Automated Malware Analysis Report for IMG-FILE

ID: 69994Sample Name: IMG-FILE-093298393840933-09208438039039-023outputA4DB4EF.exeCookbook: default.jbsTime: 16:53:00Date: 28/07/2018Version: 23.0.0

24444556666666777778888

8

99

9999

1010

101010101010

1111111112

12131314141414

14141515

Table of Contents

Table of ContentsAnalysis Report

OverviewGeneral InformationDetectionConfidenceClassificationAnalysis AdviceSignature Overview

AV Detection:Spreading:Networking:Key, Mouse, Clipboard, Microphone and Screen Capturing:Spam, unwanted Advertisements and Ransom Demands:System Summary:Data Obfuscation:Boot Survival:Hooking and other Techniques for Hiding and Protection:Malware Analysis System Evasion:Anti Debugging:HIPS / PFW / Operating System Protection Evasion:Language, Device and Operating System Detection:Remote Access Functionality:

Behavior Graph

SimulationsBehavior and APIs

Antivirus DetectionInitial SampleDropped FilesUnpacked PE FilesDomainsURLs

Yara OverviewInitial SamplePCAP (Network Traffic)Dropped FilesMemory DumpsUnpacked PEs

Joe Sandbox View / ContextIPsDomainsASNDropped Files

ScreenshotsStartupCreated / dropped FilesContacted Domains/Contacted IPs

Contacted DomainsContacted IPsPublic

Static File InfoGeneralFile IconStatic PE Info

Copyright Joe Security LLC 2018 Page 2 of 31

1515161717171717

181818192225

292929

29

292930

303030303031

3131

3131

GeneralEntrypoint PreviewData DirectoriesSectionsResourcesImportsVersion InfosPossible Origin

Network BehaviorNetwork Port DistributionTCP PacketsUDP PacketsDNS QueriesDNS Answers

Code ManipulationsStatistics

Behavior

System BehaviorAnalysis Process: IMG-FILE-093298393840933-09208438039039-023outputA4DB4EF.exe PID: 3440 Parent PID:3040

GeneralFile Activities

Analysis Process: IMG-FILE-093298393840933-09208438039039-023outputA4DB4EF.exe PID: 3476 Parent PID:3440

GeneralFile Activities

File CreatedFile WrittenFile Read

Registry ActivitiesKey Created

DisassemblyCode Analysis


Analysis Report

Overview

General Information

Joe Sandbox Version: 23.0.0

Analysis ID: 69994

Start time: 16:53:00

Joe Sandbox Product: CloudBasic

Start date: 28.07.2018

Overall analysis duration: 0h 5m 20s

Hypervisor based Inspection enabled: false

Report type: light

Sample file name: IMG-FILE-093298393840933-09208438039039-023outputA4DB4EF.exe

Cookbook file name: default.jbs

Analysis system description: Windows 7 SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 17, Flash 26, Java 8.0.1440.1)

Number of analysed new started processes analysed: 3

Number of new started drivers analysed: 0

Number of existing processes analysed: 0

Number of existing drivers analysed: 0

Number of injected processes analysed: 0

Technologies HCA enabledEGA enabledHDC enabled

Analysis stop reason: Timeout

Detection: MAL

Classification: mal84.rans.troj.spyw.evad.winEXE@3/1@93/1

EGA Information: Successful, ratio: 100%

HDC Information: Successful, ratio: 67.4% (good quality ratio 62.6%)Quality average: 77.2%Quality standard deviation: 29.3%

HCA Information: Successful, ratio: 93%Number of executed functions: 0Number of non-executed functions: 0

Cookbook Comments: Adjust boot timeCorrecting counters for adjusted boot timeFound application associated with file extension: .exe

Warnings:

Detection

Strategy Score Range Reporting Detection

Threshold 84 0 - 100 Report FP / FN

Exclude process from analysis (whitelisted): dllhost.exeTCP Packets have been reduced to 100Report size getting too big, too many NtDeviceIoControlFile calls found.Report size getting too big, too many NtQueryValueKey calls found.Skipping Hybrid Code Analysis (implementation is based on Java, .Net, VB or Delphi, or parses a document) for: IMG-FILE-093298393840933-09208438039039-023outputA4DB4EF.exe

Show All


mailto: [email protected]?subject=Joe Sandbox FP/FN: 69994 IMG-FILE-093298393840933-09208438039039-023outputA4DB4EF.exe default.jbs

Confidence

Strategy Score Range Further Analysis Required? Confidence

Threshold 5 0 - 5 false

Ransomware

Spreading

Phishing

Banker

Trojan / Bot

Adware

Spyware

Exploiter

Evader

Miner

clean

clean

clean

clean

clean

clean

clean

suspicious

suspicious

suspicious

suspicious

suspicious

suspicious

suspicious

malicious

malicious

malicious

malicious

malicious

malicious

malicious

Classification


Analysis Advice

Contains functionality to modify the execution of threads in other processes

Sample has functionality to log and monitor keystrokes, analyze it with the 'Simulates keyboard and window changes' cookbook

Signature Overview

• AV Detection

• Spreading

• Networking

• Key, Mouse, Clipboard, Microphone and Screen Capturing

• Spam, unwanted Advertisements and Ransom Demands

• System Summary

• Data Obfuscation

• Boot Survival

• Hooking and other Techniques for Hiding and Protection

• Malware Analysis System Evasion

• Anti Debugging

• HIPS / PFW / Operating System Protection Evasion

• Language, Device and Operating System Detection

• Remote Access Functionality

Click to jump to signature section

AV Detection:

Antivirus detection for unpacked file

Yara signature match

Spreading:

Contains functionality to enumerate / list files inside a directory

Networking:

Detected TCP or UDP traffic on non-standard ports

Contains functionality to upload files via FTP

Internet Provider seen in connection with other malware

Contains functionality to download additional files from the internet

Performs DNS lookups

Urls found in memory or binary data

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Contains functionality to capture and log keystrokes

Contains functionality to log keystrokes

Contains functionality to log keystrokes

Contains functionality to register a low level keyboard hook

Installs a global keyboard hook

Contains functionality for read data from the clipboard

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality to retrieve information about pressed keystrokes

Spam, unwanted Advertisements and Ransom Demands:


Contains functionalty to change the wallpaper

System Summary:

Contains functionality to call native functions

Contains functionality to delete services

Contains functionality to shutdown / reboot the system

Creates mutexes

Detected potential crypto function

Enables driver privileges

Enables security privileges

Found potential string decryption / allocating functions

Reads the hosts file

Sample file is different than original file name gathered from version info

PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)

Classification label

Contains functionality for error logging

Contains functionality to adjust token privileges (e.g. debug / backup)

Contains functionality to check free disk space

Contains functionality to create services

Contains functionality to instantiate COM classes

Contains functionality to load and extract PE file embedded resources

Contains functionality to modify services (start/stop/modify)

Creates files inside the user directory

PE file has an executable .text section and no other executable section

Parts of this applications are using Borland Delphi (Probably coded in Delphi)

Parts of this applications are using VB runtime library 6.0 (Probably coded in Visual Basic)

Reads ini files

Reads software policies

Spawns processes

Uses an in-process (OLE) Automation server

Data Obfuscation:

Contains functionality to dynamically determine API calls

PE file contains an invalid checksum

Uses code obfuscation techniques (call, push, ret)

Binary may include packed or encrypted code

Boot Survival:

Contains functionality to start windows services

Hooking and other Techniques for Hiding and Protection:

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Extensive use of GetProcAddress (often used to hide API calls)

Disables application error messsages (SetErrorMode)

Malware Analysis System Evasion:

Found evasive API chain (may stop execution after checking mutex)

Contains functionality to enumerate running services

Found evasive API chain (date check)

Found evasive API chain checking for process token information


Found large amount of non-executed APIs

Contains functionality to enumerate / list files inside a directory

Program exit points

Anti Debugging:

Contains functionality to dynamically determine API calls

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Enables debug privileges

HIPS / PFW / Operating System Protection Evasion:

Contains functionality to inject code into remote processes

Modifies the context of a thread in another process (thread injection)

Contains functionality to launch a program with higher privileges

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

May try to detect the Windows Explorer process (often used for injection)

Language, Device and Operating System Detection:

Contains functionality locales information (e.g. system language)

Queries the volume information (name, serial number etc) of a device

Contains functionality to query local / system time

Contains functionality to query the account / user name

Contains functionality to query windows version

Remote Access Functionality:

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Behavior Graph


Behavior Graph

ID: 69994

Sample: IMG-FILE-093298393840933-09208438039039-023outputA4DB4EF.exe

Startdate: 28/07/2018

Architecture: WINDOWS

Score: 84

Detected TCP or UDPtraffic on non-standard

ports

Antivirus detectionfor unpacked file

IMG-FILE-093298393840933-09208438039039-023outputA4DB4EF.exe

started

Contains functionalityto log keystrokes

Found evasive API chain(may stop executionafter checking mutex)

Contains functionaltyto change the wallpaper 5 other signatures

IMG-FILE-093298393840933-09208438039039-023outputA4DB4EF.exe

3

started

dcpiconew.ddns.me

213.183.40.43, 2213, 49163, 49164

MELBICOM-EU-ASNL

Lithuania

Installs a global keyboardhook

Detected TCP or UDPtraffic on non-standard

ports

Legend:

