0.8553682342502218 | ||
| PNG | 0x1b0030 | 0xd622 | PNG image data, 599 x 389, 8-bit/color RGBA, non-interlaced | 0.9450180597613922 | ||
| PNG | 0x1bd654 | 0x1d31 | PNG image data, 156 x 156, 8-bit/color RGBA, non-interlaced | 0.9660109728355413 | ||
| RT_ICON | 0x1bf388 | 0x42028 | Device independent bitmap graphic, 256 x 512 x 32, image size 262144 | 0.09283368346302927 | ||
| RT_ICON | 0x2013b0 | 0x10828 | Device independent bitmap graphic, 128 x 256 x 32, image size 65536 | 0.16344788832367207 | ||
| RT_ICON | 0x211bd8 | 0x25a8 | Device independent bitmap graphic, 48 x 96 x 32, image size 9216 | 0.35269709543568467 | ||
| RT_ICON | 0x214180 | 0x10a8 | Device independent bitmap graphic, 32 x 64 x 32, image size 4096 | 0.48850844277673544 | ||
| RT_ICON | 0x215228 | 0x468 | Device independent bitmap graphic, 16 x 32 x 32, image size 1024 | 0.7606382978723404 | ||
| RT_ICON | 0x215690 | 0x468 | Device independent bitmap graphic, 16 x 32 x 32, image size 1088, resolution 2835 x 2835 px/m | 0.449468085106383 | ||
| RT_ICON | 0x215af8 | 0x468 | Device independent bitmap graphic, 16 x 32 x 32, image size 1088, resolution 2835 x 2835 px/m | 0.5567375886524822 | ||
| RT_MENU | 0x215f60 | 0xaa | data | English | United States | 0.6705882352941176 |
| RT_STRING | 0x21600c | 0x36 | data | 0.5925925925925926 | ||
| RT_STRING | 0x216044 | 0x3d2 | data | Arabic | Saudi Arabia | 0.4611451942740286 |
| RT_STRING | 0x216418 | 0x476 | data | Danish | Denmark | 0.4194395796847636 |
| RT_STRING | 0x216890 | 0x51e | data | German | Germany | 0.36793893129770994 |
| RT_STRING | 0x216db0 | 0x656 | data | English | United States | 0.3711467324290999 |
| RT_STRING | 0x217408 | 0x4f8 | data | Spanish | Spain | 0.3812893081761006 |
| RT_STRING | 0x217900 | 0x4de | data | French | France | 0.3924558587479936 |
| RT_STRING | 0x217de0 | 0x494 | data | Dutch | Netherlands | 0.40273037542662116 |
| RT_STRING | 0x218274 | 0x442 | data | Norwegian | Norway | 0.4073394495412844 |
| RT_STRING | 0x2186b8 | 0x46e | data | English | Great Britain | 0.4012345679012346 |
| RT_STRING | 0x218b28 | 0x1dc | data | Arabic | Saudi Arabia | 0.5441176470588235 |
| RT_STRING | 0x218d04 | 0x224 | data | Danish | Denmark | 0.5164233576642335 |
| RT_STRING | 0x218f28 | 0x2b0 | data | German | Germany | 0.45348837209302323 |
| RT_STRING | 0x2191d8 | 0x254 | data | English | United States | 0.4446308724832215 |
| RT_STRING | 0x21942c | 0x274 | data | Spanish | Spain | 0.4585987261146497 |
| RT_STRING | 0x2196a0 | 0x26e | data | French | France | 0.47106109324758844 |
| RT_STRING | 0x219910 | 0x232 | data | Dutch | Netherlands | 0.47686832740213525 |
| RT_STRING | 0x219b44 | 0x20c | data | Norwegian | Norway | 0.5057251908396947 |
| RT_STRING | 0x219d50 | 0x220 | data | English | Great Britain | 0.4742647058823529 |
| RT_STRING | 0x219f70 | 0x54 | data | Arabic | Saudi Arabia | 0.6666666666666666 |
| RT_STRING | 0x219fc4 | 0x5a | data | Danish | Denmark | 0.5555555555555556 |
| RT_STRING | 0x21a020 | 0x62 | data | German | Germany | 0.5714285714285714 |
| RT_STRING | 0x21a084 | 0x5a | data | English | United States | 0.6111111111111112 |
| RT_STRING | 0x21a0e0 | 0x5a | data | Spanish | Spain | 0.6 |
| RT_STRING | 0x21a13c | 0x62 | data | French | France | 0.5408163265306123 |
| RT_STRING | 0x21a1a0 | 0x58 | data | Dutch | Netherlands | 0.5909090909090909 |
| RT_STRING | 0x21a1f8 | 0x5e | data | Norwegian | Norway | 0.5957446808510638 |
| RT_STRING | 0x21a258 | 0x5a | data | English | Great Britain | 0.6111111111111112 |
| RT_STRING | 0x21a2b4 | 0x4c | data | Arabic | Saudi Arabia | 0.6842105263157895 |
| RT_STRING | 0x21a300 | 0x62 | data | Danish | Denmark | 0.5714285714285714 |
| RT_STRING | 0x21a364 | 0x6c | data | German | Germany | 0.5925925925925926 |
| RT_STRING | 0x21a3d0 | 0x5e | data | English | United States | 0.6276595744680851 |
| RT_STRING | 0x21a430 | 0x62 | data | Spanish | Spain | 0.5816326530612245 |
| RT_STRING | 0x21a494 | 0x62 | data | French | France | 0.5816326530612245 |
| RT_STRING | 0x21a4f8 | 0x68 | data | Dutch | Netherlands | 0.5384615384615384 |
| RT_STRING | 0x21a560 | 0x66 | data | Norwegian | Norway | 0.5588235294117647 |
| RT_STRING | 0x21a5c8 | 0x5e | data | English | Great Britain | 0.6276595744680851 |
| RT_STRING | 0x21a628 | 0x336 | Matlab v4 mat-file (little endian) *\006E\006 , numeric, rows 0, columns 0 | Arabic | Saudi Arabia | 0.36009732360097324 |
| RT_STRING | 0x21a960 | 0x38c | Matlab v4 mat-file (little endian) e, numeric, rows 0, columns 0 | Danish | Denmark | 0.35462555066079293 |
| RT_STRING | 0x21acec | 0x47a | Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0 | German | Germany | 0.3586387434554974 |
