Play interactive tour

Edit tour

Windows Analysis Report XdPHZWGz4k.exe

Overview

General Information

Sample Name:	XdPHZWGz4k.exe
Analysis ID:	477026
MD5:	e9a07674a035bb2a1e4f233c41269edd
SHA1:	503908c418187bfc8f48533338aed01e667bf5fa
SHA256:	c2603d684ad273865985ea6e7ce27c9236e173d7633a72f2378a1309d9ec77ac
Tags:	exe
Infos:
Most interesting Screenshot:

Detection

MercurialGrabber

Score:	78
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Yara detected MercurialGrabber

Queries memory information (via WMI often done to detect virtual machines)

Machine Learning detection for sample

May check the online IP address of the machine

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Machine Learning detection for dropped file

C2 URLs / IPs found in malware configuration

Tries to harvest and steal browser information (history, passwords, etc)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

JA3 SSL client fingerprint seen in connection with other malware

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Uses insecure TLS / SSL version for HTTPS connection

Contains long sleeps (>= 3 min)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Queries information about the installed CPU (vendor, model number etc)

Queries the product ID of Windows

Sample file is different than original file name gathered from version info

Drops PE files

Contains capabilities to detect virtual machines

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Uses Microsoft's Enhanced Cryptographic Provider

Classification

Process Tree

System is w10x64

XdPHZWGz4k.exe (PID: 6384 cmdline: 'C:\Users\user\Desktop\XdPHZWGz4k.exe' MD5: E9A07674A035BB2A1E4F233C41269EDD)

conhost.exe (PID: 6424 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

XdPHZWGz4k.exe (PID: 3208 cmdline: 'C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe' MD5: E9A07674A035BB2A1E4F233C41269EDD)

conhost.exe (PID: 5116 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

XdPHZWGz4k.exe (PID: 6372 cmdline: 'C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe' MD5: E9A07674A035BB2A1E4F233C41269EDD)

conhost.exe (PID: 6320 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

Threatname: MercurialGrabber

{"Webhook Url": "https://discord.com/api/webhooks/882954273980284939/Oo5CKwHMkILgJiucQhx_aJyEIHFxNaStS_Rgc-0H9Qm-hz7qs9oDqPvJxh_FmBs3dflH"}

Yara Overview

Initial Sample

Source	Rule	Description	Author	Strings
XdPHZWGz4k.exe	JoeSecurity_MercurialGrabber	Yara detected MercurialGrabber	Joe Security
XdPHZWGz4k.exe	MAL_Luna_Stealer_Apr_2021_1	Detect Luna stealer (also Mercurial Grabber)	Arkbird_SOLG	0xb18:$s1: 73 40 00 00 0A 0B 07 72 D9 0B 00 70 02 7B 07 00 00 04 28 13 00 00 0A 6F 41 00 00 0A 0C 08 6F 42 ... 0x1d44:$s2: 72 24 18 00 70 02 7B 36 00 00 04 28 2F 00 00 06 0A 02 72 36 18 00 70 02 7B 36 00 00 04 28 2F 00 ... 0x1f48:$s3: 72 0A 19 00 70 73 81 00 00 0A 0A 06 6F 82 00 00 0A 6F 83 00 00 0A 0C 2B 75 08 6F 84 00 00 0A 74 ... 0x7b67:$x1: ---------------- mercurial grabber ---------------- 0x7daf:$x2: 5C 00 73 00 2A 00 3A 00 5C 00 73 00 2A 00 28 00 22 00 28 00 3F 00 3A 00 5C 00 5C 00 22 00 7C 00 ... 0x7fc9:$x3: 5B 00 5C 00 77 00 2D 00 5D 00 7B 00 32 00 34 00 7D 00 5C 00 2E 00 5B 00 5C 00 77 00 2D 00 5D 00 ...

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	JoeSecurity_MercurialGrabber	Yara detected MercurialGrabber	Joe Security
C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	MAL_Luna_Stealer_Apr_2021_1	Detect Luna stealer (also Mercurial Grabber)	Arkbird_SOLG	0xb18:$s1: 73 40 00 00 0A 0B 07 72 D9 0B 00 70 02 7B 07 00 00 04 28 13 00 00 0A 6F 41 00 00 0A 0C 08 6F 42 ... 0x1d44:$s2: 72 24 18 00 70 02 7B 36 00 00 04 28 2F 00 00 06 0A 02 72 36 18 00 70 02 7B 36 00 00 04 28 2F 00 ... 0x1f48:$s3: 72 0A 19 00 70 73 81 00 00 0A 0A 06 6F 82 00 00 0A 6F 83 00 00 0A 0C 2B 75 08 6F 84 00 00 0A 74 ... 0x7b67:$x1: ---------------- mercurial grabber ---------------- 0x7daf:$x2: 5C 00 73 00 2A 00 3A 00 5C 00 73 00 2A 00 28 00 22 00 28 00 3F 00 3A 00 5C 00 5C 00 22 00 7C 00 ... 0x7fc9:$x3: 5B 00 5C 00 77 00 2D 00 5D 00 7B 00 32 00 34 00 7D 00 5C 00 2E 00 5B 00 5C 00 77 00 2D 00 5D 00 ...

Memory Dumps

Source	Rule	Description	Author
0000000C.00000000.298642309.0000000000BC2000.00000002.00020000.sdmp	JoeSecurity_MercurialGrabber	Yara detected MercurialGrabber	Joe Security
00000010.00000002.339741238.0000000000AF2000.00000002.00020000.sdmp	JoeSecurity_MercurialGrabber	Yara detected MercurialGrabber	Joe Security
00000001.00000002.273139663.00000000003A2000.00000002.00020000.sdmp	JoeSecurity_MercurialGrabber	Yara detected MercurialGrabber	Joe Security
00000010.00000000.315911277.0000000000AF2000.00000002.00020000.sdmp	JoeSecurity_MercurialGrabber	Yara detected MercurialGrabber	Joe Security
00000001.00000000.253502407.00000000003A2000.00000002.00020000.sdmp	JoeSecurity_MercurialGrabber	Yara detected MercurialGrabber	Joe Security
0000000C.00000002.318186750.0000000000BC2000.00000002.00020000.sdmp	JoeSecurity_MercurialGrabber	Yara detected MercurialGrabber	Joe Security
00000001.00000003.272744068.000000001C9D5000.00000004.00000001.sdmp	JoeSecurity_MercurialGrabber	Yara detected MercurialGrabber	Joe Security
Process Memory Space: XdPHZWGz4k.exe PID: 6384	JoeSecurity_MercurialGrabber	Yara detected MercurialGrabber	Joe Security
Process Memory Space: XdPHZWGz4k.exe PID: 3208	JoeSecurity_MercurialGrabber	Yara detected MercurialGrabber	Joe Security
Process Memory Space: XdPHZWGz4k.exe PID: 6372	JoeSecurity_MercurialGrabber	Yara detected MercurialGrabber	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
12.2.XdPHZWGz4k.exe.bc0000.0.unpack	JoeSecurity_MercurialGrabber	Yara detected MercurialGrabber	Joe Security
12.2.XdPHZWGz4k.exe.bc0000.0.unpack	MAL_Luna_Stealer_Apr_2021_1	Detect Luna stealer (also Mercurial Grabber)	Arkbird_SOLG	0xb18:$s1: 73 40 00 00 0A 0B 07 72 D9 0B 00 70 02 7B 07 00 00 04 28 13 00 00 0A 6F 41 00 00 0A 0C 08 6F 42 ... 0x1d44:$s2: 72 24 18 00 70 02 7B 36 00 00 04 28 2F 00 00 06 0A 02 72 36 18 00 70 02 7B 36 00 00 04 28 2F 00 ... 0x1f48:$s3: 72 0A 19 00 70 73 81 00 00 0A 0A 06 6F 82 00 00 0A 6F 83 00 00 0A 0C 2B 75 08 6F 84 00 00 0A 74 ... 0x7b67:$x1: ---------------- mercurial grabber ---------------- 0x7daf:$x2: 5C 00 73 00 2A 00 3A 00 5C 00 73 00 2A 00 28 00 22 00 28 00 3F 00 3A 00 5C 00 5C 00 22 00 7C 00 ... 0x7fc9:$x3: 5B 00 5C 00 77 00 2D 00 5D 00 7B 00 32 00 34 00 7D 00 5C 00 2E 00 5B 00 5C 00 77 00 2D 00 5D 00 ...
1.0.XdPHZWGz4k.exe.3a0000.0.unpack	JoeSecurity_MercurialGrabber	Yara detected MercurialGrabber	Joe Security
16.2.XdPHZWGz4k.exe.af0000.0.unpack	JoeSecurity_MercurialGrabber	Yara detected MercurialGrabber	Joe Security
1.0.XdPHZWGz4k.exe.3a0000.0.unpack	MAL_Luna_Stealer_Apr_2021_1	Detect Luna stealer (also Mercurial Grabber)	Arkbird_SOLG	0xb18:$s1: 73 40 00 00 0A 0B 07 72 D9 0B 00 70 02 7B 07 00 00 04 28 13 00 00 0A 6F 41 00 00 0A 0C 08 6F 42 ... 0x1d44:$s2: 72 24 18 00 70 02 7B 36 00 00 04 28 2F 00 00 06 0A 02 72 36 18 00 70 02 7B 36 00 00 04 28 2F 00 ... 0x1f48:$s3: 72 0A 19 00 70 73 81 00 00 0A 0A 06 6F 82 00 00 0A 6F 83 00 00 0A 0C 2B 75 08 6F 84 00 00 0A 74 ... 0x7b67:$x1: ---------------- mercurial grabber ---------------- 0x7daf:$x2: 5C 00 73 00 2A 00 3A 00 5C 00 73 00 2A 00 28 00 22 00 28 00 3F 00 3A 00 5C 00 5C 00 22 00 7C 00 ... 0x7fc9:$x3: 5B 00 5C 00 77 00 2D 00 5D 00 7B 00 32 00 34 00 7D 00 5C 00 2E 00 5B 00 5C 00 77 00 2D 00 5D 00 ...
16.2.XdPHZWGz4k.exe.af0000.0.unpack	MAL_Luna_Stealer_Apr_2021_1	Detect Luna stealer (also Mercurial Grabber)	Arkbird_SOLG	0xb18:$s1: 73 40 00 00 0A 0B 07 72 D9 0B 00 70 02 7B 07 00 00 04 28 13 00 00 0A 6F 41 00 00 0A 0C 08 6F 42 ... 0x1d44:$s2: 72 24 18 00 70 02 7B 36 00 00 04 28 2F 00 00 06 0A 02 72 36 18 00 70 02 7B 36 00 00 04 28 2F 00 ... 0x1f48:$s3: 72 0A 19 00 70 73 81 00 00 0A 0A 06 6F 82 00 00 0A 6F 83 00 00 0A 0C 2B 75 08 6F 84 00 00 0A 74 ... 0x7b67:$x1: ---------------- mercurial grabber ---------------- 0x7daf:$x2: 5C 00 73 00 2A 00 3A 00 5C 00 73 00 2A 00 28 00 22 00 28 00 3F 00 3A 00 5C 00 5C 00 22 00 7C 00 ... 0x7fc9:$x3: 5B 00 5C 00 77 00 2D 00 5D 00 7B 00 32 00 34 00 7D 00 5C 00 2E 00 5B 00 5C 00 77 00 2D 00 5D 00 ...
1.2.XdPHZWGz4k.exe.3a0000.0.unpack	JoeSecurity_MercurialGrabber	Yara detected MercurialGrabber	Joe Security
1.2.XdPHZWGz4k.exe.3a0000.0.unpack	MAL_Luna_Stealer_Apr_2021_1	Detect Luna stealer (also Mercurial Grabber)	Arkbird_SOLG	0xb18:$s1: 73 40 00 00 0A 0B 07 72 D9 0B 00 70 02 7B 07 00 00 04 28 13 00 00 0A 6F 41 00 00 0A 0C 08 6F 42 ... 0x1d44:$s2: 72 24 18 00 70 02 7B 36 00 00 04 28 2F 00 00 06 0A 02 72 36 18 00 70 02 7B 36 00 00 04 28 2F 00 ... 0x1f48:$s3: 72 0A 19 00 70 73 81 00 00 0A 0A 06 6F 82 00 00 0A 6F 83 00 00 0A 0C 2B 75 08 6F 84 00 00 0A 74 ... 0x7b67:$x1: ---------------- mercurial grabber ---------------- 0x7daf:$x2: 5C 00 73 00 2A 00 3A 00 5C 00 73 00 2A 00 28 00 22 00 28 00 3F 00 3A 00 5C 00 5C 00 22 00 7C 00 ... 0x7fc9:$x3: 5B 00 5C 00 77 00 2D 00 5D 00 7B 00 32 00 34 00 7D 00 5C 00 2E 00 5B 00 5C 00 77 00 2D 00 5D 00 ...
12.0.XdPHZWGz4k.exe.bc0000.0.unpack	JoeSecurity_MercurialGrabber	Yara detected MercurialGrabber	Joe Security
12.0.XdPHZWGz4k.exe.bc0000.0.unpack	MAL_Luna_Stealer_Apr_2021_1	Detect Luna stealer (also Mercurial Grabber)	Arkbird_SOLG	0xb18:$s1: 73 40 00 00 0A 0B 07 72 D9 0B 00 70 02 7B 07 00 00 04 28 13 00 00 0A 6F 41 00 00 0A 0C 08 6F 42 ... 0x1d44:$s2: 72 24 18 00 70 02 7B 36 00 00 04 28 2F 00 00 06 0A 02 72 36 18 00 70 02 7B 36 00 00 04 28 2F 00 ... 0x1f48:$s3: 72 0A 19 00 70 73 81 00 00 0A 0A 06 6F 82 00 00 0A 6F 83 00 00 0A 0C 2B 75 08 6F 84 00 00 0A 74 ... 0x7b67:$x1: ---------------- mercurial grabber ---------------- 0x7daf:$x2: 5C 00 73 00 2A 00 3A 00 5C 00 73 00 2A 00 28 00 22 00 28 00 3F 00 3A 00 5C 00 5C 00 22 00 7C 00 ... 0x7fc9:$x3: 5B 00 5C 00 77 00 2D 00 5D 00 7B 00 32 00 34 00 7D 00 5C 00 2E 00 5B 00 5C 00 77 00 2D 00 5D 00 ...
16.0.XdPHZWGz4k.exe.af0000.0.unpack	JoeSecurity_MercurialGrabber	Yara detected MercurialGrabber	Joe Security
16.0.XdPHZWGz4k.exe.af0000.0.unpack	MAL_Luna_Stealer_Apr_2021_1	Detect Luna stealer (also Mercurial Grabber)	Arkbird_SOLG	0xb18:$s1: 73 40 00 00 0A 0B 07 72 D9 0B 00 70 02 7B 07 00 00 04 28 13 00 00 0A 6F 41 00 00 0A 0C 08 6F 42 ... 0x1d44:$s2: 72 24 18 00 70 02 7B 36 00 00 04 28 2F 00 00 06 0A 02 72 36 18 00 70 02 7B 36 00 00 04 28 2F 00 ... 0x1f48:$s3: 72 0A 19 00 70 73 81 00 00 0A 0A 06 6F 82 00 00 0A 6F 83 00 00 0A 0C 2B 75 08 6F 84 00 00 0A 74 ... 0x7b67:$x1: ---------------- mercurial grabber ---------------- 0x7daf:$x2: 5C 00 73 00 2A 00 3A 00 5C 00 73 00 2A 00 28 00 22 00 28 00 3F 00 3A 00 5C 00 5C 00 22 00 7C 00 ... 0x7fc9:$x3: 5B 00 5C 00 77 00 2D 00 5D 00 7B 00 32 00 34 00 7D 00 5C 00 2E 00 5B 00 5C 00 77 00 2D 00 5D 00 ...
Click to see the 7 entries