Process

Signature

Created File

DNS/IP Info

Is Dropped

Is Windows Process

Number of created Registry Values

Number of created Files

Visual Basic

Delphi

Java

.Net C# or VB.NET

C, C++ or other language

Is malicious

Hide Legend

Time Type Description

16:53:48 API Interceptor 1x Sleep call for process: IMG-FILE-093298393840933-09208438039039-023outputA4DB4EF.exe modified

No Antivirus matches


Source Detection Scanner Label Link

2.0.IMG-FILE-093298393840933-09208438039039-023outputA4DB4EF.exe.400000.11.unpack 100% Avira BDS/Backdoor.Gen







Simulations

Behavior and APIs

Antivirus Detection

Initial Sample

Dropped Files

Unpacked PE Files




2.2.IMG-FILE-093298393840933-09208438039039-023outputA4DB4EF.exe.400000.3.unpack 100% Avira BDS/DarkKomet.GS







dcpiconew.ddns.me 3% virustotal Browse


No yara matches

No yara matches

No yara matches

Source Rule Description Author

00000002.00000002.21438435290.00400000.00000040.sdmp RAT_DarkComet Detects DarkComet RAT Kevin Breen <[email protected]>

00000002.00000002.21438435290.00400000.00000040.sdmp Malware_QA_update VT Research QA uploaded malware - file update.exe

Florian Roth



Florian Roth



Florian Roth



Florian Roth



Florian Roth


2.0.IMG-FILE-093298393840933-09208438039039-023outputA4DB4EF.exe.400000.14.raw.unpack

RAT_DarkComet Detects DarkComet RAT Kevin Breen <[email protected]>


Malware_QA_update VT Research QA uploaded malware - file update.exe

Florian Roth





Florian Roth

Domains

URLs

Yara Overview

Initial Sample

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs


https://www.virustotal.com/url/f5ccc4a4784f0b2cbfbeff50f8f9e7b69d377676f47618afdcda2f7a4234ac8e/analysis/1532711949/





Florian Roth





Florian Roth

1.2.IMG-FILE-093298393840933-09208438039039-023outputA4DB4EF.exe.2716000.2.unpack Malware_QA_update VT Research QA uploaded malware - file update.exe

Florian Roth

2.2.IMG-FILE-093298393840933-09208438039039-023outputA4DB4EF.exe.400000.3.unpack RAT_DarkComet Detects DarkComet RAT Kevin Breen <[email protected]>


Florian Roth





Florian Roth

2.1.IMG-FILE-093298393840933-09208438039039-023outputA4DB4EF.exe.400000.0.unpack RAT_DarkComet Detects DarkComet RAT Kevin Breen <[email protected]>


Florian Roth


No context

No context

MatchAssociated SampleName / URL SHA 256 Detection Link Context

MELBICOM-EU-ASNL new.exe bdb1678187ff11a1586ac493e32e4fbc288fc1e1f0b9dd680764a9a3e38e98e2

malicious Browse 213.183.58.27

47ORDER LIST 0018930026.exe

c9494677ea837038c7eb74b00aed8ac15dbb6f4f16bcd095535e39785c1db739


emotet.doc b62230042f02ecdff4a53e7d3cb77023c1d4bdde332d568cfc2c1001500c314d


6099956.exe 4c31b79d82ad540695af40f1862e5336158bc0c10525b402fb2a51d0b04f27a4


17Order List.pdf.exe d43876bdf3ef6bc32a661d53d48f2fe122c5d4f1e840a6db7d24eab28ea0e508


55New Order.exe ed1fd2f253403cbbcfa6d86cbc9a3147195d5d00d2eba903519fad348f7ea695


25New Order.exe 8ad8b2ab28e302f88523fbc02879a6a79dca7c498ae25bf611b75f5076da8842


19ORDER LIST 00235313 PDF.exe

cc73f1cd593458d227626d618ba6da103ed7523ccd885d9b63c185db827a3369


DOC000YUT090.exe 2778ddf8e45c6c9e6d469b7d99eebb0e063cd2f6b6608956b706ee321fca8b18


http://thehealersbridge.com/Rechnung/


37222222.exe be00d16ba5800fd7b10c378dc6ed85dbea650cc166d51266d251cecb04d867ea


Joe Sandbox View / Context

IPs

Domains

ASN


https://view.joesandbox.com/analysis/23777/html/none











22Enclosed Files PDF.exe

8c69f2681a5e00a645eac68ae60efc6826f570c0fddbec8696ba3a479cdf0e02


YUKA BOI SI PO480.docx

f7320710bde5dfab7ac3ac32fb3f6656630fcae81c14da9d074bc42229e245b3


Po#1321.jar aeabde9e723222152af590e68e67aa68e8afe1e84ef950346e7266b892883e40


SCAN00GOG090.exe 3bc676885fcb24d6743d5ec70e405ffb4a45dc1ca41f7fcec4863e719dce69b3


70order specification.exe

460e40548d9435a68144aa3d25c4866a0bd29e74ea380d8d4f566076a293829b


11cccc.exe 5a5816c5bd453414112757f274704798f2b9b079cda808316099c3e6837eddc0


17new order.exe 9b1862aff80ee6a81c9de7c9c4d05d39561c58d743ef8cef880ca67da687d85b


83PO1#77322018.exe badc5ef1e511e8143b08828b707a4f41be7592a9a9486a66dc495547832baec3


emotet.doc b62230042f02ecdff4a53e7d3cb77023c1d4bdde332d568cfc2c1001500c314d


MatchAssociated SampleName / URL SHA 256 Detection Link Context

No context

Dropped Files

Screenshots











System is w7

IMG-FILE-093298393840933-09208438039039-023outputA4DB4EF.exe (PID: 3440 cmdline: 'C:\Users\user\Desktop\IMG-FILE-093298393840933-09208438039039-023outputA4DB4EF.exe' MD5: 88E0BC064945FA01C3B2745AC3633836)

IMG-FILE-093298393840933-09208438039039-023outputA4DB4EF.exe (PID: 3476 cmdline: 'C:\Users\user\Desktop\IMG-FILE-093298393840933-09208438039039-023outputA4DB4EF.exe' MD5: 88E0BC064945FA01C3B2745AC3633836)

cleanup

C:\Users\user\AppData\Roaming\dclogs\2018-07-28-7.dcProcess: C:\Users\user\Desktop\IMG-FILE-093298393840933-09208438039039-023outputA4DB4EF.exe

File Type: ASCII text, with CRLF line terminators

Size (bytes): 69

Entropy (8bit): 4.321564674949941

Encrypted: false

MD5: A5255AEA9919DB41C0336C46D86BDDC1

SHA1: F7BCBFC3E5A68650E6DA4E8FAE42E07382CCA553

SHA-256: 5EFFBDDD06C9D721B83E454B25C9BB6E5F60BB80004851F5A78146269738D4ED

SHA-512: CEB862889536AFCE64B73712BB1EB56205C72C82322A63B936874D1D6AAAD3060EDBECC24A268192213C0B0024EFB1357C405ECC64E768437D0D7ACFEA5B69C7

Malicious: false

Reputation: low

Startup

Created / dropped Files


Static File Info

GeneralFile type: PE32 executable (GUI) Intel 80386, for MS Windows

Entropy (8bit): 7.660285851011754

TrID: Win32 Executable (generic) a (10002005/4) 99.15%Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81%Generic Win/DOS Executable (2004/3) 0.02%DOS Executable Generic (2002/1) 0.02%Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%

File name: IMG-FILE-093298393840933-09208438039039-023outputA4DB4EF.exe

File size: 921615

MD5: 88e0bc064945fa01c3b2745ac3633836

SHA1: ad9c9bb67f8ab0a98eb8c7615c9df09c01608cb5

SHA256: b92fddbc957300ad83902f2a5d78ed7a0258af765471bc40f9aceedd40a37eea

Name IP Active Malicious Antivirus Detection Reputation

dcpiconew.ddns.me 213.183.40.43 true true 3%, virustotal, Browse unknown

No. of IPs < 25%

25% < No. of IPs < 50%

50% < No. of IPs < 75%

75% < No. of IPs

IP Country Flag ASN ASN Name Malicious

213.183.40.43 Lithuania 56630 MELBICOM-EU-ASNL true

Contacted Domains/Contacted IPs

Contacted Domains

Contacted IPs

Public


https://www.virustotal.com/url/f5ccc4a4784f0b2cbfbeff50f8f9e7b69d377676f47618afdcda2f7a4234ac8e/analysis/1532711949/

SHA512: 01fcee89985560c1f4b156401d9b89ecb240ca8b7b25a755d72787ec1678c6b277f9bfe6a7fe5a684403a22ce32504b41892f50ab0faa31a6c072a68e14b9d30

File Content Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O.......................D.......=.......Rich............PE..L......N............................X.............@................