| RT_STRING | 0x21b168 | 0x3b6 | Matlab v4 mat-file (little endian) l, numeric, rows 0, columns 0 | English | United States | 0.3547368421052632 |
| RT_STRING | 0x21b520 | 0x3ce | Matlab v4 mat-file (little endian) e, numeric, rows 0, columns 0 | Spanish | Spain | 0.3531827515400411 |
| RT_STRING | 0x21b8f0 | 0x3e6 | Matlab v4 mat-file (little endian) \351, numeric, rows 0, columns 0 | French | France | 0.3697394789579158 |
| RT_STRING | 0x21bcd8 | 0x3b2 | Matlab v4 mat-file (little endian) o, numeric, rows 0, columns 0 | Dutch | Netherlands | 0.35306553911205074 |
| RT_STRING | 0x21c08c | 0x34a | Matlab v4 mat-file (little endian) o, numeric, rows 0, columns 0 | Norwegian | Norway | 0.34085510688836107 |
| RT_STRING | 0x21c3d8 | 0x392 | Matlab v4 mat-file (little endian) e, numeric, rows 0, columns 0 | English | Great Britain | 0.34573304157549234 |
| RT_STRING | 0x21c76c | 0x1f4 | data | Arabic | Saudi Arabia | 0.456 |
| RT_STRING | 0x21c960 | 0x2d2 | data | Danish | Denmark | 0.3684210526315789 |
| RT_STRING | 0x21cc34 | 0x2de | data | German | Germany | 0.35149863760217986 |
| RT_STRING | 0x21cf14 | 0x328 | data | Spanish | Spain | 0.33044554455445546 |
| RT_STRING | 0x21d23c | 0x33a | data | French | France | 0.32566585956416466 |
| RT_STRING | 0x21d578 | 0x31a | data | Dutch | Netherlands | 0.3060453400503778 |
| RT_STRING | 0x21d894 | 0x2dc | data | Norwegian | Norway | 0.3360655737704918 |
| RT_STRING | 0x21db70 | 0x2b4 | data | English | Great Britain | 0.3554913294797688 |
| RT_STRING | 0x21de24 | 0x24a | data | Arabic | Saudi Arabia | 0.44880546075085326 |
| RT_STRING | 0x21e070 | 0x310 | data | Danish | Denmark | 0.3711734693877551 |
| RT_STRING | 0x21e380 | 0x38e | data | German | Germany | 0.34945054945054943 |
| RT_STRING | 0x21e710 | 0x388 | data | Spanish | Spain | 0.33517699115044247 |
| RT_STRING | 0x21ea98 | 0x39a | data | French | France | 0.35032537960954446 |
| RT_STRING | 0x21ee34 | 0x3b8 | data | Dutch | Netherlands | 0.3077731092436975 |
| RT_STRING | 0x21f1ec | 0x34c | data | Norwegian | Norway | 0.3234597156398104 |
| RT_STRING | 0x21f538 | 0x2e4 | data | English | Great Britain | 0.35945945945945945 |
| RT_GROUP_ICON | 0x21f81c | 0x4c | data | 0.7894736842105263 | ||
| RT_GROUP_ICON | 0x21f868 | 0x14 | data | 1.25 | ||
| RT_GROUP_ICON | 0x21f87c | 0x14 | data | 1.25 | ||
| RT_VERSION | 0x21f890 | 0x2dc | data | 0.46311475409836067 | ||
| RT_HTML | 0x21fb6c | 0x744 | HTML document, ASCII text | 0.432258064516129 | ||
| RT_HTML | 0x2202b0 | 0x412 | HTML document, ASCII text, with CRLF, LF line terminators | 0.5854126679462572 | ||
| RT_MANIFEST | 0x2206c4 | 0x59d | XML 1.0 document, ASCII text, with CRLF line terminators | English | Great Britain | 0.430062630480167 |
| DLL | Import |
|---|---|
| KERNEL32.dll | GetCurrentDirectoryW, GetLocalTime, GetCurrentProcessId, CreateDirectoryW, CreateProcessW, DeleteFileW, GetComputerNameW, GetVersionExW, GetModuleHandleExW, GetModuleFileNameW, SetThreadPriority, FindFirstFileW, FindClose, FindNextFileW, FreeLibrary, EndUpdateResourceW, LoadLibraryW, BeginUpdateResourceW, UpdateResourceW, GlobalFree, MoveFileExW, WriteFile, ReadFile, CopyFileW, GetFileAttributesW, GetFileSizeEx, MoveFileW, GetFileType, RemoveDirectoryW, DuplicateHandle, VirtualQuery, OpenProcess, GetExitCodeProcess, SetEndOfFile, SetFilePointerEx, FormatMessageW, GetDriveTypeW, LCMapStringW, HeapAlloc, HeapFree, GetProcessHeap, SetLastError, GetTempFileNameW, GetTempPathW, ExpandEnvironmentStringsW, ResumeThread, FlushInstructionCache, RaiseException, GlobalLock, GlobalAlloc, MulDiv, lstrcmpW, GlobalUnlock, ExpandEnvironmentStringsA, LoadLibraryA, SleepEx, WaitForSingleObjectEx, WaitNamedPipeW, ReadFileEx, CancelIo, WriteFileEx, GetStringTypeW, GetFileInformationByHandle, DecodePointer, HeapDestroy, HeapReAlloc, HeapSize, InterlockedCompareExchange, InitializeSListHead, InterlockedPopEntrySList, InterlockedPushEntrySList, IsProcessorFeaturePresent, VirtualAlloc, VirtualFree, GetCommandLineW, IsDebuggerPresent, GetLogicalDrives, GetSystemInfo, VirtualProtect, GetTimeZoneInformation, FileTimeToLocalFileTime, FindFirstFileExW, FileTimeToSystemTime, CreateThread, ExitThread, LoadLibraryExW, ExitProcess, RtlUnwind, GetCPInfo, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetDateFormatW, GetTimeFormatW, CompareStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetStdHandle, QueryPerformanceCounter, GetEnvironmentStringsW, FreeEnvironmentStringsW, IsValidCodePage, GetACP, GetOEMCP, PeekNamedPipe, GetFullPathNameW, OutputDebugStringW, GetConsoleCP, GetConsoleMode, SetStdHandle, ReadConsoleW, WriteConsoleW, SetEnvironmentVariableA, FlushFileBuffers, GetThreadTimes, GetSystemTimeAsFileTime, GetCurrentThread, GetCurrentProcess, GetProcessIoCounters, WideCharToMultiByte, WaitForSingleObject, EncodePointer, CreateFileW, CloseHandle, GetCurrentThreadId, WaitForMultipleObjects, CreateEventW, EnterCriticalSection, GetProcAddress, LeaveCriticalSection, Sleep, GetModuleHandleW, SetEvent, DeleteCriticalSection, LockResource, GetLastError, MultiByteToWideChar, SizeofResource, InitializeCriticalSectionAndSpinCount, InterlockedDecrement, InterlockedIncrement, LoadResource, FindResourceW, LocalFree, FindResourceExW |