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 12.2.XdPHZWGz4k.exe.bc0000.0.unpack

Malware Configuration Extractor: MercurialGrabber {"Webhook Url": "https://discord.com/api/webhooks/882954273980284939/Oo5CKwHMkILgJiucQhx_aJyEIHFxNaStS_Rgc-0H9Qm-hz7qs9oDqPvJxh_FmBs3dflH"}

Multi AV Scanner detection for submitted file

Show sources

Source: XdPHZWGz4k.exe

Virustotal: Detection: 53%

Perma Link

Yara detected MercurialGrabber

Show sources

Source: Yara match	File source: XdPHZWGz4k.exe, type: SAMPLE
Source: Yara match	File source: 12.2.XdPHZWGz4k.exe.bc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.XdPHZWGz4k.exe.3a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.XdPHZWGz4k.exe.af0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.XdPHZWGz4k.exe.3a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.XdPHZWGz4k.exe.bc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.0.XdPHZWGz4k.exe.af0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000000.298642309.0000000000BC2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.339741238.0000000000AF2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.273139663.00000000003A2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000000.315911277.0000000000AF2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.253502407.00000000003A2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.318186750.0000000000BC2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.272744068.000000001C9D5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: XdPHZWGz4k.exe PID: 6384, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: XdPHZWGz4k.exe PID: 3208, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: XdPHZWGz4k.exe PID: 6372, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe, type: DROPPED

Machine Learning detection for sample

Show sources

Source: XdPHZWGz4k.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Code function: 1_2_00007FFA1680B24E CryptUnprotectData,	1_2_00007FFA1680B24E
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Code function: 12_2_00007FFA1658B25E CryptUnprotectData,	12_2_00007FFA1658B25E
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Code function: 16_2_00007FFA165AB24E CryptUnprotectData,	16_2_00007FFA165AB24E

Source: XdPHZWGz4k.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: unknown	HTTPS traffic detected: 23.128.64.141:443 -> 192.168.2.5:49703 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 162.159.136.232:443 -> 192.168.2.5:49706 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 23.128.64.141:443 -> 192.168.2.5:49709 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 162.159.136.232:443 -> 192.168.2.5:49711 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 23.128.64.141:443 -> 192.168.2.5:49714 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 162.159.136.232:443 -> 192.168.2.5:49716 version: TLS 1.0

Source: XdPHZWGz4k.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	File opened: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\6d7d43e19d7fc0006285b85b7e2c8702\System.Windows.Forms.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	File opened: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\4e05e2e48b8a6dd267a8c9e25ef129a7\System.Core.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	File opened: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\49e5c0579db170be9741dccc34c1998e\System.Drawing.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	File opened: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	File opened: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	File opened: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Net.Http\a0f6e3585453700574fc42ba3653c021\System.Net.Http.ni.dll	Jump to behavior

Networking:

May check the online IP address of the machine

Show sources

Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	DNS query: name: ip-api.com
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	DNS query: name: ip-api.com
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	DNS query: name: ip-api.com

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: https://discord.com/api/webhooks/882954273980284939/Oo5CKwHMkILgJiucQhx_aJyEIHFxNaStS_Rgc-0H9Qm-hz7qs9oDqPvJxh_FmBs3dflH

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: global traffic	HTTP traffic detected: GET //json/84.17.52.41 HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET //json/84.17.52.41 HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET //json/84.17.52.41 HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1

Source: unknown	HTTPS traffic detected: 23.128.64.141:443 -> 192.168.2.5:49703 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 162.159.136.232:443 -> 192.168.2.5:49706 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 23.128.64.141:443 -> 192.168.2.5:49709 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 162.159.136.232:443 -> 192.168.2.5:49711 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 23.128.64.141:443 -> 192.168.2.5:49714 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 162.159.136.232:443 -> 192.168.2.5:49716 version: TLS 1.0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714

Source: XdPHZWGz4k.exe, 00000001.00000003.272829886.000000001C984000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 0000000C.00000002.321493569.000000001CFC0000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 00000010.00000002.340329280.000000000304D000.00000004.00000001.sdmp	String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c0
Source: XdPHZWGz4k.exe, 00000001.00000002.274406226.00000000026AA000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 0000000C.00000003.318001084.000000001D007000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 00000010.00000002.340408555.000000000308A000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/CloudflareIncRSACA-2.crt0
Source: XdPHZWGz4k.exe, 00000001.00000002.274321032.000000000267E000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 0000000C.00000002.321493569.000000001CFC0000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 00000010.00000002.340329280.000000000304D000.00000004.00000001.sdmp	String found in binary or memory: http://cps.letsencrypt.org0
Source: XdPHZWGz4k.exe, 00000001.00000003.272829886.000000001C984000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 0000000C.00000002.321493569.000000001CFC0000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 00000010.00000002.340329280.000000000304D000.00000004.00000001.sdmp	String found in binary or memory: http://cps.root-x1.letsencrypt.org0
Source: XdPHZWGz4k.exe, 00000001.00000003.272829886.000000001C984000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 0000000C.00000002.321493569.000000001CFC0000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 00000010.00000002.340329280.000000000304D000.00000004.00000001.sdmp	String found in binary or memory: http://crl.identrust.com/DSTROOTCAX3CRL.crl0
Source: XdPHZWGz4k.exe, 00000001.00000002.274406226.00000000026AA000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 0000000C.00000003.318001084.000000001D007000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 00000010.00000002.340408555.000000000308A000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/CloudflareIncRSACA-2.crl07
Source: XdPHZWGz4k.exe, 00000001.00000002.274406226.00000000026AA000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 0000000C.00000003.318001084.000000001D007000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 00000010.00000002.340408555.000000000308A000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0m
Source: XdPHZWGz4k.exe, 00000010.00000002.343098466.000000001D0D3000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digic
Source: XdPHZWGz4k.exe, 00000001.00000002.274406226.00000000026AA000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 0000000C.00000003.318001084.000000001D007000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 00000010.00000002.340408555.000000000308A000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/CloudflareIncRSACA-2.crl0
Source: XdPHZWGz4k.exe, 00000001.00000002.274406226.00000000026AA000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 0000000C.00000002.319503161.0000000002E58000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 00000010.00000002.340408555.000000000308A000.00000004.00000001.sdmp	String found in binary or memory: http://discord.com
Source: XdPHZWGz4k.exe, 00000001.00000003.272968518.00000000007F9000.00000004.00000001.sdmp	String found in binary or memory: http://go.micz
Source: XdPHZWGz4k.exe, 00000001.00000002.274271699.000000000264C000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 0000000C.00000002.319475097.0000000002E4B000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 00000010.00000002.340329280.000000000304D000.00000004.00000001.sdmp	String found in binary or memory: http://ip-api.com
Source: XdPHZWGz4k.exe	String found in binary or memory: http://ip-api.com//json/
Source: XdPHZWGz4k.exe, 00000001.00000002.274383164.00000000026A4000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 0000000C.00000002.319475097.0000000002E4B000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 00000010.00000002.340390852.0000000003081000.00000004.00000001.sdmp	String found in binary or memory: http://ip-api.com//json/84.17.52.41
Source: XdPHZWGz4k.exe, 00000001.00000002.274271699.000000000264C000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 0000000C.00000002.319342827.0000000002E1D000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 00000010.00000002.340329280.000000000304D000.00000004.00000001.sdmp	String found in binary or memory: http://ip-api.comx
Source: XdPHZWGz4k.exe, 00000001.00000002.274298274.000000000266D000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 0000000C.00000002.319342827.0000000002E1D000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 00000010.00000002.340329280.000000000304D000.00000004.00000001.sdmp	String found in binary or memory: http://ip4.seeip.org
Source: XdPHZWGz4k.exe, 00000001.00000002.274406226.00000000026AA000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 0000000C.00000003.318001084.000000001D007000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 00000010.00000002.340408555.000000000308A000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: XdPHZWGz4k.exe, 00000001.00000002.274406226.00000000026AA000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 0000000C.00000003.318001084.000000001D007000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 00000010.00000002.340408555.000000000308A000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0:
Source: XdPHZWGz4k.exe, 00000001.00000002.274321032.000000000267E000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 0000000C.00000002.321493569.000000001CFC0000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 00000010.00000002.340329280.000000000304D000.00000004.00000001.sdmp	String found in binary or memory: http://r3.i.lencr.org/05
Source: XdPHZWGz4k.exe, 00000001.00000002.274321032.000000000267E000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 0000000C.00000002.321493569.000000001CFC0000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 00000010.00000002.340329280.000000000304D000.00000004.00000001.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: XdPHZWGz4k.exe, 00000001.00000002.274271699.000000000264C000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 0000000C.00000002.319252949.0000000002DF9000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 00000010.00000002.340284669.0000000003029000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: XdPHZWGz4k.exe, 00000001.00000002.274406226.00000000026AA000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 0000000C.00000003.318001084.000000001D007000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 00000010.00000002.340408555.000000000308A000.00000004.00000001.sdmp	String found in binary or memory: http://www.digicert.com/CPS0v
Source: XdPHZWGz4k.exe, 00000001.00000003.272829886.000000001C984000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 0000000C.00000002.321493569.000000001CFC0000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 00000010.00000002.340329280.000000000304D000.00000004.00000001.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: XdPHZWGz4k.exe, 00000001.00000003.272829886.000000001C984000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 0000000C.00000002.321493569.000000001CFC0000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 00000010.00000002.340329280.000000000304D000.00000004.00000001.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: XdPHZWGz4k.exe, 00000001.00000002.274650996.0000000002811000.00000004.00000001.sdmp, ConDrv.1.dr	String found in binary or memory: https://cdn.discordapp.com/attachments/882953645983957012/883254211461136404/cookies.txt
Source: XdPHZWGz4k.exe, 00000001.00000002.274686155.0000000002830000.00000004.00000001.sdmp, ConDrv.1.dr	String found in binary or memory: https://cdn.discordapp.com/attachments/882953645983957012/883254213243719690/passwords.txt
Source: XdPHZWGz4k.exe, 00000001.00000002.274730267.0000000002850000.00000004.00000001.sdmp, ConDrv.1.dr	String found in binary or memory: https://cdn.discordapp.com/attachments/882953645983957012/883254216330711070/Capture.jpg
Source: XdPHZWGz4k.exe, 0000000C.00000002.319787894.0000000002EFA000.00000004.00000001.sdmp, ConDrv.12.dr	String found in binary or memory: https://cdn.discordapp.com/attachments/882953645983957012/883254299721863178/cookies.txt
Source: XdPHZWGz4k.exe, 0000000C.00000002.320128808.0000000002FE9000.00000004.00000001.sdmp, ConDrv.12.dr	String found in binary or memory: https://cdn.discordapp.com/attachments/882953645983957012/883254301399584779/passwords.txt
Source: XdPHZWGz4k.exe, 0000000C.00000002.320190582.0000000003000000.00000004.00000001.sdmp, ConDrv.12.dr	String found in binary or memory: https://cdn.discordapp.com/attachments/882953645983957012/883254304713080833/Capture.jpg
Source: XdPHZWGz4k.exe, 00000010.00000002.340579707.00000000031F1000.00000004.00000001.sdmp, ConDrv.16.dr	String found in binary or memory: https://cdn.discordapp.com/attachments/882953645983957012/883254341446795304/cookies.txt
Source: XdPHZWGz4k.exe, 00000010.00000002.340604241.0000000003210000.00000004.00000001.sdmp, ConDrv.16.dr	String found in binary or memory: https://cdn.discordapp.com/attachments/882953645983957012/883254343187447818/passwords.txt
Source: XdPHZWGz4k.exe, 00000010.00000002.340625873.0000000003230000.00000004.00000001.sdmp, ConDrv.16.dr	String found in binary or memory: https://cdn.discordapp.com/attachments/882953645983957012/883254346521927710/Capture.jpg
Source: XdPHZWGz4k.exe	String found in binary or memory: https://cdn.discordapp.com/avatars/
Source: XdPHZWGz4k.exe, 00000001.00000002.274406226.00000000026AA000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 0000000C.00000002.319503161.0000000002E58000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 00000010.00000002.340408555.000000000308A000.00000004.00000001.sdmp	String found in binary or memory: https://discord.com
Source: XdPHZWGz4k.exe	String found in binary or memory: https://discord.com/api/webhooks/882954273980284939/Oo5CKwHMkILgJiucQhx_aJyEIHFxNaStS_Rgc-0H9Qm-hz7q
Source: XdPHZWGz4k.exe, 00000001.00000002.274686155.0000000002830000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 0000000C.00000002.320190582.0000000003000000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 00000010.00000002.340625873.0000000003230000.00000004.00000001.sdmp	String found in binary or memory: https://discord.com8
Source: XdPHZWGz4k.exe, 00000001.00000002.274406226.00000000026AA000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 0000000C.00000002.319503161.0000000002E58000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 00000010.00000002.340408555.000000000308A000.00000004.00000001.sdmp	String found in binary or memory: https://discord.comx
Source: XdPHZWGz4k.exe	String found in binary or memory: https://discordapp.com/api/v8/users/
Source: XdPHZWGz4k.exe	String found in binary or memory: https://i.imgur.com/vgxBhmx.png
Source: XdPHZWGz4k.exe, 00000001.00000002.274650996.0000000002811000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 0000000C.00000002.319787894.0000000002EFA000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 00000010.00000002.340579707.00000000031F1000.00000004.00000001.sdmp	String found in binary or memory: https://i.imgur.com/vgxBhmx.pngultipart/form-data
Source: XdPHZWGz4k.exe	String found in binary or memory: https://ip4.seeip.org
Source: XdPHZWGz4k.exe, 00000010.00000002.340284669.0000000003029000.00000004.00000001.sdmp	String found in binary or memory: https://ip4.seeip.org/
Source: XdPHZWGz4k.exe, 00000001.00000002.274271699.000000000264C000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 0000000C.00000002.319252949.0000000002DF9000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 00000010.00000002.340284669.0000000003029000.00000004.00000001.sdmp	String found in binary or memory: https://ip4.seeip.orgx
Source: XdPHZWGz4k.exe, 00000001.00000002.274650996.0000000002811000.00000004.00000001.sdmp, ConDrv.1.dr	String found in binary or memory: https://media.discordapp.net/attachments/882953645983957012/883254211461136404/cookies.txt
Source: XdPHZWGz4k.exe, 00000001.00000002.274686155.0000000002830000.00000004.00000001.sdmp, ConDrv.1.dr	String found in binary or memory: https://media.discordapp.net/attachments/882953645983957012/883254213243719690/passwords.txt
Source: XdPHZWGz4k.exe, 00000001.00000002.274730267.0000000002850000.00000004.00000001.sdmp, ConDrv.1.dr	String found in binary or memory: https://media.discordapp.net/attachments/882953645983957012/883254216330711070/Capture.jpg
Source: XdPHZWGz4k.exe, 0000000C.00000002.319787894.0000000002EFA000.00000004.00000001.sdmp, ConDrv.12.dr	String found in binary or memory: https://media.discordapp.net/attachments/882953645983957012/883254299721863178/cookies.txt
Source: XdPHZWGz4k.exe, 0000000C.00000002.320128808.0000000002FE9000.00000004.00000001.sdmp, ConDrv.12.dr	String found in binary or memory: https://media.discordapp.net/attachments/882953645983957012/883254301399584779/passwords.txt
Source: XdPHZWGz4k.exe, 0000000C.00000002.320190582.0000000003000000.00000004.00000001.sdmp, ConDrv.12.dr	String found in binary or memory: https://media.discordapp.net/attachments/882953645983957012/883254304713080833/Capture.jpg
Source: XdPHZWGz4k.exe, 00000010.00000002.340579707.00000000031F1000.00000004.00000001.sdmp, ConDrv.16.dr	String found in binary or memory: https://media.discordapp.net/attachments/882953645983957012/883254341446795304/cookies.txt
Source: XdPHZWGz4k.exe, 00000010.00000002.340604241.0000000003210000.00000004.00000001.sdmp, ConDrv.16.dr	String found in binary or memory: https://media.discordapp.net/attachments/882953645983957012/883254343187447818/passwords.txt
Source: XdPHZWGz4k.exe, 00000010.00000002.340625873.0000000003230000.00000004.00000001.sdmp, ConDrv.16.dr	String found in binary or memory: https://media.discordapp.net/attachments/882953645983957012/883254346521927710/Capture.jpg
Source: XdPHZWGz4k.exe, 00000001.00000002.274686155.0000000002830000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 00000001.00000002.274298274.000000000266D000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 0000000C.00000002.320190582.0000000003000000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 00000010.00000002.340625873.0000000003230000.00000004.00000001.sdmp	String found in binary or memory: https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct
Source: XdPHZWGz4k.exe	String found in binary or memory: https://www.countryflags.io/
Source: XdPHZWGz4k.exe, 00000010.00000002.340408555.000000000308A000.00000004.00000001.sdmp	String found in binary or memory: https://www.countryflags.io/CH/flat/48.png
Source: XdPHZWGz4k.exe, 00000001.00000002.274406226.00000000026AA000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 0000000C.00000003.318001084.000000001D007000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 00000010.00000002.340408555.000000000308A000.00000004.00000001.sdmp	String found in binary or memory: https://www.digicert.com/CPS0