General

File Icon

GeneralEntrypoint: 0x401758

Entrypoint Section: .text

Digitally signed: false

Imagebase: 0x400000

Subsystem: windows gui

Image File Characteristics: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

DLL Characteristics:

Time Stamp: 0x4E8196A8 [Tue Sep 27 09:26:00 2011 UTC]

TLS Callbacks:

CLR (.Net) Version:

OS Version Major: 4

OS Version Minor: 0

File Version Major: 4

File Version Minor: 0

Subsystem Version Major: 4

Subsystem Version Minor: 0

Import Hash: 5d4144bf3ece0ea2838e101a478c2b38

Instruction

push 00401958h

call 00007F5222BD9DA5h

add byte ptr [eax], al



xor byte ptr [eax], al


inc eax




add byte ptr [ebx+esi*8-2D8846C5h], bh

or eax, 3EBF8845h

pop ebp

loopne 00007F5222BD9D77h

js 00007F5222BD9D5Dh




add dword ptr [eax], eax





dec esi

imul esp, dword ptr [edi+68h], 73696674h

push 00000000h

Static PE Info

Entrypoint Preview





add bh, bh

int3

xor dword ptr [eax], eax

add bh, byte ptr [edx+esi*4-1772F829h]

ret

dec edi

mov cl, ADh

inc esi

pop ebp

push esi

sbb eax, 2816EB7Eh

sal byte ptr [ebx+edx*4-60B139B3h], 1

add al, EEh

enter 34C4h, BFh

or byte ptr [edx], bh

dec edi

lodsd

xor ebx, dword ptr [ecx-48EE309Ah]

or al, 00h

stosb

add byte ptr [eax-2Dh], ah

xchg eax, ebx



















test byte ptr [eax], 00000000h

add byte ptr [eax+eax+00h], cl


or dword ptr [eax], eax

inc esi

popad

insb

outsb

imul esi, dword ptr [ebp+73h], 010D0038h

Instruction

Name Virtual Address Virtual Size Is in Section

IMAGE_DIRECTORY_ENTRY_EXPORT 0x0 0x0

IMAGE_DIRECTORY_ENTRY_IMPORT 0xd8b94 0x28 .text

IMAGE_DIRECTORY_ENTRY_RESOURCE 0xdb000 0x66ea .rsrc

IMAGE_DIRECTORY_ENTRY_EXCEPTION 0x0 0x0

IMAGE_DIRECTORY_ENTRY_SECURITY 0x0 0x0

IMAGE_DIRECTORY_ENTRY_BASERELOC 0x0 0x0

IMAGE_DIRECTORY_ENTRY_DEBUG 0x0 0x0

IMAGE_DIRECTORY_ENTRY_COPYRIGHT 0x0 0x0

Data Directories


IMAGE_DIRECTORY_ENTRY_GLOBALPTR 0x0 0x0

IMAGE_DIRECTORY_ENTRY_TLS 0x0 0x0

IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG 0x0 0x0

IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT 0x228 0x20

IMAGE_DIRECTORY_ENTRY_IAT 0x1000 0xd4 .text

IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT 0x0 0x0

IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 0x0 0x0

IMAGE_DIRECTORY_ENTRY_RESERVED 0x0 0x0

Name Virtual Address Virtual Size Is in Section

Name Virtual Address Virtual Size Raw Size Xored PE ZLIB Complexity File Type Entropy Characteristics

.text 0x1000 0xd7f94 0xd8000 False 0.829871283637 data 7.7300786047 IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

.data 0xd9000 0x1998 0x1000 False 0.00634765625 data 0.0 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ

.rsrc 0xdb000 0x66ea 0x7000 False 0.414376395089 data 4.43350683981 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Name RVA Size Type Language Country

RT_ICON 0xde4c2 0x3228 FoxPro FPT, blocks size 0, next free block index 671088640

RT_ICON 0xdc81a 0x1ca8 data

RT_ICON 0xdbb72 0xca8 data

RT_ICON 0xdb42a 0x748 data

RT_GROUP_ICON 0xdb3ec 0x3e MS Windows icon resource - 4 icons, 64x64, 256-colors

RT_VERSION 0xdb180 0x26c data English United States

DLL Import

MSVBVM60.DLL _CIcos, _adj_fptan, __vbaFreeVarList, __vbaEnd, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaStrCat, __vbaSetSystemError, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaObjSet, __vbaOnError, _adj_fdiv_m16i, _adj_fdivr_m16i, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaStrCmp, DllFunctionCall, _adj_fpatan, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, __vbaStrToUnicode, _adj_fprem, _adj_fdivr_m64, __vbaFPException, _CIlog, __vbaErrorOverflow, __vbaNew2, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, __vbaStrToAnsi, __vbaFpI4, _CIatan, __vbaStrMove, _allmul, _CItan, _CIexp, __vbaFreeStr, __vbaFreeObj

Description Data

Translation 0x0409 0x04b0

InternalName Polythely

FileVersion 3.04

LegalTrademarks goSHIYUKI GasuI

ProductName ESUS

ProductVersion 3.04

FileDescription geAMVIEWER nmBH

OriginalFilename Polythely.exe

Language of compilation system Country where language is spoken Map

English United States

Sections

Resources

Imports

Version Infos

Possible Origin


Network Behavior

Network Port Distribution

Total Packets: 143

• 2213 undefined

• 53 (DNS)

Timestamp Source Port Dest Port Source IP Dest IP

Jul 28, 2018 16:53:40.256915092 CEST 56842 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:53:40.289809942 CEST 53 56842 8.8.8.8 192.168.2.2

Jul 28, 2018 16:53:40.293693066 CEST 49163 2213 192.168.2.2 213.183.40.43

Jul 28, 2018 16:53:40.312577009 CEST 2213 49163 213.183.40.43 192.168.2.2

Jul 28, 2018 16:53:40.864700079 CEST 49163 2213 192.168.2.2 213.183.40.43

Jul 28, 2018 16:53:40.883702040 CEST 2213 49163 213.183.40.43 192.168.2.2

Jul 28, 2018 16:53:41.398777962 CEST 49163 2213 192.168.2.2 213.183.40.43

Jul 28, 2018 16:53:41.417757988 CEST 2213 49163 213.183.40.43 192.168.2.2

Jul 28, 2018 16:53:41.623138905 CEST 53440 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:53:41.656985998 CEST 53 53440 8.8.8.8 192.168.2.2

Jul 28, 2018 16:53:41.658391953 CEST 49164 2213 192.168.2.2 213.183.40.43

Jul 28, 2018 16:53:41.677309036 CEST 2213 49164 213.183.40.43 192.168.2.2

Jul 28, 2018 16:53:42.175987005 CEST 49164 2213 192.168.2.2 213.183.40.43

Jul 28, 2018 16:53:42.194941998 CEST 2213 49164 213.183.40.43 192.168.2.2

Jul 28, 2018 16:53:42.699413061 CEST 49164 2213 192.168.2.2 213.183.40.43

Jul 28, 2018 16:53:42.718939066 CEST 2213 49164 213.183.40.43 192.168.2.2

Jul 28, 2018 16:53:42.922620058 CEST 59605 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:53:42.956001997 CEST 53 59605 8.8.8.8 192.168.2.2

Jul 28, 2018 16:53:42.957010031 CEST 49165 2213 192.168.2.2 213.183.40.43

Jul 28, 2018 16:53:42.975992918 CEST 2213 49165 213.183.40.43 192.168.2.2

Jul 28, 2018 16:53:43.478080988 CEST 49165 2213 192.168.2.2 213.183.40.43

Jul 28, 2018 16:53:43.497401953 CEST 2213 49165 213.183.40.43 192.168.2.2

Jul 28, 2018 16:53:43.999022007 CEST 49165 2213 192.168.2.2 213.183.40.43

Jul 28, 2018 16:53:44.018266916 CEST 2213 49165 213.183.40.43 192.168.2.2

Jul 28, 2018 16:53:44.218100071 CEST 50900 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:53:44.246260881 CEST 53 50900 8.8.8.8 192.168.2.2

Jul 28, 2018 16:53:44.247507095 CEST 49166 2213 192.168.2.2 213.183.40.43

Jul 28, 2018 16:53:44.266525984 CEST 2213 49166 213.183.40.43 192.168.2.2

Jul 28, 2018 16:53:44.769830942 CEST 49166 2213 192.168.2.2 213.183.40.43

Jul 28, 2018 16:53:44.789115906 CEST 2213 49166 213.183.40.43 192.168.2.2

Jul 28, 2018 16:53:45.290693045 CEST 49166 2213 192.168.2.2 213.183.40.43

Jul 28, 2018 16:53:45.309560061 CEST 2213 49166 213.183.40.43 192.168.2.2

Jul 28, 2018 16:53:45.510560989 CEST 51075 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:53:45.538414001 CEST 53 51075 8.8.8.8 192.168.2.2

Jul 28, 2018 16:53:45.539638042 CEST 49167 2213 192.168.2.2 213.183.40.43

Jul 28, 2018 16:53:45.558681011 CEST 2213 49167 213.183.40.43 192.168.2.2

Jul 28, 2018 16:53:46.052136898 CEST 49167 2213 192.168.2.2 213.183.40.43

Jul 28, 2018 16:53:46.071149111 CEST 2213 49167 213.183.40.43 192.168.2.2

Jul 28, 2018 16:53:46.572894096 CEST 49167 2213 192.168.2.2 213.183.40.43

Jul 28, 2018 16:53:46.591871977 CEST 2213 49167 213.183.40.43 192.168.2.2

TCP Packets


Jul 28, 2018 16:53:46.791172028 CEST 61674 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:53:46.805017948 CEST 53 61674 8.8.8.8 192.168.2.2