| USER32.dll | GetMessageW, TranslateMessage, PostThreadMessageW, DispatchMessageW, SetForegroundWindow, KillTimer, PostMessageW, RegisterWindowMessageW, PostQuitMessage, SetTimer, LoadCursorW, GetParent, DialogBoxParamW, GetWindowRect, DestroyWindow, MoveWindow, UnregisterClassW, EndPaint, ClientToScreen, GetWindowTextLengthW, DestroyAcceleratorTable, BringWindowToTop, CharNextW, IsChild, SetCapture, GetKeyState, InvalidateRgn, CreateAcceleratorTableW, BeginPaint, InvalidateRect, ReleaseDC, GetDlgItem, RedrawWindow, GetSysColor, GetWindow, SendMessageW, GetWindowInfo, EnumWindows, GetWindowTextW, GetClassNameW, GetWindowThreadProcessId, FillRect, DrawIconEx, GetDC, LoadIconW, DestroyIcon, GetFocus, IsWindowEnabled, SetFocus, IsWindow, MessageBoxW, EnableWindow, ShowWindow, GetMonitorInfoW, UpdateWindow, MapWindowPoints, GetActiveWindow, CreateWindowExW, SetWindowPos, GetDesktopWindow, SendDlgItemMessageW, EndDialog, SetWindowLongW, MonitorFromWindow, GetWindowLongW, RegisterClassExW, ScreenToClient, GetClassInfoExW, ReleaseCapture, SetWindowTextW, CallWindowProcW, DefWindowProcW, GetClientRect |
| OLEAUT32.dll | VariantInit, VariantClear, SysFreeString, VariantCopy, SysAllocString, SafeArrayLock, SafeArrayCopy, LoadRegTypeLib, OleCreateFontIndirect, SafeArrayGetVartype, DispCallFunc, SafeArrayCreate, SafeArrayUnlock, LoadTypeLib, SysStringByteLen, SysAllocStringByteLen, VariantChangeType, VarI4FromStr, SysStringLen, SafeArrayGetUBound, SafeArrayGetElement, SafeArrayDestroy, SafeArrayGetLBound, SysAllocStringLen |
| WININET.dll | InternetCloseHandle, InternetErrorDlg, HttpOpenRequestW, HttpQueryInfoW, HttpSendRequestW, InternetConnectW, InternetReadFile, InternetQueryOptionW, InternetOpenW, InternetSetOptionW |
| WINHTTP.dll | WinHttpGetProxyForUrl, WinHttpCloseHandle |
| VERSION.dll | VerQueryValueW, GetFileVersionInfoW |
| NETAPI32.dll | NetGetJoinInformation, NetApiBufferFree, NetWkstaGetInfo |
| PSAPI.DLL | EnumProcesses, GetModuleFileNameExW, EnumProcessModules, GetModuleBaseNameW |
| Secur32.dll | GetUserNameExW, GetComputerObjectNameW |
| SHLWAPI.dll | StrStrW, StrStrIW |
| IPHLPAPI.DLL | GetAdaptersInfo |
| GDI32.dll | RemoveFontResourceExW, AddFontResourceExW, BitBlt, GetDeviceCaps, DeleteDC, GetDIBits, DeleteObject, SelectObject, CreateCompatibleDC, CreateCompatibleBitmap, RealizePalette, SelectPalette, GetObjectW, CreateSolidBrush, GetStockObject |
| SHELL32.dll | SHGetMalloc, SHGetFileInfoW, SHBrowseForFolderW, ShellExecuteExW, SHGetPathFromIDListW, SHGetFolderPathW |
| ole32.dll | StringFromCLSID, CoTaskMemAlloc, CoGetClassObject, CoTaskMemFree, OleUninitialize, OleInitialize, StringFromGUID2, CreateStreamOnHGlobal, CLSIDFromString, OleLockRunning, CoInitializeSecurity, CoCreateInstance, CoInitializeEx, CoCreateInstanceEx, CLSIDFromProgID, CoUninitialize, CoAddRefServerProcess, CoReleaseServerProcess, CoCreateGuid |
| COMDLG32.dll | CommDlgExtendedError, GetSaveFileNameW |
| ADVAPI32.dll | CloseServiceHandle, GetSidLengthRequired, IsValidSid, GetSecurityDescriptorOwner, InitializeAcl, MakeAbsoluteSD, GetSecurityDescriptorLength, SetSecurityDescriptorDacl, InitializeSecurityDescriptor, AddAce, GetSecurityDescriptorSacl, MakeSelfRelativeSD, GetLengthSid, GetSecurityDescriptorGroup, GetSecurityDescriptorDacl, CryptAcquireContextW, RegCloseKey, RegConnectRegistryW, GetSidSubAuthority, GetAclInformation, CopySid, GetSecurityDescriptorControl, CryptReleaseContext, CryptGetHashParam, CryptCreateHash, CryptDestroyHash, CryptHashData, RegOpenKeyExA, RegQueryValueExA, GetNamedSecurityInfoW, LookupAccountSidW, GetAce, EqualSid, QueryServiceConfigW, ControlService, ChangeServiceConfigW, QueryServiceStatus, StartServiceW, OpenServiceW, OpenSCManagerW, DeleteService, InitializeSid, ConvertSidToStringSidW, CheckTokenMembership, FreeSid, SetSecurityDescriptorOwner, AllocateAndInitializeSid, GetSecurityInfo, SetNamedSecurityInfoW, GetTokenInformation, SetSecurityDescriptorGroup, GetUserNameW, OpenProcessToken, RegSetValueExW, RegEnumKeyExW, RegOpenKeyExW, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegQueryInfoKeyW, RegQueryValueExW, RegCreateKeyExW |