Source: unknown

DNS traffic detected: queries for: ip4.seeip.org

Source: global traffic	HTTP traffic detected: GET //json/84.17.52.41 HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET //json/84.17.52.41 HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET //json/84.17.52.41 HTTP/1.1Host: ip-api.comConnection: Keep-Alive

E-Banking Fraud:

Yara detected MercurialGrabber

Show sources

Source: Yara match	File source: XdPHZWGz4k.exe, type: SAMPLE
Source: Yara match	File source: 12.2.XdPHZWGz4k.exe.bc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.XdPHZWGz4k.exe.3a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.XdPHZWGz4k.exe.af0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.XdPHZWGz4k.exe.3a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.XdPHZWGz4k.exe.bc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.0.XdPHZWGz4k.exe.af0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000000.298642309.0000000000BC2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.339741238.0000000000AF2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.273139663.00000000003A2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000000.315911277.0000000000AF2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.253502407.00000000003A2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.318186750.0000000000BC2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.272744068.000000001C9D5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: XdPHZWGz4k.exe PID: 6384, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: XdPHZWGz4k.exe PID: 3208, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: XdPHZWGz4k.exe PID: 6372, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe, type: DROPPED

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: XdPHZWGz4k.exe, type: SAMPLE	Matched rule: Detect Luna stealer (also Mercurial Grabber) Author: Arkbird_SOLG
Source: 12.2.XdPHZWGz4k.exe.bc0000.0.unpack, type: UNPACKEDPE	Matched rule: Detect Luna stealer (also Mercurial Grabber) Author: Arkbird_SOLG
Source: 1.0.XdPHZWGz4k.exe.3a0000.0.unpack, type: UNPACKEDPE	Matched rule: Detect Luna stealer (also Mercurial Grabber) Author: Arkbird_SOLG
Source: 16.2.XdPHZWGz4k.exe.af0000.0.unpack, type: UNPACKEDPE	Matched rule: Detect Luna stealer (also Mercurial Grabber) Author: Arkbird_SOLG
Source: 1.2.XdPHZWGz4k.exe.3a0000.0.unpack, type: UNPACKEDPE	Matched rule: Detect Luna stealer (also Mercurial Grabber) Author: Arkbird_SOLG
Source: 12.0.XdPHZWGz4k.exe.bc0000.0.unpack, type: UNPACKEDPE	Matched rule: Detect Luna stealer (also Mercurial Grabber) Author: Arkbird_SOLG
Source: 16.0.XdPHZWGz4k.exe.af0000.0.unpack, type: UNPACKEDPE	Matched rule: Detect Luna stealer (also Mercurial Grabber) Author: Arkbird_SOLG
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe, type: DROPPED	Matched rule: Detect Luna stealer (also Mercurial Grabber) Author: Arkbird_SOLG

Source: XdPHZWGz4k.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: XdPHZWGz4k.exe, type: SAMPLE	Matched rule: MAL_Luna_Stealer_Apr_2021_1 date = 2021-08-29, hash4 = ce35eb5ba2f3f36b3d2742b33d3dbbe95f5ec6b93942ba20be4693528b163e3a, hash3 = 0521bb85472869598d9aa822b11edc04044dbe876dbf9900565bfdc8e02c2b21, hash2 = 93563f68975a858ff07f7eb91f4e0c997f0212d58b1755704d89fecd442d448f, hash1 = a14918133b9b818fa2e8728faa075c4f173fa69abc424f39621d6aa1405f5a18, author = Arkbird_SOLG, description = Detect Luna stealer (also Mercurial Grabber), adversary = -, reference = https://github.com/NightfallGT/Mercurial-Grabber, tlp = White
Source: 12.2.XdPHZWGz4k.exe.bc0000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Luna_Stealer_Apr_2021_1 date = 2021-08-29, hash4 = ce35eb5ba2f3f36b3d2742b33d3dbbe95f5ec6b93942ba20be4693528b163e3a, hash3 = 0521bb85472869598d9aa822b11edc04044dbe876dbf9900565bfdc8e02c2b21, hash2 = 93563f68975a858ff07f7eb91f4e0c997f0212d58b1755704d89fecd442d448f, hash1 = a14918133b9b818fa2e8728faa075c4f173fa69abc424f39621d6aa1405f5a18, author = Arkbird_SOLG, description = Detect Luna stealer (also Mercurial Grabber), adversary = -, reference = https://github.com/NightfallGT/Mercurial-Grabber, tlp = White
Source: 1.0.XdPHZWGz4k.exe.3a0000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Luna_Stealer_Apr_2021_1 date = 2021-08-29, hash4 = ce35eb5ba2f3f36b3d2742b33d3dbbe95f5ec6b93942ba20be4693528b163e3a, hash3 = 0521bb85472869598d9aa822b11edc04044dbe876dbf9900565bfdc8e02c2b21, hash2 = 93563f68975a858ff07f7eb91f4e0c997f0212d58b1755704d89fecd442d448f, hash1 = a14918133b9b818fa2e8728faa075c4f173fa69abc424f39621d6aa1405f5a18, author = Arkbird_SOLG, description = Detect Luna stealer (also Mercurial Grabber), adversary = -, reference = https://github.com/NightfallGT/Mercurial-Grabber, tlp = White
Source: 16.2.XdPHZWGz4k.exe.af0000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Luna_Stealer_Apr_2021_1 date = 2021-08-29, hash4 = ce35eb5ba2f3f36b3d2742b33d3dbbe95f5ec6b93942ba20be4693528b163e3a, hash3 = 0521bb85472869598d9aa822b11edc04044dbe876dbf9900565bfdc8e02c2b21, hash2 = 93563f68975a858ff07f7eb91f4e0c997f0212d58b1755704d89fecd442d448f, hash1 = a14918133b9b818fa2e8728faa075c4f173fa69abc424f39621d6aa1405f5a18, author = Arkbird_SOLG, description = Detect Luna stealer (also Mercurial Grabber), adversary = -, reference = https://github.com/NightfallGT/Mercurial-Grabber, tlp = White
Source: 1.2.XdPHZWGz4k.exe.3a0000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Luna_Stealer_Apr_2021_1 date = 2021-08-29, hash4 = ce35eb5ba2f3f36b3d2742b33d3dbbe95f5ec6b93942ba20be4693528b163e3a, hash3 = 0521bb85472869598d9aa822b11edc04044dbe876dbf9900565bfdc8e02c2b21, hash2 = 93563f68975a858ff07f7eb91f4e0c997f0212d58b1755704d89fecd442d448f, hash1 = a14918133b9b818fa2e8728faa075c4f173fa69abc424f39621d6aa1405f5a18, author = Arkbird_SOLG, description = Detect Luna stealer (also Mercurial Grabber), adversary = -, reference = https://github.com/NightfallGT/Mercurial-Grabber, tlp = White
Source: 12.0.XdPHZWGz4k.exe.bc0000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Luna_Stealer_Apr_2021_1 date = 2021-08-29, hash4 = ce35eb5ba2f3f36b3d2742b33d3dbbe95f5ec6b93942ba20be4693528b163e3a, hash3 = 0521bb85472869598d9aa822b11edc04044dbe876dbf9900565bfdc8e02c2b21, hash2 = 93563f68975a858ff07f7eb91f4e0c997f0212d58b1755704d89fecd442d448f, hash1 = a14918133b9b818fa2e8728faa075c4f173fa69abc424f39621d6aa1405f5a18, author = Arkbird_SOLG, description = Detect Luna stealer (also Mercurial Grabber), adversary = -, reference = https://github.com/NightfallGT/Mercurial-Grabber, tlp = White
Source: 16.0.XdPHZWGz4k.exe.af0000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Luna_Stealer_Apr_2021_1 date = 2021-08-29, hash4 = ce35eb5ba2f3f36b3d2742b33d3dbbe95f5ec6b93942ba20be4693528b163e3a, hash3 = 0521bb85472869598d9aa822b11edc04044dbe876dbf9900565bfdc8e02c2b21, hash2 = 93563f68975a858ff07f7eb91f4e0c997f0212d58b1755704d89fecd442d448f, hash1 = a14918133b9b818fa2e8728faa075c4f173fa69abc424f39621d6aa1405f5a18, author = Arkbird_SOLG, description = Detect Luna stealer (also Mercurial Grabber), adversary = -, reference = https://github.com/NightfallGT/Mercurial-Grabber, tlp = White
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe, type: DROPPED	Matched rule: MAL_Luna_Stealer_Apr_2021_1 date = 2021-08-29, hash4 = ce35eb5ba2f3f36b3d2742b33d3dbbe95f5ec6b93942ba20be4693528b163e3a, hash3 = 0521bb85472869598d9aa822b11edc04044dbe876dbf9900565bfdc8e02c2b21, hash2 = 93563f68975a858ff07f7eb91f4e0c997f0212d58b1755704d89fecd442d448f, hash1 = a14918133b9b818fa2e8728faa075c4f173fa69abc424f39621d6aa1405f5a18, author = Arkbird_SOLG, description = Detect Luna stealer (also Mercurial Grabber), adversary = -, reference = https://github.com/NightfallGT/Mercurial-Grabber, tlp = White

Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Code function: 1_2_00007FFA16806F92	1_2_00007FFA16806F92
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Code function: 1_2_00007FFA168061E6	1_2_00007FFA168061E6
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Code function: 12_2_00007FFA16586FA2	12_2_00007FFA16586FA2
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Code function: 12_2_00007FFA1658BD99	12_2_00007FFA1658BD99
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Code function: 12_2_00007FFA165861F6	12_2_00007FFA165861F6
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Code function: 12_2_00007FFA16585CF9	12_2_00007FFA16585CF9
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Code function: 16_2_00007FFA165A6F92	16_2_00007FFA165A6F92
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Code function: 16_2_00007FFA165A61E6	16_2_00007FFA165A61E6

Source: XdPHZWGz4k.exe	Binary or memory string: OriginalFilename vs XdPHZWGz4k.exe
Source: XdPHZWGz4k.exe, 00000001.00000002.273139663.00000000003A2000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameDiscordpro.exe4 vs XdPHZWGz4k.exe
Source: XdPHZWGz4k.exe, 00000001.00000002.273171481.0000000000750000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs XdPHZWGz4k.exe
Source: XdPHZWGz4k.exe	Binary or memory string: OriginalFilename vs XdPHZWGz4k.exe
Source: XdPHZWGz4k.exe, 0000000C.00000000.298642309.0000000000BC2000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameDiscordpro.exe4 vs XdPHZWGz4k.exe
Source: XdPHZWGz4k.exe, 0000000C.00000002.318381575.0000000000FBB000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs XdPHZWGz4k.exe
Source: XdPHZWGz4k.exe	Binary or memory string: OriginalFilename vs XdPHZWGz4k.exe
Source: XdPHZWGz4k.exe, 00000010.00000002.339741238.0000000000AF2000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameDiscordpro.exe4 vs XdPHZWGz4k.exe
Source: XdPHZWGz4k.exe, 00000010.00000002.339841701.0000000000F95000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs XdPHZWGz4k.exe
Source: XdPHZWGz4k.exe	Binary or memory string: OriginalFilenameDiscordpro.exe4 vs XdPHZWGz4k.exe

Source: XdPHZWGz4k.exe

Virustotal: Detection: 53%

Source: C:\Users\user\Desktop\XdPHZWGz4k.exe

File read: C:\Users\user\Desktop\XdPHZWGz4k.exe

Jump to behavior

Source: XdPHZWGz4k.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\XdPHZWGz4k.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\XdPHZWGz4k.exe 'C:\Users\user\Desktop\XdPHZWGz4k.exe'
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe 'C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe'
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe 'C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe'
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\XdPHZWGz4k.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\XdPHZWGz4k.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\XdPHZWGz4k.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\XdPHZWGz4k.exe

File created: C:\Users\user\AppData\Local\Temp\cookies.db

Jump to behavior

Source: classification engine

Classification label: mal78.troj.spyw.evad.winEXE@6/18@9/4

Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6320:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6424:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5116:120:WilError_01

Source: XdPHZWGz4k.exe, 00000001.00000002.273171481.0000000000750000.00000004.00000020.sdmp

Binary or memory string: ;.VBP

Source: XdPHZWGz4k.exe	String found in binary or memory: copy to : /\launcher_profiles.json5Minecraft Session Profiles-launcher_profiles.json'multipart/form-data
Source: XdPHZWGz4k.exe	String found in binary or memory: #Minecraft SessionKUnable to find launcher_profiles.jsonE\.minecraft\launcher_accounts.json/\launcher_accounts.json-launcher_accounts.jsonKUnable to find launcher_accounts.json

Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: XdPHZWGz4k.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: XdPHZWGz4k.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Code function: 1_2_00007FFA16800442 pushad ; ret		1_2_00007FFA16800451
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Code function: 12_2_00007FFA16580442 pushad ; ret		12_2_00007FFA16580451

Source: C:\Users\user\Desktop\XdPHZWGz4k.exe

File created: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe

Jump to dropped file

Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Mercurial Grabber			Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Mercurial Grabber			Jump to behavior

Source: C:\Users\user\Desktop\XdPHZWGz4k.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Queries memory information (via WMI often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Capacity FROM Win32_PhysicalMemory
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Capacity FROM Win32_PhysicalMemory
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Capacity FROM Win32_PhysicalMemory

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Capacity FROM Win32_PhysicalMemory
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Capacity FROM Win32_PhysicalMemory
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Capacity FROM Win32_PhysicalMemory