Jul 28, 2018 16:53:46.806241989 CEST 49168 2213 192.168.2.2 213.183.40.43

Jul 28, 2018 16:53:46.825131893 CEST 2213 49168 213.183.40.43 192.168.2.2

Jul 28, 2018 16:53:47.324064970 CEST 49168 2213 192.168.2.2 213.183.40.43

Jul 28, 2018 16:53:47.343060970 CEST 2213 49168 213.183.40.43 192.168.2.2

Jul 28, 2018 16:53:47.844163895 CEST 49168 2213 192.168.2.2 213.183.40.43

Jul 28, 2018 16:53:47.863190889 CEST 2213 49168 213.183.40.43 192.168.2.2

Jul 28, 2018 16:53:48.060863018 CEST 59291 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:53:48.099422932 CEST 53 59291 8.8.8.8 192.168.2.2

Jul 28, 2018 16:53:48.100276947 CEST 49169 2213 192.168.2.2 213.183.40.43

Jul 28, 2018 16:53:48.119254112 CEST 2213 49169 213.183.40.43 192.168.2.2

Jul 28, 2018 16:53:48.615776062 CEST 49169 2213 192.168.2.2 213.183.40.43

Jul 28, 2018 16:53:48.634748936 CEST 2213 49169 213.183.40.43 192.168.2.2

Jul 28, 2018 16:53:49.136157990 CEST 49169 2213 192.168.2.2 213.183.40.43

Jul 28, 2018 16:53:49.155041933 CEST 2213 49169 213.183.40.43 192.168.2.2

Jul 28, 2018 16:53:49.440210104 CEST 63053 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:53:49.453116894 CEST 53 63053 8.8.8.8 192.168.2.2

Jul 28, 2018 16:53:49.453722000 CEST 49170 2213 192.168.2.2 213.183.40.43

Jul 28, 2018 16:53:49.472695112 CEST 2213 49170 213.183.40.43 192.168.2.2

Jul 28, 2018 16:53:49.977560997 CEST 49170 2213 192.168.2.2 213.183.40.43

Jul 28, 2018 16:53:49.996911049 CEST 2213 49170 213.183.40.43 192.168.2.2

Jul 28, 2018 16:53:50.497953892 CEST 49170 2213 192.168.2.2 213.183.40.43

Jul 28, 2018 16:53:50.516993046 CEST 2213 49170 213.183.40.43 192.168.2.2

Jul 28, 2018 16:53:50.714940071 CEST 60812 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:53:50.743074894 CEST 53 60812 8.8.8.8 192.168.2.2

Jul 28, 2018 16:53:50.743998051 CEST 49171 2213 192.168.2.2 213.183.40.43

Jul 28, 2018 16:53:50.763194084 CEST 2213 49171 213.183.40.43 192.168.2.2

Jul 28, 2018 16:53:51.269793987 CEST 49171 2213 192.168.2.2 213.183.40.43

Jul 28, 2018 16:53:51.288816929 CEST 2213 49171 213.183.40.43 192.168.2.2

Jul 28, 2018 16:53:51.790399075 CEST 49171 2213 192.168.2.2 213.183.40.43

Jul 28, 2018 16:53:51.809545040 CEST 2213 49171 213.183.40.43 192.168.2.2

Jul 28, 2018 16:53:52.009888887 CEST 58523 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:53:52.023118019 CEST 53 58523 8.8.8.8 192.168.2.2

Jul 28, 2018 16:53:52.024377108 CEST 49172 2213 192.168.2.2 213.183.40.43

Jul 28, 2018 16:53:52.043540955 CEST 2213 49172 213.183.40.43 192.168.2.2

Jul 28, 2018 16:53:52.541573048 CEST 49172 2213 192.168.2.2 213.183.40.43

Jul 28, 2018 16:53:52.560672045 CEST 2213 49172 213.183.40.43 192.168.2.2

Jul 28, 2018 16:53:53.061755896 CEST 49172 2213 192.168.2.2 213.183.40.43

Jul 28, 2018 16:53:53.080734015 CEST 2213 49172 213.183.40.43 192.168.2.2

Jul 28, 2018 16:53:53.280365944 CEST 65490 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:53:53.308398962 CEST 53 65490 8.8.8.8 192.168.2.2

Jul 28, 2018 16:53:53.309407949 CEST 49173 2213 192.168.2.2 213.183.40.43

Jul 28, 2018 16:53:53.328320980 CEST 2213 49173 213.183.40.43 192.168.2.2

Jul 28, 2018 16:53:53.823327065 CEST 49173 2213 192.168.2.2 213.183.40.43

Jul 28, 2018 16:53:53.842542887 CEST 2213 49173 213.183.40.43 192.168.2.2

Jul 28, 2018 16:53:54.344147921 CEST 49173 2213 192.168.2.2 213.183.40.43

Jul 28, 2018 16:53:54.363435984 CEST 2213 49173 213.183.40.43 192.168.2.2

Jul 28, 2018 16:53:54.567811012 CEST 60652 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:53:54.581576109 CEST 53 60652 8.8.8.8 192.168.2.2

Jul 28, 2018 16:53:54.582801104 CEST 49174 2213 192.168.2.2 213.183.40.43

Jul 28, 2018 16:53:54.601670027 CEST 2213 49174 213.183.40.43 192.168.2.2

Jul 28, 2018 16:53:55.105041027 CEST 49174 2213 192.168.2.2 213.183.40.43

Jul 28, 2018 16:53:55.123951912 CEST 2213 49174 213.183.40.43 192.168.2.2

Jul 28, 2018 16:53:55.625886917 CEST 49174 2213 192.168.2.2 213.183.40.43

Jul 28, 2018 16:53:55.645148993 CEST 2213 49174 213.183.40.43 192.168.2.2

Jul 28, 2018 16:53:55.892533064 CEST 57729 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:53:55.905730009 CEST 53 57729 8.8.8.8 192.168.2.2

Jul 28, 2018 16:53:55.906831026 CEST 49175 2213 192.168.2.2 213.183.40.43

Jul 28, 2018 16:53:55.925625086 CEST 2213 49175 213.183.40.43 192.168.2.2


UDP Packets



Jul 28, 2018 16:53:40.256915092 CEST 56842 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:53:40.289809942 CEST 53 56842 8.8.8.8 192.168.2.2

Jul 28, 2018 16:53:41.623138905 CEST 53440 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:53:41.656985998 CEST 53 53440 8.8.8.8 192.168.2.2

Jul 28, 2018 16:53:42.922620058 CEST 59605 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:53:42.956001997 CEST 53 59605 8.8.8.8 192.168.2.2

Jul 28, 2018 16:53:44.218100071 CEST 50900 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:53:44.246260881 CEST 53 50900 8.8.8.8 192.168.2.2

Jul 28, 2018 16:53:45.510560989 CEST 51075 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:53:45.538414001 CEST 53 51075 8.8.8.8 192.168.2.2

Jul 28, 2018 16:53:46.791172028 CEST 61674 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:53:46.805017948 CEST 53 61674 8.8.8.8 192.168.2.2

Jul 28, 2018 16:53:48.060863018 CEST 59291 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:53:48.099422932 CEST 53 59291 8.8.8.8 192.168.2.2

Jul 28, 2018 16:53:49.440210104 CEST 63053 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:53:49.453116894 CEST 53 63053 8.8.8.8 192.168.2.2

Jul 28, 2018 16:53:50.714940071 CEST 60812 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:53:50.743074894 CEST 53 60812 8.8.8.8 192.168.2.2

Jul 28, 2018 16:53:52.009888887 CEST 58523 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:53:52.023118019 CEST 53 58523 8.8.8.8 192.168.2.2

Jul 28, 2018 16:53:53.280365944 CEST 65490 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:53:53.308398962 CEST 53 65490 8.8.8.8 192.168.2.2

Jul 28, 2018 16:53:54.567811012 CEST 60652 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:53:54.581576109 CEST 53 60652 8.8.8.8 192.168.2.2

Jul 28, 2018 16:53:55.892533064 CEST 57729 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:53:55.905730009 CEST 53 57729 8.8.8.8 192.168.2.2

Jul 28, 2018 16:53:57.166074991 CEST 65311 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:53:57.179740906 CEST 53 65311 8.8.8.8 192.168.2.2

Jul 28, 2018 16:53:58.448458910 CEST 50323 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:53:58.462502003 CEST 53 50323 8.8.8.8 192.168.2.2

Jul 28, 2018 16:53:59.727968931 CEST 64115 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:53:59.755918980 CEST 53 64115 8.8.8.8 192.168.2.2

Jul 28, 2018 16:54:01.012783051 CEST 59195 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:54:01.027308941 CEST 53 59195 8.8.8.8 192.168.2.2

Jul 28, 2018 16:54:02.295042038 CEST 58138 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:54:02.308679104 CEST 53 58138 8.8.8.8 192.168.2.2