| CRYPT32.dll | CryptUnprotectData, CryptProtectData |
| Description | Data |
|---|---|
| CompanyName | Secunia |
| FileDescription | Secunia PSI |
| FileVersion | 3.0.0.11005 |
| InternalName | PSI.exe |
| LegalCopyright | (c) 2007-2015 Secunia. All rights reserved. |
| OriginalFilename | PSI.exe |
| ProductName | Secunia PSI |
| ProductVersion | 3.0.0.11005 |
| Translation | 0x0409 0x04e4 |
| Language of compilation system | Country where language is spoken | Map |
|---|---|---|
| English | United States |  |
| Arabic | Saudi Arabia |  |
| Danish | Denmark |  |
| German | Germany |  |
| Spanish | Spain |  |
| French | France |  |
| Dutch | Netherlands |  |
| Norwegian | Norway |  |
| English | Great Britain |  |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | SID | Signature | Severity | Source IP | Source Port | Dest IP | Dest Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2025-04-13T17:06:28.154230+0200 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.6 | 49691 | 104.21.13.126 | 443 | TCP |
| 2025-04-13T17:06:31.131004+0200 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.6 | 49693 | 104.21.13.126 | 443 | TCP |
| 2025-04-13T17:06:33.577954+0200 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.6 | 49694 | 104.21.13.126 | 443 | TCP |
| 2025-04-13T17:06:34.790472+0200 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.6 | 49695 | 104.21.13.126 | 443 | TCP |
| 2025-04-13T17:06:38.799505+0200 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.6 | 49696 | 104.21.13.126 | 443 | TCP |
| 2025-04-13T17:06:40.410690+0200 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.6 | 49697 | 104.21.13.126 | 443 | TCP |
| 2025-04-13T17:06:42.814821+0200 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.6 | 49698 | 104.21.13.126 | 443 | TCP |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Apr 13, 2025 17:06:27.897552967 CEST | 49691 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:27.897663116 CEST | 443 | 49691 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:27.897770882 CEST | 49691 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:27.904922009 CEST | 49691 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:27.904958010 CEST | 443 | 49691 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:28.154118061 CEST | 443 | 49691 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:28.154230118 CEST | 49691 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:28.156440973 CEST | 49691 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:28.156470060 CEST | 443 | 49691 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:28.156900883 CEST | 443 | 49691 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:28.211086035 CEST | 49691 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:28.602648973 CEST | 49691 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:28.602710962 CEST | 49691 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:28.603115082 CEST | 443 | 49691 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:29.188993931 CEST | 443 | 49691 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:29.189122915 CEST | 443 | 49691 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:29.189192057 CEST | 49691 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:29.189254045 CEST | 443 | 49691 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:29.189361095 CEST | 443 | 49691 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:29.189440012 CEST | 49691 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:29.189455032 CEST | 443 | 49691 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:29.189580917 CEST | 443 | 49691 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:29.189634085 CEST | 49691 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:29.189646006 CEST | 443 | 49691 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:29.189737082 CEST | 443 | 49691 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:29.189795971 CEST | 49691 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:29.189809084 CEST | 443 | 49691 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:29.190924883 CEST | 443 | 49691 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:29.190993071 CEST | 49691 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:29.191004992 CEST | 443 | 49691 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:29.191082954 CEST | 443 | 49691 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:29.191133022 CEST | 49691 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:29.191145897 CEST | 