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_VideoController

Source: C:\Users\user\Desktop\XdPHZWGz4k.exe TID: 6552	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe TID: 6552	Thread sleep time: -200000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe TID: 6552	Thread sleep time: -99890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe TID: 6552	Thread sleep time: -99747s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe TID: 6552	Thread sleep time: -99636s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe TID: 6552	Thread sleep time: -99527s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe TID: 6552	Thread sleep time: -99421s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe TID: 6552	Thread sleep time: -99306s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe TID: 6552	Thread sleep time: -99187s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe TID: 6552	Thread sleep time: -99076s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe TID: 6552	Thread sleep time: -98968s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe TID: 6552	Thread sleep time: -98797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe TID: 6552	Thread sleep time: -99835s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe TID: 6548	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe TID: 6512	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe TID: 3696	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe TID: 3696	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe TID: 3696	Thread sleep time: -199686s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe TID: 3696	Thread sleep time: -99719s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe TID: 3696	Thread sleep time: -99594s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe TID: 3696	Thread sleep time: -99484s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe TID: 3696	Thread sleep time: -99375s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe TID: 3696	Thread sleep time: -99263s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe TID: 3696	Thread sleep time: -99156s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe TID: 3696	Thread sleep time: -99047s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe TID: 3696	Thread sleep time: -98933s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe TID: 3696	Thread sleep time: -98828s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe TID: 3696	Thread sleep time: -98717s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe TID: 3696	Thread sleep time: -99968s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe TID: 3084	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe TID: 1132	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe TID: 1132	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe TID: 1132	Thread sleep time: -99875s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe TID: 1132	Thread sleep time: -99734s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe TID: 1132	Thread sleep time: -99594s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe TID: 1132	Thread sleep time: -99391s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe TID: 1132	Thread sleep time: -99266s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe TID: 1132	Thread sleep time: -99157s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe TID: 1132	Thread sleep time: -99000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe TID: 1132	Thread sleep time: -98891s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe TID: 1132	Thread sleep time: -98750s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe TID: 1132	Thread sleep time: -98641s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe TID: 1132	Thread sleep time: -98500s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe TID: 1132	Thread sleep time: -98375s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe TID: 1132	Thread sleep time: -99969s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe TID: 1132	Thread sleep time: -99857s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe TID: 1132	Thread sleep time: -99750s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe TID: 1132	Thread sleep time: -99547s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe TID: 6404	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe TID: 6472	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Window / User API: threadDelayed 918	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Window / User API: threadDelayed 1814	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Window / User API: threadDelayed 2948	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Window / User API: threadDelayed 1206	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Window / User API: threadDelayed 1716	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum name: 0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\XdPHZWGz4k.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Thread delayed: delay time: 99890	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Thread delayed: delay time: 99747	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Thread delayed: delay time: 99636	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Thread delayed: delay time: 99527	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Thread delayed: delay time: 99421	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Thread delayed: delay time: 99306	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Thread delayed: delay time: 99187	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Thread delayed: delay time: 99076	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Thread delayed: delay time: 98968	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Thread delayed: delay time: 98797	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Thread delayed: delay time: 99835	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Thread delayed: delay time: 99843	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Thread delayed: delay time: 99719	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Thread delayed: delay time: 99594	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Thread delayed: delay time: 99484	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Thread delayed: delay time: 99375	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Thread delayed: delay time: 99263	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Thread delayed: delay time: 99156	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Thread delayed: delay time: 99047	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Thread delayed: delay time: 98933	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Thread delayed: delay time: 98828	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Thread delayed: delay time: 98717	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Thread delayed: delay time: 99968	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Thread delayed: delay time: 99734	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Thread delayed: delay time: 99594	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Thread delayed: delay time: 99391	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Thread delayed: delay time: 99266	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Thread delayed: delay time: 99157	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Thread delayed: delay time: 99000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Thread delayed: delay time: 98891	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Thread delayed: delay time: 98750	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Thread delayed: delay time: 98641	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Thread delayed: delay time: 98500	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Thread delayed: delay time: 98375	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Thread delayed: delay time: 99969	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Thread delayed: delay time: 99857	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Thread delayed: delay time: 99750	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Thread delayed: delay time: 99547	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	File opened: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\6d7d43e19d7fc0006285b85b7e2c8702\System.Windows.Forms.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	File opened: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\4e05e2e48b8a6dd267a8c9e25ef129a7\System.Core.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	File opened: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\49e5c0579db170be9741dccc34c1998e\System.Drawing.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	File opened: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	File opened: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	File opened: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Net.Http\a0f6e3585453700574fc42ba3653c021\System.Net.Http.ni.dll	Jump to behavior

Source: XdPHZWGz4k.exe	Binary or memory string: SYSTEM\CurrentControlSet\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S
Source: XdPHZWGz4k.exe, 00000010.00000003.339560833.000000001D110000.00000004.00000001.sdmp	Binary or memory string: VMware
Source: XdPHZWGz4k.exe, 00000010.00000002.340223000.0000000002FB1000.00000004.00000001.sdmp	Binary or memory string: ISYSTEM\CurrentControlSet\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S
Source: XdPHZWGz4k.exe, 00000010.00000002.340223000.0000000002FB1000.00000004.00000001.sdmp	Binary or memory string: KSYSTEM\CurrentControlSet\Control\CriticalDeviceDatabase\root#vmwvmcihostdev
Source: XdPHZWGz4k.exe	Binary or memory string: vmware
Source: XdPHZWGz4k.exe	Binary or memory string: virtualboxvboxqemu
Source: XdPHZWGz4k.exe	Binary or memory string: SOFTWARE\VMWare, Inc.\VMWare Tools
Source: XdPHZWGz4k.exe, 0000000C.00000003.318001084.000000001D007000.00000004.00000001.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMwareYA_B5NPGWin3
Source: XdPHZWGz4k.exe, 00000001.00000002.275211895.000000001C920000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll)
Source: XdPHZWGz4k.exe, 00000010.00000003.339560833.000000001D110000.00000004.00000001.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMwareYA_B5NPGWin32_VideoControllerUBB7E6GTVideoController120060621000000.000000-00038037273display.infMSBDA1VG6OER7PCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsP9KK2TXR
Source: XdPHZWGz4k.exe	Binary or memory string: SYSTEM\CurrentControlSet\Control\CriticalDeviceDatabase\root#vmwvmcihostdev
Source: XdPHZWGz4k.exe, 00000010.00000002.340223000.0000000002FB1000.00000004.00000001.sdmp	Binary or memory string: "SOFTWARE\VMWare, Inc.\VMWare Tools
Source: XdPHZWGz4k.exe, 0000000C.00000002.321386293.000000001CF70000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 00000010.00000002.342617367.000000001D060000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: XdPHZWGz4k.exe	Binary or memory string: SYSTEM\CurrentControlSet\Control\CriticalDeviceDatabase\root#vmwvmcihostdevkSYSTEM\CurrentControlSet\Control\VirtualDeviceDriversESOFTWARE\VMWare, Inc.\VMWare ToolsUSOFTWARE\Oracle\VirtualBox Guest Additions1HARDWARE\ACPI\DSDT\VBOX_SSYSTEM\ControlSet001\Services\Disk\Enum\0cHARDWARE\Description\System\SystemBiosInformationYHARDWARE\Description\System\VideoBiosVersion]HARDWARE\Description\System\SystemManufacturer[HARDWARE\Description\System\SystemProductName[HARDWARE\Description\System\Logical Unit Id 0

Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\XdPHZWGz4k.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Queries volume information: C:\Users\user\Desktop\XdPHZWGz4k.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior

Source: C:\Users\user\Desktop\XdPHZWGz4k.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion DigitalProductId	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion DigitalProductId	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion DigitalProductId	Jump to behavior

Source: C:\Users\user\Desktop\XdPHZWGz4k.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected MercurialGrabber

Show sources

Source: Yara match	File source: XdPHZWGz4k.exe, type: SAMPLE
Source: Yara match	File source: 12.2.XdPHZWGz4k.exe.bc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.XdPHZWGz4k.exe.3a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.XdPHZWGz4k.exe.af0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.XdPHZWGz4k.exe.3a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.XdPHZWGz4k.exe.bc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.0.XdPHZWGz4k.exe.af0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000000.298642309.0000000000BC2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.339741238.0000000000AF2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.273139663.00000000003A2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000000.315911277.0000000000AF2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.253502407.00000000003A2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.318186750.0000000000BC2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.272744068.000000001C9D5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: XdPHZWGz4k.exe PID: 6384, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: XdPHZWGz4k.exe PID: 3208, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: XdPHZWGz4k.exe PID: 6372, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe, type: DROPPED

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\default\Cookies			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\default\Login Data			Jump to behavior

Remote Access Functionality:

Yara detected MercurialGrabber

Show sources

Source: Yara match	File source: XdPHZWGz4k.exe, type: SAMPLE
Source: Yara match	File source: 12.2.XdPHZWGz4k.exe.bc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.XdPHZWGz4k.exe.3a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.XdPHZWGz4k.exe.af0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.XdPHZWGz4k.exe.3a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.XdPHZWGz4k.exe.bc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.0.XdPHZWGz4k.exe.af0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000000.298642309.0000000000BC2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.339741238.0000000000AF2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.273139663.00000000003A2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000000.315911277.0000000000AF2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.253502407.00000000003A2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.318186750.0000000000BC2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.272744068.000000001C9D5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: XdPHZWGz4k.exe PID: 6384, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: XdPHZWGz4k.exe PID: 3208, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: XdPHZWGz4k.exe PID: 6372, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe, type: DROPPED

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation3	Registry Run Keys / Startup Folder1	Process Injection1	Masquerading1	OS Credential Dumping1	Query Registry1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel22	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Command and Scripting Interpreter2	Boot or Logon Initialization Scripts	Registry Run Keys / Startup Folder1	Disable or Modify Tools1	LSASS Memory	Security Software Discovery311	Remote Desktop Protocol	Data from Local System1	Exfiltration Over Bluetooth	Ingress Tool Transfer1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Virtualization/Sandbox Evasion231	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol2	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection1	NTDS	Virtualization/Sandbox Evasion231	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol13	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Obfuscated Files or Information1	LSA Secrets	Application Window Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	Remote System Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	System Network Configuration Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	File and Directory Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	System Information Discovery33	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
XdPHZWGz4k.exe	53%	Virustotal		Browse
XdPHZWGz4k.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe	100%	Joe Sandbox ML