Jul 28, 2018 16:54:03.564284086 CEST 60708 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:54:03.578180075 CEST 53 60708 8.8.8.8 192.168.2.2

Jul 28, 2018 16:54:04.834522963 CEST 65034 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:54:04.847754955 CEST 53 65034 8.8.8.8 192.168.2.2

Jul 28, 2018 16:54:06.108506918 CEST 58653 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:54:06.122287035 CEST 53 58653 8.8.8.8 192.168.2.2

Jul 28, 2018 16:54:07.379065990 CEST 57327 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:54:07.392807007 CEST 53 57327 8.8.8.8 192.168.2.2

Jul 28, 2018 16:54:08.662684917 CEST 56352 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:54:08.676893950 CEST 53 56352 8.8.8.8 192.168.2.2

Jul 28, 2018 16:54:09.955468893 CEST 62091 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:54:09.969798088 CEST 53 62091 8.8.8.8 192.168.2.2

Jul 28, 2018 16:54:11.286573887 CEST 63509 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:54:11.305902004 CEST 53 63509 8.8.8.8 192.168.2.2

Jul 28, 2018 16:54:12.569451094 CEST 51492 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:54:12.583128929 CEST 53 51492 8.8.8.8 192.168.2.2

Jul 28, 2018 16:54:13.850972891 CEST 62750 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:54:13.864027977 CEST 53 62750 8.8.8.8 192.168.2.2

Jul 28, 2018 16:54:15.123455048 CEST 58913 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:54:15.137018919 CEST 53 58913 8.8.8.8 192.168.2.2

Jul 28, 2018 16:54:16.406147957 CEST 63309 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:54:16.420468092 CEST 53 63309 8.8.8.8 192.168.2.2

Jul 28, 2018 16:54:17.696930885 CEST 52316 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:54:17.710144997 CEST 53 52316 8.8.8.8 192.168.2.2

Jul 28, 2018 16:54:18.989093065 CEST 65236 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:54:19.003176928 CEST 53 65236 8.8.8.8 192.168.2.2

Jul 28, 2018 16:54:20.269597054 CEST 55904 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:54:20.283694029 CEST 53 55904 8.8.8.8 192.168.2.2


Jul 28, 2018 16:54:21.542146921 CEST 55581 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:54:21.555753946 CEST 53 55581 8.8.8.8 192.168.2.2

Jul 28, 2018 16:54:22.813710928 CEST 57178 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:54:22.826834917 CEST 53 57178 8.8.8.8 192.168.2.2

Jul 28, 2018 16:54:24.086327076 CEST 62406 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:54:24.099877119 CEST 53 62406 8.8.8.8 192.168.2.2

Jul 28, 2018 16:54:25.368151903 CEST 58563 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:54:25.381920099 CEST 53 58563 8.8.8.8 192.168.2.2

Jul 28, 2018 16:54:26.696667910 CEST 49408 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:54:26.724555969 CEST 53 49408 8.8.8.8 192.168.2.2

Jul 28, 2018 16:54:27.980077028 CEST 61609 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:54:27.993844986 CEST 53 61609 8.8.8.8 192.168.2.2

Jul 28, 2018 16:54:29.253496885 CEST 59433 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:54:29.267262936 CEST 53 59433 8.8.8.8 192.168.2.2

Jul 28, 2018 16:54:30.533129930 CEST 57291 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:54:30.546283007 CEST 53 57291 8.8.8.8 192.168.2.2

Jul 28, 2018 16:54:31.805951118 CEST 52245 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:54:31.819585085 CEST 53 52245 8.8.8.8 192.168.2.2

Jul 28, 2018 16:54:33.127824068 CEST 56115 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:54:33.140887022 CEST 53 56115 8.8.8.8 192.168.2.2

Jul 28, 2018 16:54:34.400926113 CEST 64225 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:54:34.414535046 CEST 53 64225 8.8.8.8 192.168.2.2

Jul 28, 2018 16:54:35.671713114 CEST 55567 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:54:35.685591936 CEST 53 55567 8.8.8.8 192.168.2.2

Jul 28, 2018 16:54:36.942847013 CEST 54625 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:54:36.956442118 CEST 53 54625 8.8.8.8 192.168.2.2

Jul 28, 2018 16:54:40.820545912 CEST 64017 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:54:40.853554010 CEST 53 64017 8.8.8.8 192.168.2.2

Jul 28, 2018 16:54:42.151648045 CEST 53054 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:54:42.179446936 CEST 53 53054 8.8.8.8 192.168.2.2

Jul 28, 2018 16:54:43.433971882 CEST 61002 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:54:43.467886925 CEST 53 61002 8.8.8.8 192.168.2.2

Jul 28, 2018 16:54:44.725675106 CEST 61578 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:54:44.768603086 CEST 53 61578 8.8.8.8 192.168.2.2

Jul 28, 2018 16:54:46.037002087 CEST 64252 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:54:46.050968885 CEST 53 64252 8.8.8.8 192.168.2.2

Jul 28, 2018 16:54:47.319364071 CEST 62744 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:54:47.333059072 CEST 53 62744 8.8.8.8 192.168.2.2

Jul 28, 2018 16:54:48.630811930 CEST 64808 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:54:48.658801079 CEST 53 64808 8.8.8.8 192.168.2.2

Jul 28, 2018 16:54:49.924047947 CEST 65300 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:54:49.937834978 CEST 53 65300 8.8.8.8 192.168.2.2

Jul 28, 2018 16:54:51.204914093 CEST 51518 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:54:51.237368107 CEST 53 51518 8.8.8.8 192.168.2.2

Jul 28, 2018 16:54:52.497864008 CEST 63535 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:54:52.525909901 CEST 53 63535 8.8.8.8 192.168.2.2

Jul 28, 2018 16:54:53.788826942 CEST 65474 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:54:53.816133022 CEST 53 65474 8.8.8.8 192.168.2.2

Jul 28, 2018 16:54:55.080184937 CEST 58773 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:54:56.073122025 CEST 58773 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:54:57.074553967 CEST 58773 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:54:58.011504889 CEST 53 58773 8.8.8.8 192.168.2.2

Jul 28, 2018 16:54:58.011523962 CEST 53 58773 8.8.8.8 192.168.2.2

Jul 28, 2018 16:54:58.011575937 CEST 53 58773 8.8.8.8 192.168.2.2

Jul 28, 2018 16:54:59.333810091 CEST 64117 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:54:59.346910000 CEST 53 64117 8.8.8.8 192.168.2.2

Jul 28, 2018 16:55:00.606225967 CEST 64501 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:55:00.634890079 CEST 53 64501 8.8.8.8 192.168.2.2

Jul 28, 2018 16:55:01.909796000 CEST 55877 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:55:01.923397064 CEST 53 55877 8.8.8.8 192.168.2.2

Jul 28, 2018 16:55:03.192349911 CEST 55120 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:55:03.206060886 CEST 53 55120 8.8.8.8 192.168.2.2

Jul 28, 2018 16:55:04.474843025 CEST 57840 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:55:04.488651991 CEST 53 57840 8.8.8.8 192.168.2.2



Jul 28, 2018 16:55:05.745505095 CEST 52123 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:55:05.759233952 CEST 53 52123 8.8.8.8 192.168.2.2

Jul 28, 2018 16:55:07.027517080 CEST 58962 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:55:07.041001081 CEST 53 58962 8.8.8.8 192.168.2.2

Jul 28, 2018 16:55:08.317681074 CEST 60523 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:55:08.345282078 CEST 53 60523 8.8.8.8 192.168.2.2

Jul 28, 2018 16:55:09.600775003 CEST 64715 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:55:09.614770889 CEST 53 64715 8.8.8.8 192.168.2.2

Jul 28, 2018 16:55:10.883024931 CEST 50225 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:55:10.896838903 CEST 53 50225 8.8.8.8 192.168.2.2

Jul 28, 2018 16:55:12.155435085 CEST 62475 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:55:12.169066906 CEST 53 62475 8.8.8.8 192.168.2.2

Jul 28, 2018 16:55:15.030194998 CEST 52196 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:55:15.044025898 CEST 53 52196 8.8.8.8 192.168.2.2

Jul 28, 2018 16:55:16.300254107 CEST 60278 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:55:16.313400030 CEST 53 60278 8.8.8.8 192.168.2.2

Jul 28, 2018 16:55:17.569968939 CEST 54681 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:55:17.583223104 CEST 53 54681 8.8.8.8 192.168.2.2

Jul 28, 2018 16:55:18.852302074 CEST 61540 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:55:18.865550041 CEST 53 61540 8.8.8.8 192.168.2.2

Jul 28, 2018 16:55:20.136581898 CEST 55216 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:55:20.150567055 CEST 53 55216 8.8.8.8 192.168.2.2

Jul 28, 2018 16:55:21.437165022 CEST 58370 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:55:21.450452089 CEST 53 58370 8.8.8.8 192.168.2.2

Jul 28, 2018 16:55:22.716200113 CEST 65031 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:55:22.729310036 CEST 53 65031 8.8.8.8 192.168.2.2

Jul 28, 2018 16:55:23.982711077 CEST 56951 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:55:23.995711088 CEST 53 56951 8.8.8.8 192.168.2.2