443 | 49691 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:29.242331982 CEST | 49691 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:29.336337090 CEST | 443 | 49691 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:29.336536884 CEST | 443 | 49691 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:29.336649895 CEST | 443 | 49691 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:29.336709976 CEST | 49691 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:29.336741924 CEST | 443 | 49691 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:29.336795092 CEST | 49691 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:29.336810112 CEST | 443 | 49691 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:29.336908102 CEST | 443 | 49691 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:29.336963892 CEST | 49691 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:29.336976051 CEST | 443 | 49691 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:29.337085962 CEST | 443 | 49691 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:29.337142944 CEST | 49691 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:29.337155104 CEST | 443 | 49691 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:29.337368011 CEST | 443 | 49691 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:29.337440968 CEST | 443 | 49691 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:29.337447882 CEST | 49691 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:29.337469101 CEST | 443 | 49691 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:29.337563038 CEST | 49691 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:29.337621927 CEST | 443 | 49691 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:29.337783098 CEST | 443 | 49691 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:29.337852955 CEST | 49691 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:29.337866068 CEST | 443 | 49691 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:29.338021994 CEST | 443 | 49691 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:29.338074923 CEST | 49691 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:29.338085890 CEST | 443 | 49691 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:29.338190079 CEST | 443 | 49691 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:29.338365078 CEST | 49691 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:29.342622995 CEST | 49691 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:29.342662096 CEST | 443 | 49691 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:29.342694044 CEST | 49691 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:29.342709064 CEST | 443 | 49691 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:30.891140938 CEST | 49693 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:30.891244888 CEST | 443 | 49693 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:30.891355038 CEST | 49693 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:30.891844988 CEST | 49693 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:30.891884089 CEST | 443 | 49693 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:31.130920887 CEST | 443 | 49693 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:31.131004095 CEST | 49693 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:31.132327080 CEST | 49693 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:31.132345915 CEST | 443 | 49693 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:31.132678986 CEST | 443 | 49693 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:31.134263992 CEST | 49693 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:31.134474039 CEST | 49693 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:31.134516954 CEST | 443 | 49693 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:31.134612083 CEST | 49693 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:31.134624958 CEST | 443 | 49693 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:32.945535898 CEST | 443 | 49693 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:32.953763008 CEST | 49693 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:33.347204924 CEST | 49694 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:33.347250938 CEST | 443 | 49694 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:33.347315073 CEST | 49694 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:33.347767115 CEST | 49694 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:33.347784042 CEST | 443 | 49694 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:33.577676058 CEST | 443 | 49694 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:33.577954054 