Unpacked PE Files

No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
discord.com	1%	Virustotal		Browse
ip4.seeip.org	2%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://ip4.seeip.org/	2%	Virustotal		Browse
https://ip4.seeip.org/	0%	Avira URL Cloud	safe
https://discord.com	0%	URL Reputation	safe
https://www.countryflags.io/CH/flat/48.png	0%	Avira URL Cloud	safe
http://cps.letsencrypt.org0	0%	URL Reputation	safe
https://ip4.seeip.org	0%	Avira URL Cloud	safe
http://discord.com	0%	Avira URL Cloud	safe
https://ip4.seeip.orgx	0%	Avira URL Cloud	safe
http://crl4.digic	0%	Avira URL Cloud	safe
https://www.countryflags.io/	0%	Avira URL Cloud	safe
http://ip-api.comx	0%	Avira URL Cloud	safe
https://discord.com/api/webhooks/882954273980284939/Oo5CKwHMkILgJiucQhx_aJyEIHFxNaStS_Rgc-0H9Qm-hz7q	0%	Avira URL Cloud	safe
http://go.micz	0%	Avira URL Cloud	safe
https://discord.com/api/webhooks/882954273980284939/Oo5CKwHMkILgJiucQhx_aJyEIHFxNaStS_Rgc-0H9Qm-hz7qs9oDqPvJxh_FmBs3dflH	0%	Avira URL Cloud	safe
https://discord.com8	0%	Avira URL Cloud	safe
https://discord.comx	0%	Avira URL Cloud	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
http://r3.i.lencr.org/05	0%	Avira URL Cloud	safe
http://r3.o.lencr.org0	0%	URL Reputation	safe
http://ip4.seeip.org	0%	Avira URL Cloud	safe
http://cps.root-x1.letsencrypt.org0	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
discord.com	162.159.136.232	true	true	1%, Virustotal, Browse	unknown
ip-api.com	208.95.112.1	true	false		high
ip4.seeip.org	23.128.64.141	true	false	2%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://discord.com/api/webhooks/882954273980284939/Oo5CKwHMkILgJiucQhx_aJyEIHFxNaStS_Rgc-0H9Qm-hz7qs9oDqPvJxh_FmBs3dflH	true	Avira URL Cloud: safe	unknown
http://ip-api.com//json/84.17.52.41	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://media.discordapp.net/attachments/882953645983957012/883254211461136404/cookies.txt	XdPHZWGz4k.exe, 00000001.00000002.274650996.0000000002811000.00000004.00000001.sdmp, ConDrv.1.dr	false		high
https://media.discordapp.net/attachments/882953645983957012/883254304713080833/Capture.jpg	XdPHZWGz4k.exe, 0000000C.00000002.320190582.0000000003000000.00000004.00000001.sdmp, ConDrv.12.dr	false		high
https://discordapp.com/api/v8/users/	XdPHZWGz4k.exe	false		high
https://ip4.seeip.org/	XdPHZWGz4k.exe, 00000010.00000002.340284669.0000000003029000.00000004.00000001.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://media.discordapp.net/attachments/882953645983957012/883254343187447818/passwords.txt	XdPHZWGz4k.exe, 00000010.00000002.340604241.0000000003210000.00000004.00000001.sdmp, ConDrv.16.dr	false		high
https://discord.com	XdPHZWGz4k.exe, 00000001.00000002.274406226.00000000026AA000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 0000000C.00000002.319503161.0000000002E58000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 00000010.00000002.340408555.000000000308A000.00000004.00000001.sdmp	true	URL Reputation: safe	unknown
https://i.imgur.com/vgxBhmx.pngultipart/form-data	XdPHZWGz4k.exe, 00000001.00000002.274650996.0000000002811000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 0000000C.00000002.319787894.0000000002EFA000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 00000010.00000002.340579707.00000000031F1000.00000004.00000001.sdmp	false		high
https://www.countryflags.io/CH/flat/48.png	XdPHZWGz4k.exe, 00000010.00000002.340408555.000000000308A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://cps.letsencrypt.org0	XdPHZWGz4k.exe, 00000001.00000002.274321032.000000000267E000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 0000000C.00000002.321493569.000000001CFC0000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 00000010.00000002.340329280.000000000304D000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://cdn.discordapp.com/attachments/882953645983957012/883254301399584779/passwords.txt	XdPHZWGz4k.exe, 0000000C.00000002.320128808.0000000002FE9000.00000004.00000001.sdmp, ConDrv.12.dr	false		high
https://cdn.discordapp.com/attachments/882953645983957012/883254211461136404/cookies.txt	XdPHZWGz4k.exe, 00000001.00000002.274650996.0000000002811000.00000004.00000001.sdmp, ConDrv.1.dr	false		high
https://ip4.seeip.org	XdPHZWGz4k.exe	false	Avira URL Cloud: safe	unknown
http://discord.com	XdPHZWGz4k.exe, 00000001.00000002.274406226.00000000026AA000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 0000000C.00000002.319503161.0000000002E58000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 00000010.00000002.340408555.000000000308A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://ip4.seeip.orgx	XdPHZWGz4k.exe, 00000001.00000002.274271699.000000000264C000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 0000000C.00000002.319252949.0000000002DF9000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 00000010.00000002.340284669.0000000003029000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://crl4.digic	XdPHZWGz4k.exe, 00000010.00000002.343098466.000000001D0D3000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://www.countryflags.io/	XdPHZWGz4k.exe	false	Avira URL Cloud: safe	unknown
http://ip-api.comx	XdPHZWGz4k.exe, 00000001.00000002.274271699.000000000264C000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 0000000C.00000002.319342827.0000000002E1D000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 00000010.00000002.340329280.000000000304D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://discord.com/api/webhooks/882954273980284939/Oo5CKwHMkILgJiucQhx_aJyEIHFxNaStS_Rgc-0H9Qm-hz7q	XdPHZWGz4k.exe	true	Avira URL Cloud: safe	unknown
https://cdn.discordapp.com/attachments/882953645983957012/883254213243719690/passwords.txt	XdPHZWGz4k.exe, 00000001.00000002.274686155.0000000002830000.00000004.00000001.sdmp, ConDrv.1.dr	false		high
http://go.micz	XdPHZWGz4k.exe, 00000001.00000003.272968518.00000000007F9000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://ip-api.com//json/	XdPHZWGz4k.exe	false		high
https://media.discordapp.net/attachments/882953645983957012/883254216330711070/Capture.jpg	XdPHZWGz4k.exe, 00000001.00000002.274730267.0000000002850000.00000004.00000001.sdmp, ConDrv.1.dr	false		high
https://cdn.discordapp.com/attachments/882953645983957012/883254343187447818/passwords.txt	XdPHZWGz4k.exe, 00000010.00000002.340604241.0000000003210000.00000004.00000001.sdmp, ConDrv.16.dr	false		high
https://discord.com8	XdPHZWGz4k.exe, 00000001.00000002.274686155.0000000002830000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 0000000C.00000002.320190582.0000000003000000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 00000010.00000002.340625873.0000000003230000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://discord.comx	XdPHZWGz4k.exe, 00000001.00000002.274406226.00000000026AA000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 0000000C.00000002.319503161.0000000002E58000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 00000010.00000002.340408555.000000000308A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.discordapp.com/attachments/882953645983957012/883254341446795304/cookies.txt	XdPHZWGz4k.exe, 00000010.00000002.340579707.00000000031F1000.00000004.00000001.sdmp, ConDrv.16.dr	false		high
http://x1.c.lencr.org/0	XdPHZWGz4k.exe, 00000001.00000003.272829886.000000001C984000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 0000000C.00000002.321493569.000000001CFC0000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 00000010.00000002.340329280.000000000304D000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	XdPHZWGz4k.exe, 00000001.00000003.272829886.000000001C984000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 0000000C.00000002.321493569.000000001CFC0000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 00000010.00000002.340329280.000000000304D000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://cdn.discordapp.com/attachments/882953645983957012/883254216330711070/Capture.jpg	XdPHZWGz4k.exe, 00000001.00000002.274730267.0000000002850000.00000004.00000001.sdmp, ConDrv.1.dr	false		high
https://media.discordapp.net/attachments/882953645983957012/883254301399584779/passwords.txt	XdPHZWGz4k.exe, 0000000C.00000002.320128808.0000000002FE9000.00000004.00000001.sdmp, ConDrv.12.dr	false		high
http://r3.i.lencr.org/05	XdPHZWGz4k.exe, 00000001.00000002.274321032.000000000267E000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 0000000C.00000002.321493569.000000001CFC0000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 00000010.00000002.340329280.000000000304D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://ip-api.com	XdPHZWGz4k.exe, 00000001.00000002.274271699.000000000264C000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 0000000C.00000002.319475097.0000000002E4B000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 00000010.00000002.340329280.000000000304D000.00000004.00000001.sdmp	false		high
http://r3.o.lencr.org0	XdPHZWGz4k.exe, 00000001.00000002.274321032.000000000267E000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 0000000C.00000002.321493569.000000001CFC0000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 00000010.00000002.340329280.000000000304D000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://media.discordapp.net/attachments/882953645983957012/883254213243719690/passwords.txt	XdPHZWGz4k.exe, 00000001.00000002.274686155.0000000002830000.00000004.00000001.sdmp, ConDrv.1.dr	false		high
https://media.discordapp.net/attachments/882953645983957012/883254299721863178/cookies.txt	XdPHZWGz4k.exe, 0000000C.00000002.319787894.0000000002EFA000.00000004.00000001.sdmp, ConDrv.12.dr	false		high
https://cdn.discordapp.com/attachments/882953645983957012/883254346521927710/Capture.jpg	XdPHZWGz4k.exe, 00000010.00000002.340625873.0000000003230000.00000004.00000001.sdmp, ConDrv.16.dr	false		high
https://media.discordapp.net/attachments/882953645983957012/883254346521927710/Capture.jpg	XdPHZWGz4k.exe, 00000010.00000002.340625873.0000000003230000.00000004.00000001.sdmp, ConDrv.16.dr	false		high
https://cdn.discordapp.com/avatars/	XdPHZWGz4k.exe	false		high
https://media.discordapp.net/attachments/882953645983957012/883254341446795304/cookies.txt	XdPHZWGz4k.exe, 00000010.00000002.340579707.00000000031F1000.00000004.00000001.sdmp, ConDrv.16.dr	false		high
https://cdn.discordapp.com/attachments/882953645983957012/883254299721863178/cookies.txt	XdPHZWGz4k.exe, 0000000C.00000002.319787894.0000000002EFA000.00000004.00000001.sdmp, ConDrv.12.dr	false		high
https://i.imgur.com/vgxBhmx.png	XdPHZWGz4k.exe	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	XdPHZWGz4k.exe, 00000001.00000002.274271699.000000000264C000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 0000000C.00000002.319252949.0000000002DF9000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 00000010.00000002.340284669.0000000003029000.00000004.00000001.sdmp	false		high
http://ip4.seeip.org	XdPHZWGz4k.exe, 00000001.00000002.274298274.000000000266D000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 0000000C.00000002.319342827.0000000002E1D000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 00000010.00000002.340329280.000000000304D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://cps.root-x1.letsencrypt.org0	XdPHZWGz4k.exe, 00000001.00000003.272829886.000000001C984000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 0000000C.00000002.321493569.000000001CFC0000.00000004.00000001.sdmp, XdPHZWGz4k.exe, 00000010.00000002.340329280.000000000304D000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://cdn.discordapp.com/attachments/882953645983957012/883254304713080833/Capture.jpg	XdPHZWGz4k.exe, 0000000C.00000002.320190582.0000000003000000.00000004.00000001.sdmp, ConDrv.12.dr	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	false
162.159.136.232	discord.com	United States	13335	CLOUDFLARENETUS	true
23.128.64.141	ip4.seeip.org	United States	19969	JOESDATACENTERUS	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	477026
Start date:	03.09.2021
Start time:	09:35:40
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	XdPHZWGz4k.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal78.troj.spyw.evad.winEXE@6/18@9/4
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 98% Number of executed functions: 10 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe Excluded IPs from analysis (whitelisted): 23.211.6.115, 23.211.4.86, 20.82.210.154, 40.112.88.60, 20.82.209.183, 80.67.82.211, 80.67.82.235, 23.203.69.124 Excluded domains from analysis (whitelisted): iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, fs.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, tile-service.weather.microsoft.com, store-images.s-microsoft.com-c.edgekey.net, e1723.g.akamaiedge.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, e15275.g.akamaiedge.net, arc.msn.com, ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, store-images.s-microsoft.com, wildcard.weather.microsoft.com.edgekey.net, arc.trafficmanager.net, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:36:48	API Interceptor	47x Sleep call for process: XdPHZWGz4k.exe modified
09:36:59	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Mercurial Grabber "C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe"
09:37:07	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Mercurial Grabber "C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe"

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
208.95.112.1	qu57kPofXM.exe	Get hash	malicious	Browse	www.facebook.com/json/
	PDOC_P7U_20217218.jar	Get hash	malicious	Browse	ip-api.com/json/
	Quote.jar	Get hash	malicious	Browse	ip-api.com/json/
	mmKnM9A5kn.exe	Get hash	malicious	Browse	ip-api.com/json
	XTDxFsa9vH.exe	Get hash	malicious	Browse	ip-api.com/json
	Quote.jar	Get hash	malicious	Browse	ip-api.com/json/
	wg73ZsPasH.exe	Get hash	malicious	Browse	ip-api.com/line/?fields=hosting
	Drawing and artwork.jar	Get hash	malicious	Browse	ip-api.com/json/
	Purchase Order.jar	Get hash	malicious	Browse	ip-api.com/json/
	doc_V1_20214567.jar	Get hash	malicious	Browse	ip-api.com/json/
	zGRZdyh2nY.exe	Get hash	malicious	Browse	ip-api.com/json/
	ORDER40223.jar	Get hash	malicious	Browse	ip-api.com/json/
	seFGGGDFQm.exe	Get hash	malicious	Browse	ip-api.com/json/
	iwRDZ0zfWO.exe	Get hash	malicious	Browse	ip-api.com/json/
	Quotation.jar	Get hash	malicious	Browse	ip-api.com/json/
	UXQchSbnd5.exe	Get hash	malicious	Browse	ip-api.com/json
	NfKSHsfT14.exe	Get hash	malicious	Browse	ip-api.com/json/
	FW RE TEXGEEK INVOICE PACKING LIST - SCAN SOFT COPY.jar	Get hash	malicious	Browse	ip-api.com/json/
	ORDER.jar	Get hash	malicious	Browse	ip-api.com/json/
	68EThDrp2k.exe	Get hash	malicious	Browse	ip-api.com/json/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
discord.com	neL0w1KoM8.exe	Get hash	malicious	Browse	162.159.128.233
	Gen_1.8.9.exe	Get hash	malicious	Browse	162.159.136.232
	Og5HB9sISH.exe	Get hash	malicious	Browse	162.159.137.232
	t1YS17PfeB.exe	Get hash	malicious	Browse	162.159.138.232
	Launcher.exe	Get hash	malicious	Browse	162.159.138.232
	aMpHmoIHqo.exe	Get hash	malicious	Browse	162.159.135.232
	L1P38ikpUE.exe	Get hash	malicious	Browse	162.159.136.232
	mdD2CE9zE8.exe	Get hash	malicious	Browse	162.159.136.232
	6dUY4Cghru.exe	Get hash	malicious	Browse	162.159.135.232
	65h32BDkgF.exe	Get hash	malicious	Browse	162.159.136.232
	6Omi4NBljV.exe	Get hash	malicious	Browse	162.159.136.232
	rXYEUYrPOK.exe	Get hash	malicious	Browse	162.159.135.232
	gdO3AAyW8C.exe	Get hash	malicious	Browse	162.159.135.232
	mu4CoqbDEa.exe	Get hash	malicious	Browse	162.159.135.232
	test.exe	Get hash	malicious	Browse	162.159.128.233
	Lunar_Builder.exe	Get hash	malicious	Browse	162.159.128.233
	Lunar_Builder.exe	Get hash	malicious	Browse	162.159.128.233
	Y54o1vpvV6.exe	Get hash	malicious	Browse	162.159.135.232
	output.jar	Get hash	malicious	Browse	162.159.137.232
	output.jar	Get hash	malicious	Browse	162.159.136.232
ip-api.com	qu57kPofXM.exe	Get hash	malicious	Browse	208.95.112.1
	PDOC_P7U_20217218.jar	Get hash	malicious	Browse	208.95.112.1
	Quote.jar	Get hash	malicious	Browse	208.95.112.1
	mmKnM9A5kn.exe	Get hash	malicious	Browse	208.95.112.1
	XTDxFsa9vH.exe	Get hash	malicious	Browse	208.95.112.1
	Quote.jar	Get hash	malicious	Browse	208.95.112.1
	wg73ZsPasH.exe	Get hash	malicious	Browse	208.95.112.1
	Drawing and artwork.jar	Get hash	malicious	Browse	208.95.112.1
	Purchase Order.jar	Get hash	malicious	Browse	208.95.112.1
	doc_V1_20214567.jar	Get hash	malicious	Browse	208.95.112.1
	zGRZdyh2nY.exe	Get hash	malicious	Browse	208.95.112.1
	ORDER40223.jar	Get hash	malicious	Browse	208.95.112.1
	seFGGGDFQm.exe	Get hash	malicious	Browse	208.95.112.1
	iwRDZ0zfWO.exe	Get hash	malicious	Browse	208.95.112.1
	Quotation.jar	Get hash	malicious	Browse	208.95.112.1
	UXQchSbnd5.exe	Get hash	malicious	Browse	208.95.112.1
	NfKSHsfT14.exe	Get hash	malicious	Browse	208.95.112.1
	FW RE TEXGEEK INVOICE PACKING LIST - SCAN SOFT COPY.jar	Get hash	malicious	Browse	208.95.112.1
	ORDER.jar	Get hash	malicious	Browse	208.95.112.1
	68EThDrp2k.exe	Get hash	malicious	Browse	208.95.112.1

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
TUT-ASUS	qu57kPofXM.exe	Get hash	malicious	Browse	208.95.112.1
	WRpObsIa8q.exe	Get hash	malicious	Browse	208.95.112.1
	ACDC44F3C8B2B8B12A3E396A3D9F5D353D17DAB46B0E7.exe	Get hash	malicious	Browse	208.95.112.1
	kWhElUg959.exe	Get hash	malicious	Browse	208.95.112.1
	l9iqEhEbQg.exe	Get hash	malicious	Browse	208.95.112.1
	07985C9819097683B7F2BC59CC7D02E0497F012187E05.exe	Get hash	malicious	Browse	208.95.112.1
	PDOC_P7U_20217218.jar	Get hash	malicious	Browse	208.95.112.1
	Quote.jar	Get hash	malicious	Browse	208.95.112.1
	mmKnM9A5kn.exe	Get hash	malicious	Browse	208.95.112.1
	XTDxFsa9vH.exe	Get hash	malicious	Browse	208.95.112.1
	Quote.jar	Get hash	malicious	Browse	208.95.112.1
	wg73ZsPasH.exe	Get hash	malicious	Browse	208.95.112.1
	Drawing and artwork.jar	Get hash	malicious	Browse	208.95.112.1
	sp5q2BCFJ2.exe	Get hash	malicious	Browse	208.95.112.1
	D09MD2MjGx.exe	Get hash	malicious	Browse	208.95.112.1
	Purchase Order.jar	Get hash	malicious	Browse	208.95.112.1
	doc_V1_20214567.jar	Get hash	malicious	Browse	208.95.112.1
	zGRZdyh2nY.exe	Get hash	malicious	Browse	208.95.112.1
	ORDER40223.jar	Get hash	malicious	Browse	208.95.112.1
	53lnF4fzSf.exe	Get hash	malicious	Browse	208.95.112.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	Swift TT Copy.exe	Get hash	malicious	Browse	162.159.136.232 23.128.64.141
	qu57kPofXM.exe	Get hash	malicious	Browse	162.159.136.232 23.128.64.141
	9088890000.exe	Get hash	malicious	Browse	162.159.136.232 23.128.64.141
	Sales Quotation 309020032012.exe	Get hash	malicious	Browse	162.159.136.232 23.128.64.141
	Transfer.exe	Get hash	malicious	Browse	162.159.136.232 23.128.64.141
	NewProject-9072551776254517715425441524255614.exe	Get hash	malicious	Browse	162.159.136.232 23.128.64.141
	83736354Invoicereceipt.vbs	Get hash	malicious	Browse	162.159.136.232 23.128.64.141
	Sales Invoice_REG212004755711421641.vbs	Get hash	malicious	Browse	162.159.136.232 23.128.64.141
	4BC5E5B4CEDFD5EAD662697296DE264A0CED170C95024.exe	Get hash	malicious	Browse	162.159.136.232 23.128.64.141
	Invoice52190.vbs	Get hash	malicious	Browse	162.159.136.232 23.128.64.141
	7Dy4mYzkdq.exe	Get hash	malicious	Browse	162.159.136.232 23.128.64.141
	AVn7n82qq2.exe	Get hash	malicious	Browse	162.159.136.232 23.128.64.141
	YTHK21082400.exe	Get hash	malicious	Browse	162.159.136.232 23.128.64.141
	Invoice#52190.vbs	Get hash	malicious	Browse	162.159.136.232 23.128.64.141
	NEW PO MD25261-0.exe	Get hash	malicious	Browse	162.159.136.232 23.128.64.141
	4jof5V8Wjz.exe	Get hash	malicious	Browse	162.159.136.232 23.128.64.141
	Run.exe	Get hash	malicious	Browse	162.159.136.232 23.128.64.141
	August Report.exe	Get hash	malicious	Browse	162.159.136.232 23.128.64.141
	1evb6qEht9.exe	Get hash	malicious	Browse	162.159.136.232 23.128.64.141
	NBI Antiants Trading Pte ltd 09022021.exe	Get hash	malicious	Browse	162.159.136.232 23.128.64.141