Jul 28, 2018 16:55:25.254471064 CEST 58537 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:55:25.268090963 CEST 53 58537 8.8.8.8 192.168.2.2

Jul 28, 2018 16:55:26.525326014 CEST 65180 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:55:26.539007902 CEST 53 65180 8.8.8.8 192.168.2.2

Jul 28, 2018 16:55:27.794415951 CEST 62051 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:55:27.807468891 CEST 53 62051 8.8.8.8 192.168.2.2

Jul 28, 2018 16:55:29.069037914 CEST 54936 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:55:29.082689047 CEST 53 54936 8.8.8.8 192.168.2.2

Jul 28, 2018 16:55:30.391339064 CEST 61570 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:55:30.404520988 CEST 53 61570 8.8.8.8 192.168.2.2

Jul 28, 2018 16:55:31.673348904 CEST 61043 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:55:31.686408997 CEST 53 61043 8.8.8.8 192.168.2.2

Jul 28, 2018 16:55:32.942317963 CEST 59013 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:55:32.955909014 CEST 53 59013 8.8.8.8 192.168.2.2

Jul 28, 2018 16:55:34.217669010 CEST 52100 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:55:34.231218100 CEST 53 52100 8.8.8.8 192.168.2.2

Jul 28, 2018 16:55:35.498225927 CEST 64395 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:55:35.511885881 CEST 53 64395 8.8.8.8 192.168.2.2

Jul 28, 2018 16:55:36.780378103 CEST 52345 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:55:36.793442965 CEST 53 52345 8.8.8.8 192.168.2.2

Jul 28, 2018 16:55:38.051469088 CEST 63313 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:55:38.064651966 CEST 53 63313 8.8.8.8 192.168.2.2

Jul 28, 2018 16:55:39.333128929 CEST 57416 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:55:39.347166061 CEST 53 57416 8.8.8.8 192.168.2.2

Jul 28, 2018 16:55:40.605597019 CEST 63933 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:55:40.619220018 CEST 53 63933 8.8.8.8 192.168.2.2

Jul 28, 2018 16:55:41.869585037 CEST 63402 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:55:41.883240938 CEST 53 63402 8.8.8.8 192.168.2.2

Jul 28, 2018 16:55:43.141112089 CEST 55268 53 192.168.2.2 8.8.8.8

Jul 28, 2018 16:55:43.169612885 CEST 53 55268 8.8.8.8 192.168.2.2


Timestamp Source IP Dest IP Trans ID OP Code Name Type Class

Jul 28, 2018 16:53:40.256915092 CEST 192.168.2.2 8.8.8.8 0xfc1 Standard query (0)

dcpiconew.ddns.me

A (IP address) IN (0x0001)

DNS Queries


Jul 28, 2018 16:53:41.623138905 CEST 192.168.2.2 8.8.8.8 0xad0d Standard query (0)

dcpiconew.ddns.me


Jul 28, 2018 16:53:42.922620058 CEST 192.168.2.2 8.8.8.8 0xc872 Standard query (0)

dcpiconew.ddns.me


Jul 28, 2018 16:53:44.218100071 CEST 192.168.2.2 8.8.8.8 0xa1a4 Standard query (0)

dcpiconew.ddns.me


Jul 28, 2018 16:53:45.510560989 CEST 192.168.2.2 8.8.8.8 0x5472 Standard query (0)

dcpiconew.ddns.me


Jul 28, 2018 16:53:46.791172028 CEST 192.168.2.2 8.8.8.8 0x1d93 Standard query (0)

dcpiconew.ddns.me


Jul 28, 2018 16:53:48.060863018 CEST 192.168.2.2 8.8.8.8 0x7d71 Standard query (0)

dcpiconew.ddns.me


Jul 28, 2018 16:53:49.440210104 CEST 192.168.2.2 8.8.8.8 0xa6a8 Standard query (0)

dcpiconew.ddns.me


Jul 28, 2018 16:53:50.714940071 CEST 192.168.2.2 8.8.8.8 0x9c6 Standard query (0)

dcpiconew.ddns.me


Jul 28, 2018 16:53:52.009888887 CEST 192.168.2.2 8.8.8.8 0xa409 Standard query (0)

dcpiconew.ddns.me


Jul 28, 2018 16:53:53.280365944 CEST 192.168.2.2 8.8.8.8 0xdd8a Standard query (0)

dcpiconew.ddns.me


Jul 28, 2018 16:53:54.567811012 CEST 192.168.2.2 8.8.8.8 0xfd1d Standard query (0)

dcpiconew.ddns.me


Jul 28, 2018 16:53:55.892533064 CEST 192.168.2.2 8.8.8.8 0xc3e5 Standard query (0)

dcpiconew.ddns.me



dcpiconew.ddns.me



dcpiconew.ddns.me


Jul 28, 2018 16:53:59.727968931 CEST 192.168.2.2 8.8.8.8 0x600a Standard query (0)

dcpiconew.ddns.me


Jul 28, 2018 16:54:01.012783051 CEST 192.168.2.2 8.8.8.8 0x45b8 Standard query (0)

dcpiconew.ddns.me



dcpiconew.ddns.me


Jul 28, 2018 16:54:03.564284086 CEST 192.168.2.2 8.8.8.8 0x3ace Standard query (0)

dcpiconew.ddns.me



dcpiconew.ddns.me


Jul 28, 2018 16:54:06.108506918 CEST 192.168.2.2 8.8.8.8 0xc9cb Standard query (0)

dcpiconew.ddns.me


Jul 28, 2018 16:54:07.379065990 CEST 192.168.2.2 8.8.8.8 0x683d Standard query (0)

dcpiconew.ddns.me


Jul 28, 2018 16:54:08.662684917 CEST 192.168.2.2 8.8.8.8 0xf0ee Standard query (0)

dcpiconew.ddns.me


Jul 28, 2018 16:54:09.955468893 CEST 192.168.2.2 8.8.8.8 0x7a16 Standard query (0)

dcpiconew.ddns.me



dcpiconew.ddns.me


Jul 28, 2018 16:54:12.569451094 CEST 192.168.2.2 8.8.8.8 0xdf8b Standard query (0)

dcpiconew.ddns.me


Jul 28, 2018 16:54:13.850972891 CEST 192.168.2.2 8.8.8.8 0x6fcd Standard query (0)

dcpiconew.ddns.me


Jul 28, 2018 16:54:15.123455048 CEST 192.168.2.2 8.8.8.8 0xfe0e Standard query (0)

dcpiconew.ddns.me


Jul 28, 2018 16:54:16.406147957 CEST 192.168.2.2 8.8.8.8 0x2ddd Standard query (0)

dcpiconew.ddns.me


Jul 28, 2018 16:54:17.696930885 CEST 192.168.2.2 8.8.8.8 0xcd4b Standard query (0)

dcpiconew.ddns.me



dcpiconew.ddns.me


Jul 28, 2018 16:54:20.269597054 CEST 192.168.2.2 8.8.8.8 0xed04 Standard query (0)

dcpiconew.ddns.me



dcpiconew.ddns.me



dcpiconew.ddns.me


Jul 28, 2018 16:54:24.086327076 CEST 192.168.2.2 8.8.8.8 0xde08 Standard query (0)

dcpiconew.ddns.me


Jul 28, 2018 16:54:25.368151903 CEST 192.168.2.2 8.8.8.8 0xbf3b Standard query (0)

dcpiconew.ddns.me


Jul 28, 2018 16:54:26.696667910 CEST 192.168.2.2 8.8.8.8 0x62f7 Standard query (0)

dcpiconew.ddns.me


Jul 28, 2018 16:54:27.980077028 CEST 192.168.2.2 8.8.8.8 0x644b Standard query (0)

dcpiconew.ddns.me





dcpiconew.ddns.me


Jul 28, 2018 16:54:30.533129930 CEST 192.168.2.2 8.8.8.8 0xb173 Standard query (0)

dcpiconew.ddns.me


Jul 28, 2018 16:54:31.805951118 CEST 192.168.2.2 8.8.8.8 0x82bd Standard query (0)

dcpiconew.ddns.me


Jul 28, 2018 16:54:33.127824068 CEST 192.168.2.2 8.8.8.8 0x581e Standard query (0)

dcpiconew.ddns.me


Jul 28, 2018 16:54:34.400926113 CEST 192.168.2.2 8.8.8.8 0x5a8e Standard query (0)

dcpiconew.ddns.me


Jul 28, 2018 16:54:35.671713114 CEST 192.168.2.2 8.8.8.8 0x3abd Standard query (0)

dcpiconew.ddns.me



dcpiconew.ddns.me



dcpiconew.ddns.me


Jul 28, 2018 16:54:42.151648045 CEST 192.168.2.2 8.8.8.8 0x145e Standard query (0)

dcpiconew.ddns.me



dcpiconew.ddns.me


Jul 28, 2018 16:54:44.725675106 CEST 192.168.2.2 8.8.8.8 0xf7c Standard query (0)

dcpiconew.ddns.me


Jul 28, 2018 16:54:46.037002087 CEST 192.168.2.2 8.8.8.8 0xd8f1 Standard query (0)

dcpiconew.ddns.me


Jul 28, 2018 16:54:47.319364071 CEST 192.168.2.2 8.8.8.8 0xbf84 Standard query (0)