CEST | 49694 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:33.579056025 CEST | 49694 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:33.579062939 CEST | 443 | 49694 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:33.579461098 CEST | 443 | 49694 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:33.580599070 CEST | 49694 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:33.580599070 CEST | 49694 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:33.580641985 CEST | 443 | 49694 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:33.584319115 CEST | 49694 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:33.628264904 CEST | 443 | 49694 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:34.282535076 CEST | 443 | 49694 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:34.282769918 CEST | 49694 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:34.542776108 CEST | 49695 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:34.542876959 CEST | 443 | 49695 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:34.542998075 CEST | 49695 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:34.543494940 CEST | 49695 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:34.543534040 CEST | 443 | 49695 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:34.790249109 CEST | 443 | 49695 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:34.790472031 CEST | 49695 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:34.792126894 CEST | 49695 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:34.792155027 CEST | 443 | 49695 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:34.792614937 CEST | 443 | 49695 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:34.794213057 CEST | 49695 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:34.794388056 CEST | 49695 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:34.794437885 CEST | 443 | 49695 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:34.794539928 CEST | 49695 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:34.794554949 CEST | 443 | 49695 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:35.533736944 CEST | 443 | 49695 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:35.534296989 CEST | 49695 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:38.569349051 CEST | 49696 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:38.569406033 CEST | 443 | 49696 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:38.569488049 CEST | 49696 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:38.569819927 CEST | 49696 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:38.569833040 CEST | 443 | 49696 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:38.799266100 CEST | 443 | 49696 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:38.799504995 CEST | 49696 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:38.827131987 CEST | 49696 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:38.827184916 CEST | 443 | 49696 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:38.828187943 CEST | 443 | 49696 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:38.829523087 CEST | 49696 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:38.829603910 CEST | 49696 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:38.829724073 CEST | 443 | 49696 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:39.413119078 CEST | 443 | 49696 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:39.413364887 CEST | 443 | 49696 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:39.413485050 CEST | 49696 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:39.431927919 CEST | 49696 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:39.431941986 CEST | 443 | 49696 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:40.169612885 CEST | 49697 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:40.169706106 CEST | 443 | 49697 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:40.170100927 CEST | 49697 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:40.170598984 CEST | 49697 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:40.170636892 CEST | 443 | 49697 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:40.410406113 CEST | 443 | 49697 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:40.410690069 CEST | 49697 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:40.412682056 CEST | 49697 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:40.412714005 CEST | 443 | 49697 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:40.413049936 CEST | 443 | 49697 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:40.431665897 