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\XdPHZWGz4k.exe.log Download File
Process:	C:\Users\user\Desktop\XdPHZWGz4k.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	1799
Entropy (8bit):	5.361893338243769
Encrypted:	false
SSDEEP:	48:MxHKn1qHGiD0HKeGiYHKGD8AowHiUtHTG1hAHKKP5H+iJHj:iqnwmI0qerYqGgAowjtzG1eqKP5HD
MD5:	7C72A0359558EF0A97CAA33810868B61
SHA1:	CC99825605892992E8E457C83969B5162BEB704E
SHA-256:	CB3AC1DC0DAD731AE4FBDA51C20E3F4AE81CA68EB0AAE62C7316662FAA5B986C
SHA-512:	07D36B8FA82029DB355C493752B0DE9FDB8695944E34B48E976E66A7EA1C22E37F4726448788B6277EFC4D1447A02BF4100CABCE2901EF51BB04BBB9C3691DBE
Malicious:	true
Reputation:	low
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\10a17139182a9efd561f01fada9688a5\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\49e5c0579db170be9741dccc34c1998e\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\6d7d43e19d7fc0006285b85b7e2c8702\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\4e05e2e48b8a6dd267a8c9e25ef129a7\System.Core.ni.dll",0..3,"System.Net.Http, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System

C:\Users\user\AppData\Local\Temp\Capture.jpg Download File
Process:	C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, frames 3
Category:	dropped
Size (bytes):	95773
Entropy (8bit):	7.915869119873848
Encrypted:	false
SSDEEP:	1536:C90FTabpGYEv+8TEdebUnSZFtVC5mr9JHdbt77wJXQoHMJyDyjqdRAKoVW83lEWI:40Ebi+8TNKmr9J9t72AoHgyDy2aQO/Od
MD5:	2C1248D802F48CA9AF45001215E5B47B
SHA1:	CDF5841B0B6D3C772FF5A81DC8914E0923EA004D
SHA-256:	6566937FA65033883ECB330174B399AB50EDFCDAEE4EE5CD5C3B4802EA99A877
SHA-512:	D98404177F5BF2ED5438E5CFD599E7AEEDA3B64842623893340F3DB08B681890533891E563569AF4E3A1658D97AF8577A38038BD1973B3275EFE318AF6B1BBE1
Malicious:	false
Reputation:	low
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..01KK...lq\....xcS.m..#Hm.....T......<!...wq5...v1.?S.....rHj-.U:...5............\|..+.......}...<.>...H.......Wo.CK`/l.1./...C...W.....,1....R.0.W.M.!.l7.~S....."SW.^..c......^s........u,-n....A..?.2.....l.(.?....7..~.q$.f..1\.q[.....oS:.gOY".....f-%.P.b.Z....>.....4+..b.Y&..F...)Pq.L....... .....H.#.\|..).?.H.'.\|....).?m.....h.t......\|4.%...d....

C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe Download File
Process:	C:\Users\user\Desktop\XdPHZWGz4k.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	43008
Entropy (8bit):	5.35676780407349
Encrypted:	false
SSDEEP:	768:fpIa5EMf4LB//4MouZgLL5TjoWKZKfgm3Ehdw:pE04L9D6LL5TcWF7Erw
MD5:	E9A07674A035BB2A1E4F233C41269EDD
SHA1:	503908C418187BFC8F48533338AED01E667BF5FA
SHA-256:	C2603D684AD273865985EA6E7CE27C9236E173D7633A72F2378A1309D9EC77AC
SHA-512:	4EAE0FD13CD2503253361F018CF886733E586174879AD06BF02BB60C25651E0AF417B741083E4672DC05A822528B52AA77F7EA17678EC3D38428B0A272241215
Malicious:	true
Yara Hits:	Rule: JoeSecurity_MercurialGrabber, Description: Yara detected MercurialGrabber, Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe, Author: Joe Security Rule: MAL_Luna_Stealer_Apr_2021_1, Description: Detect Luna stealer (also Mercurial Grabber), Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe, Author: Arkbird_SOLG
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....0a............................>.... ........@.. ....................................@....................................W.................................................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................ .......H........U..`f..........................................................Rr...pr...p...(....&....0..........(....(......&r/..p(......(......&rq..p(......~....-........s.........~....s....(....(....(....(....(....(,...(-...(....(....(....r...p(......................... .......0..........(.......(....&>(....-..(....*..0..........s.....s........r...po......r...po......r...po......r...po......r...po..................r...p....r...p....rW..p....r...p....r\..p....r...p....r...p..

C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe:Zone.Identifier Download File
Process:	C:\Users\user\Desktop\XdPHZWGz4k.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\cookies.db Download File
Process:	C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.698304057893793
Encrypted:	false
SSDEEP:	24:TLbJLbXaFpEO5bNmISHn06UwcQPx5fBoIL4rtEy80:T5LLOpEO5J/Kn7U1uBoI+j
MD5:	3806E8153A55C1A2DA0B09461A9C882A
SHA1:	BD98AB2FB5E18FD94DC24BCE875087B5C3BB2F72
SHA-256:	366E8B53CE8CC27C0980AC532C2E9D372399877931AB0CEA075C62B3CB0F82BE
SHA-512:	31E96CC89795D80390432062466D542DBEA7DF31E3E8676DF370381BEDC720948085AD495A735FBDB75071DE45F3B8E470D809E863664990A79DEE8ADC648F1C
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................C....... ..g... .8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cookies.txt Download File
Process:	C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	431
Entropy (8bit):	5.49824680803594
Encrypted:	false
SSDEEP:	6:LGdfLYArfXoL2fgsQvYf6gOOr7kmuj+YJYcXzzUyXdfE9AxSVtoJXzxn:LbAJQAf6h2omBYWYWicten
MD5:	0412BA180099A76157398FAD82B88D4B
SHA1:	91035F0512C1CA7B3C3AC8569648FE89476D03FC
SHA-256:	895B70541C3E85731C2A0AC3727014ECE3AAFEF9035287ED8C5D9F2C539A025D
SHA-512:	4B2EBF6DADD812D0A1A81F91744B659A6777B47D6DA588F65583BF10B3AE4760D7607F083DA79A46CCD3A73E7E8C395D4756DE6B05C18EF8938A56711D696C5E
Malicious:	false
Preview:	---------------- mercurial grabber ----------------..value: 204=QrjkTg5JXqxqyd4TmsCYpHdW17gM9uxfBn2Kl-kRsWwWCa7yAyLJXVM2W7-t_R9kFxdQqd55q6FGrZH7amcoOdR5mIxRgQM4bOtUpE-PIMkcwlGdK4ak8EAJLYFmvUgx3Qo8MVGHG7Wa2K5PDgfDvp9W0aMnxRQw2JLHpkU6YcY..hostKey: .google.com..name: NID..expires: 4/1/2021 7:43:48 AM..---------------- mercurial grabber ----------------..value: Error in deryption..hostKey: ..name: ..expires: 12/31/1600 4:00:00 PM..

C:\Users\user\AppData\Local\Temp\login.db Download File
Process:	C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.792852251086831
Encrypted:	false
SSDEEP:	48:2i3nBA+IIY1PJzr9URCVE9V8MX0D0HSFlNUfAlGuGYFoNSs8LKvUf9KVyJ7hU:pBCJyC2V8MZyFl8AlG4oNFeymw
MD5:	81DB1710BB13DA3343FC0DF9F00BE49F
SHA1:	9B1F17E936D28684FFDFA962340C8872512270BB
SHA-256:	9F37C9EAF023F2308AF24F412CBD850330C4EF476A3F2E2078A95E38D0FACABB
SHA-512:	CF92D6C3109DAB31EF028724F21BAB120CF2F08F7139E55100292B266A363E579D14507F1865D5901E4B485947BE22574D1DBA815DE2886C118739C3370801F1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv Download File
Process:	C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	3246
Entropy (8bit):	5.242362287236144
Encrypted:	false
SSDEEP:	96:Ic5Sc5RzYCSKzII/zY9pbzczY76IwlwzN:IULzYCSKzjzY9pbzczYmIwlwzN
MD5:	608A055263D35AB60C915C9CFACF5EBA
SHA1:	C1F9C1D02C0B342D8553E95276D74F5EEB3B1BF3
SHA-256:	CF6DE04A72AC5262A62F396A339723DC28CF621504A731E6578A55D0C24C9B56
SHA-512:	E3C71F88E752380BB0557AFEC23C6A103610B99B344D442FF0D69D2373D2F75C8CEE4F6F788B81F5A20EB29B5518DAE3A621F7363B51630EB0F0165192A979DD
Malicious:	false
Preview:	{"status":"success","country":"Switzerland","countryCode":"CH","region":"ZH","regionName":"Zurich","city":"Zurich","zip":"8152","lat":47.43,"lon":8.5718,"timezone":"Europe/Zurich","isp":"Datacamp Limited","org":"Cdn77 ZUR ITX","as":"AS60068 Datacamp Limited","query":"84.17.52.41"}..Located: C:\Users\user\AppData\Local\Google\Chrome\User Data\default\Cookies..Response: {"id": "883254341631377448", "type": 0, "content": "", "channel_id": "882953645983957012", "author": {"bot": true, "id": "882954273980284939", "username": "Mercurial Grabber", "avatar": "7f65ce71f79129b3931cdf30d0e43798", "discriminator": "0000"}, "attachments": [{"id": "883254341446795304", "filename": "cookies.txt", "size": 431, "url": "https://cdn.discordapp.com/attachments/882953645983957012/883254341446795304/cookies.txt", "proxy_url": "https://media.discordapp.net/attachments/882953645983957012/883254341446795304/cookies.txt", "ephemeral": false, "content_type": "text/plain; charset=utf-8"}], "embeds": [], "mentio

Static File Info

General
File type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.35676780407349
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	XdPHZWGz4k.exe
File size:	43008
MD5:	e9a07674a035bb2a1e4f233c41269edd
SHA1:	503908c418187bfc8f48533338aed01e667bf5fa
SHA256:	c2603d684ad273865985ea6e7ce27c9236e173d7633a72f2378a1309d9ec77ac
SHA512:	4eae0fd13cd2503253361f018cf886733e586174879ad06bf02bb60c25651e0af417b741083e4672dc05a822528b52aa77f7ea17678ec3d38428b0a272241215
SSDEEP:	768:fpIa5EMf4LB//4MouZgLL5TjoWKZKfgm3Ehdw:pE04L9D6LL5TcWF7Erw
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....0a............................>.... ........@.. ....................................@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x40bc3e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x6130B983 [Thu Sep 2 11:46:11 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xbbe4	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc000	0x4e8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xe000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x9c44	0x9e00	False	0.445633900316	data	5.46587897325	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0xc000	0x4e8	0x600	False	0.374348958333	data	3.73067434635	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xe000	0xc	0x200	False	0.044921875	data	0.0815394123432	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0xc0a0	0x254	data
RT_MANIFEST	0xc2f8	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright
Assembly Version	0.0.0.0
InternalName	Discordpro.exe
FileVersion	0.0.0.0
ProductVersion	0.0.0.0
FileDescription
OriginalFilename	Discordpro.exe