dcpiconew.ddns.me



dcpiconew.ddns.me


Jul 28, 2018 16:54:49.924047947 CEST 192.168.2.2 8.8.8.8 0x6dea Standard query (0)

dcpiconew.ddns.me


Jul 28, 2018 16:54:51.204914093 CEST 192.168.2.2 8.8.8.8 0xf689 Standard query (0)

dcpiconew.ddns.me


Jul 28, 2018 16:54:52.497864008 CEST 192.168.2.2 8.8.8.8 0x24ea Standard query (0)

dcpiconew.ddns.me



dcpiconew.ddns.me


Jul 28, 2018 16:54:55.080184937 CEST 192.168.2.2 8.8.8.8 0x6ed2 Standard query (0)

dcpiconew.ddns.me



dcpiconew.ddns.me



dcpiconew.ddns.me


Jul 28, 2018 16:54:59.333810091 CEST 192.168.2.2 8.8.8.8 0x924a Standard query (0)

dcpiconew.ddns.me


Jul 28, 2018 16:55:00.606225967 CEST 192.168.2.2 8.8.8.8 0xe37f Standard query (0)

dcpiconew.ddns.me


Jul 28, 2018 16:55:01.909796000 CEST 192.168.2.2 8.8.8.8 0x8b9d Standard query (0)

dcpiconew.ddns.me


Jul 28, 2018 16:55:03.192349911 CEST 192.168.2.2 8.8.8.8 0xb4de Standard query (0)

dcpiconew.ddns.me


Jul 28, 2018 16:55:04.474843025 CEST 192.168.2.2 8.8.8.8 0x6b05 Standard query (0)

dcpiconew.ddns.me



dcpiconew.ddns.me


Jul 28, 2018 16:55:07.027517080 CEST 192.168.2.2 8.8.8.8 0xaecb Standard query (0)

dcpiconew.ddns.me


Jul 28, 2018 16:55:08.317681074 CEST 192.168.2.2 8.8.8.8 0x1b0b Standard query (0)

dcpiconew.ddns.me


Jul 28, 2018 16:55:09.600775003 CEST 192.168.2.2 8.8.8.8 0xef1d Standard query (0)

dcpiconew.ddns.me


Jul 28, 2018 16:55:10.883024931 CEST 192.168.2.2 8.8.8.8 0xaa5f Standard query (0)

dcpiconew.ddns.me


Jul 28, 2018 16:55:12.155435085 CEST 192.168.2.2 8.8.8.8 0x3a5b Standard query (0)

dcpiconew.ddns.me


Jul 28, 2018 16:55:15.030194998 CEST 192.168.2.2 8.8.8.8 0xa9c6 Standard query (0)

dcpiconew.ddns.me


Jul 28, 2018 16:55:16.300254107 CEST 192.168.2.2 8.8.8.8 0xac9c Standard query (0)

dcpiconew.ddns.me


Jul 28, 2018 16:55:17.569968939 CEST 192.168.2.2 8.8.8.8 0xef0 Standard query (0)

dcpiconew.ddns.me


Jul 28, 2018 16:55:18.852302074 CEST 192.168.2.2 8.8.8.8 0x9e24 Standard query (0)

dcpiconew.ddns.me


Jul 28, 2018 16:55:20.136581898 CEST 192.168.2.2 8.8.8.8 0xdfe4 Standard query (0)

dcpiconew.ddns.me




Jul 28, 2018 16:55:21.437165022 CEST 192.168.2.2 8.8.8.8 0xf05e Standard query (0)

dcpiconew.ddns.me


Jul 28, 2018 16:55:22.716200113 CEST 192.168.2.2 8.8.8.8 0x56af Standard query (0)

dcpiconew.ddns.me


Jul 28, 2018 16:55:23.982711077 CEST 192.168.2.2 8.8.8.8 0x7e55 Standard query (0)

dcpiconew.ddns.me



dcpiconew.ddns.me


Jul 28, 2018 16:55:26.525326014 CEST 192.168.2.2 8.8.8.8 0x3bbd Standard query (0)

dcpiconew.ddns.me


Jul 28, 2018 16:55:27.794415951 CEST 192.168.2.2 8.8.8.8 0x58df Standard query (0)

dcpiconew.ddns.me


Jul 28, 2018 16:55:29.069037914 CEST 192.168.2.2 8.8.8.8 0xf6dc Standard query (0)

dcpiconew.ddns.me


Jul 28, 2018 16:55:30.391339064 CEST 192.168.2.2 8.8.8.8 0x27dd Standard query (0)

dcpiconew.ddns.me



dcpiconew.ddns.me



dcpiconew.ddns.me



dcpiconew.ddns.me



dcpiconew.ddns.me


Jul 28, 2018 16:55:36.780378103 CEST 192.168.2.2 8.8.8.8 0xdd92 Standard query (0)

dcpiconew.ddns.me


Jul 28, 2018 16:55:38.051469088 CEST 192.168.2.2 8.8.8.8 0x6ab1 Standard query (0)

dcpiconew.ddns.me



dcpiconew.ddns.me


Jul 28, 2018 16:55:40.605597019 CEST 192.168.2.2 8.8.8.8 0xa38d Standard query (0)

dcpiconew.ddns.me



dcpiconew.ddns.me


Jul 28, 2018 16:55:43.141112089 CEST 192.168.2.2 8.8.8.8 0x743c Standard query (0)

dcpiconew.ddns.me



Timestamp Source IP Dest IP Trans ID Replay Code Name CName Address Type Class

Jul 28, 2018 16:53:40.289809942 CEST

8.8.8.8 192.168.2.2 0xfc1 No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:53:41.656985998 CEST

8.8.8.8 192.168.2.2 0xad0d No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:53:42.956001997 CEST

8.8.8.8 192.168.2.2 0xc872 No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:53:44.246260881 CEST

8.8.8.8 192.168.2.2 0xa1a4 No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:53:45.538414001 CEST

8.8.8.8 192.168.2.2 0x5472 No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:53:46.805017948 CEST

8.8.8.8 192.168.2.2 0x1d93 No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:53:48.099422932 CEST

8.8.8.8 192.168.2.2 0x7d71 No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:53:49.453116894 CEST

8.8.8.8 192.168.2.2 0xa6a8 No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:53:50.743074894 CEST

8.8.8.8 192.168.2.2 0x9c6 No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:53:52.023118019 CEST

8.8.8.8 192.168.2.2 0xa409 No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:53:53.308398962 CEST

8.8.8.8 192.168.2.2 0xdd8a No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:53:54.581576109 CEST

8.8.8.8 192.168.2.2 0xfd1d No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

DNS Answers


Jul 28, 2018 16:53:55.905730009 CEST

8.8.8.8 192.168.2.2 0xc3e5 No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:53:57.179740906 CEST


213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:53:58.462502003 CEST


213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:53:59.755918980 CEST

8.8.8.8 192.168.2.2 0x600a No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:54:01.027308941 CEST

8.8.8.8 192.168.2.2 0x45b8 No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:54:02.308679104 CEST


213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:54:03.578180075 CEST

8.8.8.8 192.168.2.2 0x3ace No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:54:04.847754955 CEST


213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:54:06.122287035 CEST

8.8.8.8 192.168.2.2 0xc9cb No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:54:07.392807007 CEST

8.8.8.8 192.168.2.2 0x683d No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:54:08.676893950 CEST

8.8.8.8 192.168.2.2 0xf0ee No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:54:09.969798088 CEST

8.8.8.8 192.168.2.2 0x7a16 No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:54:11.305902004 CEST


213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:54:12.583128929 CEST

8.8.8.8 192.168.2.2 0xdf8b No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:54:13.864027977 CEST

8.8.8.8 192.168.2.2 0x6fcd No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:54:15.137018919 CEST

8.8.8.8 192.168.2.2 0xfe0e No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:54:16.420468092 CEST

8.8.8.8 192.168.2.2 0x2ddd No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:54:17.710144997 CEST

8.8.8.8 192.168.2.2 0xcd4b No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:54:19.003176928 CEST


213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:54:20.283694029 CEST

8.8.8.8 192.168.2.2 0xed04 No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:54:21.555753946 CEST


213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:54:22.826834917 CEST


213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:54:24.099877119 CEST

8.8.8.8 192.168.2.2 0xde08 No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:54:25.381920099 CEST

8.8.8.8 192.168.2.2 0xbf3b No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:54:26.724555969 CEST

8.8.8.8 192.168.2.2 0x62f7 No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:54:27.993844986 CEST

8.8.8.8 192.168.2.2 0x644b No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)



Jul 28, 2018 16:54:29.267262936 CEST


213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:54:30.546283007 CEST

8.8.8.8 192.168.2.2 0xb173 No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:54:31.819585085 CEST

8.8.8.8 192.168.2.2 0x82bd No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:54:33.140887022 CEST

8.8.8.8 192.168.2.2 0x581e No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:54:34.414535046 CEST

8.8.8.8 192.168.2.2 0x5a8e No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:54:35.685591936 CEST

8.8.8.8 192.168.2.2 0x3abd No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:54:36.956442118 CEST