CEST | 49697 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:40.432686090 CEST | 49697 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:40.432753086 CEST | 443 | 49697 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:40.432893991 CEST | 49697 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:40.432956934 CEST | 443 | 49697 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:40.433130980 CEST | 49697 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:40.433315992 CEST | 443 | 49697 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:40.433505058 CEST | 49697 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:40.433538914 CEST | 443 | 49697 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:40.433763027 CEST | 49697 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:40.433820963 CEST | 443 | 49697 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:40.434062958 CEST | 49697 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:40.434101105 CEST | 443 | 49697 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:40.434120893 CEST | 49697 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:40.434164047 CEST | 443 | 49697 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:40.434324026 CEST | 49697 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:40.434401989 CEST | 49697 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:40.476346016 CEST | 443 | 49697 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:40.476571083 CEST | 49697 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:40.476656914 CEST | 49697 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:40.476696968 CEST | 49697 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:40.524267912 CEST | 443 | 49697 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:40.524499893 CEST | 49697 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:40.524595976 CEST | 49697 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:40.524646044 CEST | 49697 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:40.568293095 CEST | 443 | 49697 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:40.568404913 CEST | 49697 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:40.612296104 CEST | 443 | 49697 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:40.773197889 CEST | 443 | 49697 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:42.080986977 CEST | 443 | 49697 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:42.081290007 CEST | 443 | 49697 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:42.081463099 CEST | 49697 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:42.115381002 CEST | 49697 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:42.115427017 CEST | 443 | 49697 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:42.536765099 CEST | 49698 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:42.536868095 CEST | 443 | 49698 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:42.536958933 CEST | 49698 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:42.573604107 CEST | 49698 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:42.573683977 CEST | 443 | 49698 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:42.814719915 CEST | 443 | 49698 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:42.814821005 CEST | 49698 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:42.839704037 CEST | 49698 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:42.839747906 CEST | 443 | 49698 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:42.840643883 CEST | 443 | 49698 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:42.845038891 CEST | 49698 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:42.845038891 CEST | 49698 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:42.845244884 CEST | 443 | 49698 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:43.315432072 CEST | 443 | 49698 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:43.315610886 CEST | 443 | 49698 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:43.315710068 CEST | 49698 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:43.315876007 CEST | 49698 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:43.315924883 CEST | 443 | 49698 | 104.21.13.126 | 192.168.2.6 |
| Apr 13, 2025 17:06:43.315959930 CEST | 49698 | 443 | 192.168.2.6 | 104.21.13.126 |
| Apr 13, 2025 17:06:43.315978050 CEST | 443 | 49698 | 104.21.13.126 | 192.168.2.6 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Apr 13, 2025 17:06:27.717521906 CEST | 51578 | 53 | 192.168.2.6 | 1.1.1.1 |
| Apr 13, 2025 17:06:27.859970093 CEST | 53 | 51578 | 1.1.1.1 | 192.168.2.6 |