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 3, 2021 09:36:49.057435036 CEST	49703	443	192.168.2.5	23.128.64.141
Sep 3, 2021 09:36:49.229325056 CEST	443	49703	23.128.64.141	192.168.2.5
Sep 3, 2021 09:36:49.229506969 CEST	49703	443	192.168.2.5	23.128.64.141
Sep 3, 2021 09:36:49.268707037 CEST	49703	443	192.168.2.5	23.128.64.141
Sep 3, 2021 09:36:49.437309027 CEST	443	49703	23.128.64.141	192.168.2.5
Sep 3, 2021 09:36:49.437490940 CEST	443	49703	23.128.64.141	192.168.2.5
Sep 3, 2021 09:36:49.437525034 CEST	443	49703	23.128.64.141	192.168.2.5
Sep 3, 2021 09:36:49.437561989 CEST	443	49703	23.128.64.141	192.168.2.5
Sep 3, 2021 09:36:49.437581062 CEST	443	49703	23.128.64.141	192.168.2.5
Sep 3, 2021 09:36:49.437639952 CEST	49703	443	192.168.2.5	23.128.64.141
Sep 3, 2021 09:36:49.438906908 CEST	443	49703	23.128.64.141	192.168.2.5
Sep 3, 2021 09:36:49.438968897 CEST	49703	443	192.168.2.5	23.128.64.141
Sep 3, 2021 09:36:49.446839094 CEST	49703	443	192.168.2.5	23.128.64.141
Sep 3, 2021 09:36:49.616676092 CEST	443	49703	23.128.64.141	192.168.2.5
Sep 3, 2021 09:36:49.658921003 CEST	49703	443	192.168.2.5	23.128.64.141
Sep 3, 2021 09:36:49.680253029 CEST	49703	443	192.168.2.5	23.128.64.141
Sep 3, 2021 09:36:49.851501942 CEST	443	49703	23.128.64.141	192.168.2.5
Sep 3, 2021 09:36:49.904702902 CEST	49703	443	192.168.2.5	23.128.64.141
Sep 3, 2021 09:36:50.057307959 CEST	49705	80	192.168.2.5	208.95.112.1
Sep 3, 2021 09:36:50.074826002 CEST	443	49703	23.128.64.141	192.168.2.5
Sep 3, 2021 09:36:50.074918032 CEST	49703	443	192.168.2.5	23.128.64.141
Sep 3, 2021 09:36:50.088340044 CEST	80	49705	208.95.112.1	192.168.2.5
Sep 3, 2021 09:36:50.088681936 CEST	49705	80	192.168.2.5	208.95.112.1
Sep 3, 2021 09:36:50.089360952 CEST	49705	80	192.168.2.5	208.95.112.1
Sep 3, 2021 09:36:50.124435902 CEST	80	49705	208.95.112.1	192.168.2.5
Sep 3, 2021 09:36:50.157114983 CEST	49705	80	192.168.2.5	208.95.112.1
Sep 3, 2021 09:36:50.187406063 CEST	80	49705	208.95.112.1	192.168.2.5
Sep 3, 2021 09:36:50.187705994 CEST	49705	80	192.168.2.5	208.95.112.1
Sep 3, 2021 09:36:50.267914057 CEST	49706	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:36:50.286261082 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:50.286425114 CEST	49706	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:36:50.289026976 CEST	49706	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:36:50.306045055 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:50.308727980 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:50.308764935 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:50.308784962 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:50.308828115 CEST	49706	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:36:50.317476034 CEST	49706	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:36:50.335148096 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:50.335191965 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:50.345371008 CEST	49706	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:36:50.364270926 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:50.364737988 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:50.371691942 CEST	49706	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:36:50.428880930 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:50.611587048 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:50.611622095 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:50.611639977 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:50.611785889 CEST	49706	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:36:50.722011089 CEST	49706	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:36:50.739475012 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:50.739804983 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:50.740295887 CEST	49706	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:36:50.757168055 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:51.033498049 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:51.033540010 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:51.033560991 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:51.033651114 CEST	49706	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:36:52.244416952 CEST	49706	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:36:52.262182951 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:52.262427092 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:52.265355110 CEST	49706	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:36:52.283458948 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:52.501601934 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:52.501627922 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:52.501636028 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:52.501827955 CEST	49706	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:36:52.581073046 CEST	49706	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:36:53.966547966 CEST	49706	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:36:53.983767986 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:53.983802080 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:53.984270096 CEST	49706	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:36:54.044907093 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:54.284583092 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:54.284621954 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:54.284641981 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:54.284751892 CEST	49706	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:36:54.284758091 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:54.284869909 CEST	49706	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:36:54.382169962 CEST	49706	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:36:54.398993969 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:54.399389982 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:54.399935961 CEST	49706	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:36:54.419656038 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:54.637525082 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:54.637551069 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:54.637562037 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:54.637576103 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:54.637587070 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:54.637629032 CEST	49706	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:36:54.637670040 CEST	49706	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:36:54.660801888 CEST	49706	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:36:54.677666903 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:54.677896023 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:54.678436041 CEST	49706	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:36:54.696005106 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:54.848018885 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:54.848066092 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:54.848094940 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:54.848187923 CEST	49706	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:36:55.000118017 CEST	49706	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:36:55.017035961 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:55.017437935 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:55.018064022 CEST	49706	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:36:55.018168926 CEST	49706	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:36:55.035140991 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:55.035233974 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:55.035268068 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:55.035295963 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:55.035327911 CEST	49706	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:36:55.035329103 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:55.035355091 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:55.035377026 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:55.035417080 CEST	49706	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:36:55.035504103 CEST	49706	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:36:55.052221060 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:55.052309036 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:55.052381039 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:55.052426100 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:55.052455902 CEST	49706	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:36:55.052488089 CEST	49706	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:36:55.052501917 CEST	49706	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:36:55.052501917 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:55.052562952 CEST	49706	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:36:55.052576065 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:55.052609921 CEST	49706	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:36:55.052665949 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:55.052666903 CEST	49706	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:36:55.052752972 CEST	49706	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:36:55.052947998 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:55.052966118 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:55.052984953 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:55.053004980 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:55.053025961 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:55.053050041 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:55.053070068 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:55.053071022 CEST	49706	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:36:55.069333076 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:55.069364071 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:55.069660902 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:55.069701910 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:55.069730043 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:55.069747925 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:55.069902897 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:55.069926023 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:55.070415974 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:55.070451021 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:55.070476055 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:55.070496082 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:55.070521116 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:55.070542097 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:55.070561886 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:55.070580006 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:55.384721994 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:55.384782076 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:55.384809971 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:55.384843111 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:55.384867907 CEST	443	49706	162.159.136.232	192.168.2.5
Sep 3, 2021 09:36:55.385132074 CEST	49706	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:36:55.927881002 CEST	49706	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:09.977664948 CEST	49709	443	192.168.2.5	23.128.64.141
Sep 3, 2021 09:37:10.143264055 CEST	443	49709	23.128.64.141	192.168.2.5
Sep 3, 2021 09:37:10.143395901 CEST	49709	443	192.168.2.5	23.128.64.141
Sep 3, 2021 09:37:10.208245993 CEST	49709	443	192.168.2.5	23.128.64.141
Sep 3, 2021 09:37:10.373959064 CEST	443	49709	23.128.64.141	192.168.2.5
Sep 3, 2021 09:37:10.374068975 CEST	443	49709	23.128.64.141	192.168.2.5
Sep 3, 2021 09:37:10.374092102 CEST	443	49709	23.128.64.141	192.168.2.5
Sep 3, 2021 09:37:10.374113083 CEST	443	49709	23.128.64.141	192.168.2.5
Sep 3, 2021 09:37:10.374128103 CEST	443	49709	23.128.64.141	192.168.2.5
Sep 3, 2021 09:37:10.374269009 CEST	49709	443	192.168.2.5	23.128.64.141
Sep 3, 2021 09:37:10.375483036 CEST	443	49709	23.128.64.141	192.168.2.5
Sep 3, 2021 09:37:10.382286072 CEST	49709	443	192.168.2.5	23.128.64.141
Sep 3, 2021 09:37:10.548654079 CEST	443	49709	23.128.64.141	192.168.2.5
Sep 3, 2021 09:37:10.598153114 CEST	49709	443	192.168.2.5	23.128.64.141
Sep 3, 2021 09:37:10.638497114 CEST	49709	443	192.168.2.5	23.128.64.141
Sep 3, 2021 09:37:10.805023909 CEST	443	49709	23.128.64.141	192.168.2.5
Sep 3, 2021 09:37:10.848181963 CEST	49709	443	192.168.2.5	23.128.64.141
Sep 3, 2021 09:37:10.849818945 CEST	49709	443	192.168.2.5	23.128.64.141
Sep 3, 2021 09:37:10.981976986 CEST	49710	80	192.168.2.5	208.95.112.1
Sep 3, 2021 09:37:11.013566017 CEST	80	49710	208.95.112.1	192.168.2.5
Sep 3, 2021 09:37:11.013711929 CEST	49710	80	192.168.2.5	208.95.112.1
Sep 3, 2021 09:37:11.015286922 CEST	443	49709	23.128.64.141	192.168.2.5
Sep 3, 2021 09:37:11.015371084 CEST	49709	443	192.168.2.5	23.128.64.141
Sep 3, 2021 09:37:11.022640944 CEST	49710	80	192.168.2.5	208.95.112.1
Sep 3, 2021 09:37:11.053447962 CEST	80	49710	208.95.112.1	192.168.2.5
Sep 3, 2021 09:37:11.071353912 CEST	49710	80	192.168.2.5	208.95.112.1
Sep 3, 2021 09:37:11.101521015 CEST	80	49710	208.95.112.1	192.168.2.5
Sep 3, 2021 09:37:11.101650000 CEST	49710	80	192.168.2.5	208.95.112.1
Sep 3, 2021 09:37:11.165251017 CEST	49711	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:11.182360888 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:11.183562040 CEST	49711	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:11.183614969 CEST	49711	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:11.200558901 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:11.203553915 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:11.203593016 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:11.203610897 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:11.203938007 CEST	49711	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:11.206516981 CEST	49711	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:11.223581076 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:11.224513054 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:11.232975960 CEST	49711	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:11.250032902 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:11.250972033 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:11.263655901 CEST	49711	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:11.280599117 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:11.443752050 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:11.443789005 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:11.443806887 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:11.445569038 CEST	49711	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:11.622864008 CEST	49711	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:11.640362024 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:11.640719891 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:11.641258955 CEST	49711	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:11.699563980 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:11.828006029 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:11.828025103 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:11.828171968 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:11.828229904 CEST	49711	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:11.879554033 CEST	49711	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:13.095133066 CEST	49711	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:13.112148046 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:13.112535000 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:13.112896919 CEST	49711	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:13.129815102 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:13.258764029 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:13.258795977 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:13.258811951 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:13.258902073 CEST	49711	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:15.013691902 CEST	49711	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:15.030632973 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:15.030795097 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:15.031188011 CEST	49711	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:15.048043966 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:15.266905069 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:15.266916990 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:15.266927004 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:15.266972065 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:15.266997099 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:15.267036915 CEST	49711	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:15.267061949 CEST	49711	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:15.386713028 CEST	49711	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:15.404858112 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:15.404886007 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:15.405307055 CEST	49711	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:15.467904091 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:15.652844906 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:15.652878046 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:15.652900934 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:15.652992010 CEST	49711	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:15.654797077 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:15.656980991 CEST	49711	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:15.696338892 CEST	49711	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:15.713417053 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:15.713685036 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:15.714330912 CEST	49711	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:15.731618881 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:15.919241905 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:15.919275045 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:15.919294119 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:15.919399977 CEST	49711	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:16.059125900 CEST	49711	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:16.076082945 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.076680899 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.077199936 CEST	49711	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:16.077301025 CEST	49711	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:16.095194101 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.095217943 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.095231056 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.095243931 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.095256090 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.095268965 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.095273972 CEST	49711	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:16.095279932 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.095297098 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.095310926 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.095321894 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.095330954 CEST	49711	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:16.095333099 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.095345020 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.095357895 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.095360041 CEST	49711	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:16.095371008 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.095376015 CEST	49711	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:16.095383883 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.095439911 CEST	49711	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:16.095473051 CEST	49711	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:16.112891912 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.112916946 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.112934113 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.113008976 CEST	49711	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:16.113070011 CEST	49711	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:16.113400936 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.113457918 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.113483906 CEST	49711	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:16.113509893 CEST	49711	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:16.113517046 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.113533020 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.113552094 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.113563061 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.113575935 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.113588095 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.113593102 CEST	49711	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:16.113604069 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.113617897 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.113631010 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.113641977 CEST	49711	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:16.113642931 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.113693953 CEST	49711	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:16.113807917 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.113820076 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.113831997 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.113842964 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.113862038 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.113867998 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.113879919 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.113890886 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.113898039 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.113905907 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.113915920 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.113930941 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.113943100 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.129981995 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.129986048 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.130004883 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.130018950 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.130021095 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.130029917 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.131474018 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.131493092 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.131688118 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.131701946 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.131711960 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.131724119 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.131738901 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.131753922 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.131764889 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.131777048 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.131788015 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.131799936 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.131813049 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.131824970 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.131840944 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.131880045 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.131891966 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.132240057 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.132291079 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.132303953 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.132316113 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.132327080 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.132359028 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.132371902 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.472306013 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.472342014 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.472364902 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.472405910 CEST	443	49711	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:16.472467899 CEST	49711	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:16.472538948 CEST	49711	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:16.879549026 CEST	49711	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:18.542769909 CEST	49714	443	192.168.2.5	23.128.64.141
Sep 3, 2021 09:37:18.708767891 CEST	443	49714	23.128.64.141	192.168.2.5
Sep 3, 2021 09:37:18.711146116 CEST	49714	443	192.168.2.5	23.128.64.141
Sep 3, 2021 09:37:18.804078102 CEST	49714	443	192.168.2.5	23.128.64.141
Sep 3, 2021 09:37:18.970084906 CEST	443	49714	23.128.64.141	192.168.2.5
Sep 3, 2021 09:37:18.970263004 CEST	443	49714	23.128.64.141	192.168.2.5
Sep 3, 2021 09:37:18.970360041 CEST	443	49714	23.128.64.141	192.168.2.5
Sep 3, 2021 09:37:18.970383883 CEST	443	49714	23.128.64.141	192.168.2.5
Sep 3, 2021 09:37:18.970400095 CEST	443	49714	23.128.64.141	192.168.2.5
Sep 3, 2021 09:37:18.970434904 CEST	49714	443	192.168.2.5	23.128.64.141
Sep 3, 2021 09:37:18.970479012 CEST	49714	443	192.168.2.5	23.128.64.141
Sep 3, 2021 09:37:18.971657991 CEST	443	49714	23.128.64.141	192.168.2.5
Sep 3, 2021 09:37:18.974761963 CEST	49714	443	192.168.2.5	23.128.64.141
Sep 3, 2021 09:37:19.141371965 CEST	443	49714	23.128.64.141	192.168.2.5
Sep 3, 2021 09:37:19.192617893 CEST	49714	443	192.168.2.5	23.128.64.141
Sep 3, 2021 09:37:19.260559082 CEST	49714	443	192.168.2.5	23.128.64.141
Sep 3, 2021 09:37:19.428961039 CEST	443	49714	23.128.64.141	192.168.2.5
Sep 3, 2021 09:37:19.473912954 CEST	49714	443	192.168.2.5	23.128.64.141
Sep 3, 2021 09:37:19.500025988 CEST	49714	443	192.168.2.5	23.128.64.141
Sep 3, 2021 09:37:19.666121960 CEST	443	49714	23.128.64.141	192.168.2.5
Sep 3, 2021 09:37:19.666198015 CEST	49714	443	192.168.2.5	23.128.64.141
Sep 3, 2021 09:37:19.741219044 CEST	49715	80	192.168.2.5	208.95.112.1
Sep 3, 2021 09:37:19.771531105 CEST	80	49715	208.95.112.1	192.168.2.5
Sep 3, 2021 09:37:19.772037029 CEST	49715	80	192.168.2.5	208.95.112.1
Sep 3, 2021 09:37:19.955610991 CEST	49715	80	192.168.2.5	208.95.112.1
Sep 3, 2021 09:37:19.987907887 CEST	80	49715	208.95.112.1	192.168.2.5
Sep 3, 2021 09:37:20.019402027 CEST	49715	80	192.168.2.5	208.95.112.1
Sep 3, 2021 09:37:20.049715996 CEST	80	49715	208.95.112.1	192.168.2.5
Sep 3, 2021 09:37:20.050971985 CEST	49715	80	192.168.2.5	208.95.112.1
Sep 3, 2021 09:37:20.166126013 CEST	49716	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:20.182893038 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:20.184540987 CEST	49716	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:20.185312033 CEST	49716	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:20.202045918 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:20.204804897 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:20.204840899 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:20.204862118 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:20.204974890 CEST	49716	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:20.208074093 CEST	49716	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:20.224781990 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:20.225089073 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:20.233939886 CEST	49716	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:20.250705004 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:20.251024008 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:20.252237082 CEST	49716	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:20.268939972 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:20.524111986 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:20.524132967 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:20.524154902 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:20.524414062 CEST	49716	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:20.567742109 CEST	49716	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:20.660248995 CEST	49716	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:20.677063942 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:20.677484989 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:20.678220987 CEST	49716	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:20.735560894 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:20.896529913 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:20.896558046 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:20.896572113 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:20.896689892 CEST	49716	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:20.958439112 CEST	49716	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:23.262741089 CEST	49716	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:23.281050920 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:23.281083107 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:23.281507015 CEST	49716	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:23.299037933 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:23.467211008 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:23.467247963 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:23.467261076 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:23.467353106 CEST	49716	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:23.598180056 CEST	49716	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:24.965450048 CEST	49716	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:24.986587048 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:24.986613035 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:24.986960888 CEST	49716	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:25.007522106 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:25.201596022 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:25.201630116 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:25.201647997 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:25.201697111 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:25.201814890 CEST	49716	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:25.201852083 CEST	49716	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:25.202986956 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:25.331506968 CEST	49716	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:25.348386049 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:25.348778009 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:25.349409103 CEST	49716	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:25.408164024 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:25.617846012 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:25.617868900 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:25.617937088 CEST	49716	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:25.618912935 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:25.661977053 CEST	49716	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:25.665409088 CEST	49716	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:25.683660030 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:25.683830976 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:25.684319019 CEST	49716	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:25.703548908 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:25.899271965 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:25.899305105 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:25.899322033 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:25.899456978 CEST	49716	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:26.014791965 CEST	49716	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:26.031555891 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.031948090 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.032780886 CEST	49716	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:26.033008099 CEST	49716	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:26.049537897 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.049702883 CEST	49716	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:26.049746037 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.049838066 CEST	49716	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:26.049859047 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.049876928 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.049911976 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.049916029 CEST	49716	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:26.049942970 CEST	49716	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:26.049946070 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.049966097 CEST	49716	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:26.049977064 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.050007105 CEST	49716	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:26.050012112 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.050060987 CEST	49716	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:26.050062895 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.050096035 CEST	49716	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:26.050113916 CEST	49716	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:26.050132036 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.050309896 CEST	49716	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:26.050352097 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.050367117 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.050378084 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.050416946 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.050417900 CEST	49716	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:26.050455093 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.050631046 CEST	49716	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:26.050674915 CEST	49716	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:26.050697088 CEST	49716	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:26.066911936 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.066943884 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.066956043 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.066970110 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.066987038 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.067003012 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.067018032 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.067034006 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.067049026 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.067063093 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.067073107 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.067260027 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.067306995 CEST	49716	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:26.067322969 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.067339897 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.067349911 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.067364931 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.067378998 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.067394972 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.067409039 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.067423105 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.067437887 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.067461014 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.067476034 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.067523956 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.067544937 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.067575932 CEST	49716	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:26.067616940 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.067634106 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.067648888 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.067663908 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.067732096 CEST	49716	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:26.067859888 CEST	49716	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:26.084290028 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.084311008 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.084321976 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.084332943 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.084367037 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.084377050 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.084383011 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.084392071 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.084403038 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.084409952 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.084422112 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.084436893 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.084450006 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.084460020 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.084494114 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.084505081 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.084516048 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.084537983 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.084548950 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.084558964 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.085009098 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.085021973 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.085052013 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.085066080 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.085078001 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.085150957 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.085165024 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.085179090 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.085187912 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.085199118 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.725193024 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.725234032 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.725253105 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.725265026 CEST	443	49716	162.159.136.232	192.168.2.5
Sep 3, 2021 09:37:26.725310087 CEST	49716	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:26.725341082 CEST	49716	443	192.168.2.5	162.159.136.232
Sep 3, 2021 09:37:27.046689987 CEST	49716	443	192.168.2.5	162.159.136.232