213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:54:40.853554010 CEST


213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:54:42.179446936 CEST

8.8.8.8 192.168.2.2 0x145e No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:54:43.467886925 CEST


213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:54:44.768603086 CEST

8.8.8.8 192.168.2.2 0xf7c No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:54:46.050968885 CEST

8.8.8.8 192.168.2.2 0xd8f1 No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:54:47.333059072 CEST

8.8.8.8 192.168.2.2 0xbf84 No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:54:48.658801079 CEST


213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:54:49.937834978 CEST

8.8.8.8 192.168.2.2 0x6dea No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:54:51.237368107 CEST

8.8.8.8 192.168.2.2 0xf689 No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:54:52.525909901 CEST

8.8.8.8 192.168.2.2 0x24ea No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:54:53.816133022 CEST


213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:54:58.011504889 CEST

8.8.8.8 192.168.2.2 0x6ed2 No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:54:58.011523962 CEST


213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:54:58.011575937 CEST


213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:54:59.346910000 CEST

8.8.8.8 192.168.2.2 0x924a No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:55:00.634890079 CEST

8.8.8.8 192.168.2.2 0xe37f No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:55:01.923397064 CEST

8.8.8.8 192.168.2.2 0x8b9d No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:55:03.206060886 CEST

8.8.8.8 192.168.2.2 0xb4de No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:55:04.488651991 CEST

8.8.8.8 192.168.2.2 0x6b05 No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)



Jul 28, 2018 16:55:05.759233952 CEST


213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:55:07.041001081 CEST

8.8.8.8 192.168.2.2 0xaecb No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:55:08.345282078 CEST

8.8.8.8 192.168.2.2 0x1b0b No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:55:09.614770889 CEST

8.8.8.8 192.168.2.2 0xef1d No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:55:10.896838903 CEST

8.8.8.8 192.168.2.2 0xaa5f No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:55:12.169066906 CEST

8.8.8.8 192.168.2.2 0x3a5b No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:55:15.044025898 CEST

8.8.8.8 192.168.2.2 0xa9c6 No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:55:16.313400030 CEST

8.8.8.8 192.168.2.2 0xac9c No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:55:17.583223104 CEST

8.8.8.8 192.168.2.2 0xef0 No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:55:18.865550041 CEST

8.8.8.8 192.168.2.2 0x9e24 No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:55:20.150567055 CEST

8.8.8.8 192.168.2.2 0xdfe4 No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:55:21.450452089 CEST

8.8.8.8 192.168.2.2 0xf05e No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:55:22.729310036 CEST

8.8.8.8 192.168.2.2 0x56af No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:55:23.995711088 CEST

8.8.8.8 192.168.2.2 0x7e55 No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:55:25.268090963 CEST


213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:55:26.539007902 CEST

8.8.8.8 192.168.2.2 0x3bbd No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:55:27.807468891 CEST

8.8.8.8 192.168.2.2 0x58df No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:55:29.082689047 CEST

8.8.8.8 192.168.2.2 0xf6dc No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:55:30.404520988 CEST

8.8.8.8 192.168.2.2 0x27dd No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:55:31.686408997 CEST


213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:55:32.955909014 CEST


213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:55:34.231218100 CEST


213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:55:35.511885881 CEST


213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:55:36.793442965 CEST

8.8.8.8 192.168.2.2 0xdd92 No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:55:38.064651966 CEST

8.8.8.8 192.168.2.2 0x6ab1 No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:55:39.347166061 CEST


213.183.40.43 A (IP address) IN (0x0001)



Code Manipulations

Statistics

Behavior

• IMG-FILE-093298393840933-09208…

• IMG-FILE-093298393840933-09208…

Click to jump to process

System Behavior

Jul 28, 2018 16:55:40.619220018 CEST

8.8.8.8 192.168.2.2 0xa38d No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:55:41.883240938 CEST


213.183.40.43 A (IP address) IN (0x0001)

Jul 28, 2018 16:55:43.169612885 CEST

8.8.8.8 192.168.2.2 0x743c No error (0) dcpiconew.ddns.me

213.183.40.43 A (IP address) IN (0x0001)



Start date: 28/07/2018

Path: C:\Users\user\Desktop\IMG-FILE-093298393840933-09208438039039-023outputA4DB4EF.exe

Wow64 process (32bit): false

Commandline: 'C:\Users\user\Desktop\IMG-FILE-093298393840933-09208438039039-023outputA4DB4EF.exe'

Imagebase: 0x400000

File size: 921615 bytes

MD5 hash: 88E0BC064945FA01C3B2745AC3633836

Has administrator privileges: true

Programmed in: Visual Basic

Yara matches: Rule: RAT_DarkComet, Description: Detects DarkComet RAT, Source: 00000001.00000002.21009140944.02716000.00000040.sdmp, Author: Kevin Breen <[email protected]>Rule: Malware_QA_update, Description: VT Research QA uploaded malware - file update.exe, Source: 00000001.00000002.21009140944.02716000.00000040.sdmp, Author: Florian Roth

Analysis Process: IMG-FILE-093298393840933-09208438039039-023outputA4DB4EF.exe PID: 3440 Parent PID: 3040Analysis Process: IMG-FILE-093298393840933-09208438039039-023outputA4DB4EF.exe PID: 3440 Parent PID: 3040

General


File ActivitiesFile Activities

Reputation: low

File Path Offset Length Completion CountSourceAddress Symbol

File ActivitiesFile Activities


Start date: 28/07/2018

Path: C:\Users\user\Desktop\IMG-FILE-093298393840933-09208438039039-023outputA4DB4EF.exe

Wow64 process (32bit): false

Commandline: 'C:\Users\user\Desktop\IMG-FILE-093298393840933-09208438039039-023outputA4DB4EF.exe'

Imagebase: 0x400000

File size: 921615 bytes

MD5 hash: 88E0BC064945FA01C3B2745AC3633836

Has administrator privileges: true

Programmed in: Borland Delphi

Yara matches: Rule: RAT_DarkComet, Description: Detects DarkComet RAT, Source: 00000002.00000002.21438435290.00400000.00000040.sdmp, Author: Kevin Breen <[email protected]>Rule: Malware_QA_update, Description: VT Research QA uploaded malware - file update.exe, Source: 00000002.00000002.21438435290.00400000.00000040.sdmp, Author: Florian RothRule: RAT_DarkComet, Description: Detects DarkComet RAT, Source: 00000002.00000000.21002926082.00400000.00000040.sdmp, Author: Kevin Breen <[email protected]>Rule: Malware_QA_update, Description: VT Research QA uploaded malware - file update.exe, Source: 00000002.00000000.21002926082.00400000.00000040.sdmp, Author: Florian RothRule: RAT_DarkComet, Description: Detects DarkComet RAT, Source: 00000002.00000001.21003500223.00400000.00000040.sdmp, Author: Kevin Breen <[email protected]>Rule: Malware_QA_update, Description: VT Research QA uploaded malware - file update.exe, Source: 00000002.00000001.21003500223.00400000.00000040.sdmp, Author: Florian RothRule: RAT_DarkComet, Description: Detects DarkComet RAT, Source: 00000002.00000000.21003186223.00400000.00000040.sdmp, Author: Kevin Breen <[email protected]>Rule: Malware_QA_update, Description: VT Research QA uploaded malware - file update.exe, Source: 00000002.00000000.21003186223.00400000.00000040.sdmp, Author: Florian Roth

Reputation: low

File Path Access Attributes Options Completion CountSourceAddress Symbol

C:\Users\user\AppData\Roaming\dclogs read data or list directory | synchronize

normal directory file | synchronous io non alert | open for backup ident | open reparse point

success or wait 1 40A85E CreateDirectoryA

C:\Users\user\AppData\Roaming\dclogs\2018-07-28-7.dc read attributes | synchronize | generic write

normal synchronous io non alert | non directory file

success or wait 1 403651 CreateFileA

File Path Offset Length Value Ascii Completion CountSourceAddress Symbol

Analysis Process: IMG-FILE-093298393840933-09208438039039-023outputA4DB4EF.exe PID: 3476 Parent PID: 3440Analysis Process: IMG-FILE-093298393840933-09208438039039-023outputA4DB4EF.exe PID: 3476 Parent PID: 3440

General

File CreatedFile Created

File WrittenFile Written


Disassembly

Code Analysis

Registry ActivitiesRegistry Activities

C:\Users\user\AppData\Roaming\dclogs\2018-07-28-7.dc unknown 42 3a 3a 20 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 20 28 34 3a 35 34 3a 32 38 20 50 4d 29 0d 0a 5b 45 53 43 5d 0d 0a 0d 0a

:: Program Manager (4:54:28 PM)..[ESC]....

success or wait 2 40357C WriteFile

File Path Offset Length Value Ascii Completion CountSourceAddress Symbol

File Path Offset Length Completion CountSourceAddress Symbol

C:\Users\user\AppData\Roaming\dclogs\2018-07-28-7.dc unknown 128 success or wait 1 4036B2 ReadFile

Key Path Completion CountSourceAddress Symbol

HKEY_USERS\Software\DC3_FEXEC success or wait 1 421884 RegCreateKeyExA

File ReadFile Read

Key CreatedKey Created


Documents

Automated Malware Analysis Report for IMG-FILE