| Apr 13, 2025 17:06:40.477786064 CEST | 58494 | 53 | 192.168.2.6 | 1.1.1.1 |
| Apr 13, 2025 17:06:40.675299883 CEST | 53 | 58494 | 1.1.1.1 | 192.168.2.6 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Apr 13, 2025 17:06:27.717521906 CEST | 192.168.2.6 | 1.1.1.1 | 0xc661 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Apr 13, 2025 17:06:40.477786064 CEST | 192.168.2.6 | 1.1.1.1 | 0x797b | Standard query (0) | A (IP address) | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Apr 13, 2025 17:06:27.859970093 CEST | 1.1.1.1 | 192.168.2.6 | 0xc661 | No error (0) | 104.21.13.126 | A (IP address) | IN (0x0001) | false | ||
| Apr 13, 2025 17:06:27.859970093 CEST | 1.1.1.1 | 192.168.2.6 | 0xc661 | No error (0) | 172.67.132.210 | A (IP address) | IN (0x0001) | false | ||
| Apr 13, 2025 17:06:40.675299883 CEST | 1.1.1.1 | 192.168.2.6 | 0x797b | No error (0) | 104.21.13.126 | A (IP address) | IN (0x0001) | false | ||
| Apr 13, 2025 17:06:40.675299883 CEST | 1.1.1.1 | 192.168.2.6 | 0x797b | No error (0) | 172.67.132.210 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.6 | 49691 | 104.21.13.126 | 443 | 7344 | C:\Users\user\Desktop\1st.Setup_patched.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-04-13 15:06:28 UTC | 269 | OUT | |
| 2025-04-13 15:06:28 UTC | 53 | OUT | |
| 2025-04-13 15:06:29 UTC | 805 | IN | |
| 2025-04-13 15:06:29 UTC | 564 | IN | |
| 2025-04-13 15:06:29 UTC | 1369 | IN | |
| 2025-04-13 15:06:29 UTC | 1369 | IN | |
| 2025-04-13 15:06:29 UTC | 1369 | IN | |
| 2025-04-13 15:06:29 UTC | 1369 | IN | |
| 2025-04-13 15:06:29 UTC | 1369 | IN | |
| 2025-04-13 15:06:29 UTC | 1369 | IN | |
| 2025-04-13 15:06:29 UTC | 1369 | IN | |
| 2025-04-13 15:06:29 UTC | 772 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.6 | 49693 | 104.21.13.126 | 443 | 7344 | C:\Users\user\Desktop\1st.Setup_patched.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-04-13 15:06:31 UTC | 286 | OUT | |
| 2025-04-13 15:06:31 UTC | 14916 | OUT | |
| 2025-04-13 15:06:32 UTC | 823 | IN | |
| 2025-04-13 15:06:32 UTC | 76 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 2 | 192.168.2.6 | 49694 | 104.21.13.126 | 443 | 7344 | C:\Users\user\Desktop\1st.Setup_patched.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-04-13 15:06:33 UTC | 283 | OUT | |
| 2025-04-13 15:06:33 UTC | 15082 | OUT | |
| 2025-04-13 15:06:34 UTC | 818 | IN | |
| 2025-04-13 15:06:34 UTC | 76 | IN | |
| 2025-04-13 15:06:34 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 3 | 192.168.2.6 | 49695 | 104.21.13.126 | 443 | 7344 | C:\Users\user\Desktop\1st.Setup_patched.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-04-13 15:06:34 UTC | 282 | OUT | |
| 2025-04-13 15:06:34 UTC | 15331 | OUT | |
| 2025-04-13 15:06:34 UTC | 4603 | OUT | |
| 2025-04-13 15:06:35 UTC | 820 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 4 | 192.168.2.6 | 49696 | 104.21.13.126 | 443 | 7344 | C:\Users\user\Desktop\1st.Setup_patched.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-04-13 15:06:38 UTC | 284 | OUT | |
| 2025-04-13 15:06:38 UTC | 2649 | OUT | |
| 2025-04-13 15:06:39 UTC | 824 | IN | |
| 2025-04-13 15:06:39 UTC | 76 | IN | |
| 2025-04-13 15:06:39 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 5 | 192.168.2.6 | 49697 | 104.21.13.126 | 443 | 7344 | C:\Users\user\Desktop\1st.Setup_patched.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-04-13 15:06:40 UTC | 285 | OUT | |
| 2025-04-13 15:06:40 UTC | 15331 | OUT | |
| 2025-04-13 15:06:40 UTC | 15331 | OUT | |
| 2025-04-13 15:06:40 UTC | 15331 | OUT | |
| 2025-04-13 15:06:40 UTC | 15331 | OUT | |
| 2025-04-13 15:06:40 UTC | 15331 | OUT | |
| 2025-04-13 15:06:40 UTC | 15331 | OUT | |
| 2025-04-13 15:06:40 UTC | 15331 | OUT | |
| 2025-04-13 15:06:40 UTC | 15331 | OUT | |
| 2025-04-13 15:06:40 UTC | 15331 | OUT | |
| 2025-04-13 15:06:40 UTC | 15331 | OUT | |
| 2025-04-13 15:06:42 UTC | 826 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 6 | 192.168.2.6 | 49698 | 104.21.13.126 | 443 | 7344 | C:\Users\user\Desktop\1st.Setup_patched.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-04-13 15:06:42 UTC | 269 | OUT | |
| 2025-04-13 15:06:42 UTC | 91 | OUT | |
| 2025-04-13 15:06:43 UTC | 795 | IN | |
| 2025-04-13 15:06:43 UTC | 43 | IN |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
| Target ID: | 0 |
| Start time: | 11:06:09 |
| Start date: | 13/04/2025 |
| Path: | C:\Users\user\Desktop\1st.Setup_patched.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x420000 |
| File size: | 2'610'176 bytes |
| MD5 hash: | 2154ECE4944B0F4CBA3F7D2E51B84CA3 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Reputation: | low |
| Has exited: | true |