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 3, 2021 09:36:40.422548056 CEST	49557	53	192.168.2.5	8.8.8.8
Sep 3, 2021 09:36:40.457808018 CEST	53	49557	8.8.8.8	192.168.2.5
Sep 3, 2021 09:36:48.850415945 CEST	61733	53	192.168.2.5	8.8.8.8
Sep 3, 2021 09:36:49.002762079 CEST	53	61733	8.8.8.8	192.168.2.5
Sep 3, 2021 09:36:49.998277903 CEST	65447	53	192.168.2.5	8.8.8.8
Sep 3, 2021 09:36:50.029314995 CEST	53	65447	8.8.8.8	192.168.2.5
Sep 3, 2021 09:36:50.227045059 CEST	52441	53	192.168.2.5	8.8.8.8
Sep 3, 2021 09:36:50.266338110 CEST	53	52441	8.8.8.8	192.168.2.5
Sep 3, 2021 09:36:52.367176056 CEST	62176	53	192.168.2.5	8.8.8.8
Sep 3, 2021 09:36:52.401830912 CEST	53	62176	8.8.8.8	192.168.2.5
Sep 3, 2021 09:37:09.893829107 CEST	59596	53	192.168.2.5	8.8.8.8
Sep 3, 2021 09:37:09.929538965 CEST	53	59596	8.8.8.8	192.168.2.5
Sep 3, 2021 09:37:10.949671984 CEST	65296	53	192.168.2.5	8.8.8.8
Sep 3, 2021 09:37:10.978903055 CEST	53	65296	8.8.8.8	192.168.2.5
Sep 3, 2021 09:37:11.127887964 CEST	63183	53	192.168.2.5	8.8.8.8
Sep 3, 2021 09:37:11.162992001 CEST	53	63183	8.8.8.8	192.168.2.5
Sep 3, 2021 09:37:13.111938953 CEST	60151	53	192.168.2.5	8.8.8.8
Sep 3, 2021 09:37:13.144707918 CEST	53	60151	8.8.8.8	192.168.2.5
Sep 3, 2021 09:37:18.266988039 CEST	56969	53	192.168.2.5	8.8.8.8
Sep 3, 2021 09:37:18.302408934 CEST	53	56969	8.8.8.8	192.168.2.5
Sep 3, 2021 09:37:19.659853935 CEST	55161	53	192.168.2.5	8.8.8.8
Sep 3, 2021 09:37:19.684915066 CEST	53	55161	8.8.8.8	192.168.2.5
Sep 3, 2021 09:37:20.132148981 CEST	54757	53	192.168.2.5	8.8.8.8
Sep 3, 2021 09:37:20.164968014 CEST	53	54757	8.8.8.8	192.168.2.5
Sep 3, 2021 09:37:42.340838909 CEST	49992	53	192.168.2.5	8.8.8.8
Sep 3, 2021 09:37:42.389245987 CEST	53	49992	8.8.8.8	192.168.2.5
Sep 3, 2021 09:37:48.814786911 CEST	60075	53	192.168.2.5	8.8.8.8
Sep 3, 2021 09:37:48.850517988 CEST	53	60075	8.8.8.8	192.168.2.5
Sep 3, 2021 09:37:52.766640902 CEST	55016	53	192.168.2.5	8.8.8.8
Sep 3, 2021 09:37:52.802099943 CEST	53	55016	8.8.8.8	192.168.2.5
Sep 3, 2021 09:38:24.051495075 CEST	64345	53	192.168.2.5	8.8.8.8
Sep 3, 2021 09:38:24.087476969 CEST	53	64345	8.8.8.8	192.168.2.5
Sep 3, 2021 09:38:26.394675016 CEST	57128	53	192.168.2.5	8.8.8.8
Sep 3, 2021 09:38:26.435735941 CEST	53	57128	8.8.8.8	192.168.2.5
Sep 3, 2021 09:38:57.171926022 CEST	54791	53	192.168.2.5	8.8.8.8
Sep 3, 2021 09:38:57.210242987 CEST	53	54791	8.8.8.8	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Sep 3, 2021 09:36:48.850415945 CEST	192.168.2.5	8.8.8.8	0xc7cf	Standard query (0)	ip4.seeip.org	A (IP address)	IN (0x0001)
Sep 3, 2021 09:36:49.998277903 CEST	192.168.2.5	8.8.8.8	0x42ea	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)
Sep 3, 2021 09:36:50.227045059 CEST	192.168.2.5	8.8.8.8	0x29e4	Standard query (0)	discord.com	A (IP address)	IN (0x0001)
Sep 3, 2021 09:37:09.893829107 CEST	192.168.2.5	8.8.8.8	0xffe7	Standard query (0)	ip4.seeip.org	A (IP address)	IN (0x0001)
Sep 3, 2021 09:37:10.949671984 CEST	192.168.2.5	8.8.8.8	0xbfbb	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)
Sep 3, 2021 09:37:11.127887964 CEST	192.168.2.5	8.8.8.8	0xae9a	Standard query (0)	discord.com	A (IP address)	IN (0x0001)
Sep 3, 2021 09:37:18.266988039 CEST	192.168.2.5	8.8.8.8	0xdeb6	Standard query (0)	ip4.seeip.org	A (IP address)	IN (0x0001)
Sep 3, 2021 09:37:19.659853935 CEST	192.168.2.5	8.8.8.8	0x64e4	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)
Sep 3, 2021 09:37:20.132148981 CEST	192.168.2.5	8.8.8.8	0x9850	Standard query (0)	discord.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Sep 3, 2021 09:36:49.002762079 CEST	8.8.8.8	192.168.2.5	0xc7cf	No error (0)	ip4.seeip.org	23.128.64.141	A (IP address)	IN (0x0001)
Sep 3, 2021 09:36:50.029314995 CEST	8.8.8.8	192.168.2.5	0x42ea	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)
Sep 3, 2021 09:36:50.266338110 CEST	8.8.8.8	192.168.2.5	0x29e4	No error (0)	discord.com	162.159.136.232	A (IP address)	IN (0x0001)
Sep 3, 2021 09:36:50.266338110 CEST	8.8.8.8	192.168.2.5	0x29e4	No error (0)	discord.com	162.159.137.232	A (IP address)	IN (0x0001)
Sep 3, 2021 09:36:50.266338110 CEST	8.8.8.8	192.168.2.5	0x29e4	No error (0)	discord.com	162.159.128.233	A (IP address)	IN (0x0001)
Sep 3, 2021 09:36:50.266338110 CEST	8.8.8.8	192.168.2.5	0x29e4	No error (0)	discord.com	162.159.135.232	A (IP address)	IN (0x0001)
Sep 3, 2021 09:36:50.266338110 CEST	8.8.8.8	192.168.2.5	0x29e4	No error (0)	discord.com	162.159.138.232	A (IP address)	IN (0x0001)
Sep 3, 2021 09:37:09.929538965 CEST	8.8.8.8	192.168.2.5	0xffe7	No error (0)	ip4.seeip.org	23.128.64.141	A (IP address)	IN (0x0001)
Sep 3, 2021 09:37:10.978903055 CEST	8.8.8.8	192.168.2.5	0xbfbb	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)
Sep 3, 2021 09:37:11.162992001 CEST	8.8.8.8	192.168.2.5	0xae9a	No error (0)	discord.com	162.159.136.232	A (IP address)	IN (0x0001)
Sep 3, 2021 09:37:11.162992001 CEST	8.8.8.8	192.168.2.5	0xae9a	No error (0)	discord.com	162.159.137.232	A (IP address)	IN (0x0001)
Sep 3, 2021 09:37:11.162992001 CEST	8.8.8.8	192.168.2.5	0xae9a	No error (0)	discord.com	162.159.128.233	A (IP address)	IN (0x0001)
Sep 3, 2021 09:37:11.162992001 CEST	8.8.8.8	192.168.2.5	0xae9a	No error (0)	discord.com	162.159.135.232	A (IP address)	IN (0x0001)
Sep 3, 2021 09:37:11.162992001 CEST	8.8.8.8	192.168.2.5	0xae9a	No error (0)	discord.com	162.159.138.232	A (IP address)	IN (0x0001)
Sep 3, 2021 09:37:18.302408934 CEST	8.8.8.8	192.168.2.5	0xdeb6	No error (0)	ip4.seeip.org	23.128.64.141	A (IP address)	IN (0x0001)
Sep 3, 2021 09:37:19.684915066 CEST	8.8.8.8	192.168.2.5	0x64e4	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)
Sep 3, 2021 09:37:20.164968014 CEST	8.8.8.8	192.168.2.5	0x9850	No error (0)	discord.com	162.159.136.232	A (IP address)	IN (0x0001)
Sep 3, 2021 09:37:20.164968014 CEST	8.8.8.8	192.168.2.5	0x9850	No error (0)	discord.com	162.159.137.232	A (IP address)	IN (0x0001)
Sep 3, 2021 09:37:20.164968014 CEST	8.8.8.8	192.168.2.5	0x9850	No error (0)	discord.com	162.159.128.233	A (IP address)	IN (0x0001)
Sep 3, 2021 09:37:20.164968014 CEST	8.8.8.8	192.168.2.5	0x9850	No error (0)	discord.com	162.159.135.232	A (IP address)	IN (0x0001)
Sep 3, 2021 09:37:20.164968014 CEST	8.8.8.8	192.168.2.5	0x9850	No error (0)	discord.com	162.159.138.232	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.5	49705	208.95.112.1	80	C:\Users\user\Desktop\XdPHZWGz4k.exe

Timestamp	kBytes transferred	Direction	Data
Sep 3, 2021 09:36:50.089360952 CEST	1039	OUT	GET //json/84.17.52.41 HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Sep 3, 2021 09:36:50.124435902 CEST	1040	IN	HTTP/1.1 200 OK Date: Fri, 03 Sep 2021 07:36:49 GMT Content-Type: application/json; charset=utf-8 Content-Length: 281 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 53 77 69 74 7a 65 72 6c 61 6e 64 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 43 48 22 2c 22 72 65 67 69 6f 6e 22 3a 22 5a 48 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 5a 75 72 69 63 68 22 2c 22 63 69 74 79 22 3a 22 5a 75 72 69 63 68 22 2c 22 7a 69 70 22 3a 22 38 31 35 32 22 2c 22 6c 61 74 22 3a 34 37 2e 34 33 2c 22 6c 6f 6e 22 3a 38 2e 35 37 31 38 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 45 75 72 6f 70 65 2f 5a 75 72 69 63 68 22 2c 22 69 73 70 22 3a 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 6f 72 67 22 3a 22 43 64 6e 37 37 20 5a 55 52 20 49 54 58 22 2c 22 61 73 22 3a 22 41 53 36 30 30 36 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 71 75 65 72 79 22 3a 22 38 34 2e 31 37 2e 35 32 2e 34 31 22 7d Data Ascii: {"status":"success","country":"Switzerland","countryCode":"CH","region":"ZH","regionName":"Zurich","city":"Zurich","zip":"8152","lat":47.43,"lon":8.5718,"timezone":"Europe/Zurich","isp":"Datacamp Limited","org":"Cdn77 ZUR ITX","as":"AS60068 Datacamp Limited","query":"84.17.52.41"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.5	49710	208.95.112.1	80	C:\Users\user\Desktop\XdPHZWGz4k.exe

Timestamp	kBytes transferred	Direction	Data
Sep 3, 2021 09:37:11.022640944 CEST	1182	OUT	GET //json/84.17.52.41 HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Sep 3, 2021 09:37:11.053447962 CEST	1182	IN	HTTP/1.1 200 OK Date: Fri, 03 Sep 2021 07:37:10 GMT Content-Type: application/json; charset=utf-8 Content-Length: 281 Access-Control-Allow-Origin: * X-Ttl: 39 X-Rl: 43 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 53 77 69 74 7a 65 72 6c 61 6e 64 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 43 48 22 2c 22 72 65 67 69 6f 6e 22 3a 22 5a 48 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 5a 75 72 69 63 68 22 2c 22 63 69 74 79 22 3a 22 5a 75 72 69 63 68 22 2c 22 7a 69 70 22 3a 22 38 31 35 32 22 2c 22 6c 61 74 22 3a 34 37 2e 34 33 2c 22 6c 6f 6e 22 3a 38 2e 35 37 31 38 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 45 75 72 6f 70 65 2f 5a 75 72 69 63 68 22 2c 22 69 73 70 22 3a 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 6f 72 67 22 3a 22 43 64 6e 37 37 20 5a 55 52 20 49 54 58 22 2c 22 61 73 22 3a 22 41 53 36 30 30 36 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 71 75 65 72 79 22 3a 22 38 34 2e 31 37 2e 35 32 2e 34 31 22 7d Data Ascii: {"status":"success","country":"Switzerland","countryCode":"CH","region":"ZH","regionName":"Zurich","city":"Zurich","zip":"8152","lat":47.43,"lon":8.5718,"timezone":"Europe/Zurich","isp":"Datacamp Limited","org":"Cdn77 ZUR ITX","as":"AS60068 Datacamp Limited","query":"84.17.52.41"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.5	49715	208.95.112.1	80	C:\Users\user\Desktop\XdPHZWGz4k.exe

Timestamp	kBytes transferred	Direction	Data
Sep 3, 2021 09:37:19.955610991 CEST	1338	OUT	GET //json/84.17.52.41 HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Sep 3, 2021 09:37:19.987907887 CEST	1339	IN	HTTP/1.1 200 OK Date: Fri, 03 Sep 2021 07:37:19 GMT Content-Type: application/json; charset=utf-8 Content-Length: 281 Access-Control-Allow-Origin: * X-Ttl: 30 X-Rl: 42 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 53 77 69 74 7a 65 72 6c 61 6e 64 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 43 48 22 2c 22 72 65 67 69 6f 6e 22 3a 22 5a 48 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 5a 75 72 69 63 68 22 2c 22 63 69 74 79 22 3a 22 5a 75 72 69 63 68 22 2c 22 7a 69 70 22 3a 22 38 31 35 32 22 2c 22 6c 61 74 22 3a 34 37 2e 34 33 2c 22 6c 6f 6e 22 3a 38 2e 35 37 31 38 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 45 75 72 6f 70 65 2f 5a 75 72 69 63 68 22 2c 22 69 73 70 22 3a 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 6f 72 67 22 3a 22 43 64 6e 37 37 20 5a 55 52 20 49 54 58 22 2c 22 61 73 22 3a 22 41 53 36 30 30 36 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 71 75 65 72 79 22 3a 22 38 34 2e 31 37 2e 35 32 2e 34 31 22 7d Data Ascii: {"status":"success","country":"Switzerland","countryCode":"CH","region":"ZH","regionName":"Zurich","city":"Zurich","zip":"8152","lat":47.43,"lon":8.5718,"timezone":"Europe/Zurich","isp":"Datacamp Limited","org":"Cdn77 ZUR ITX","as":"AS60068 Datacamp Limited","query":"84.17.52.41"}

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Sep 3, 2021 09:36:49.438906908 CEST	23.128.64.141	443	192.168.2.5	49703	CN=ip.seeip.org CN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US	CN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.	Sun Aug 29 12:20:28 CEST 2021 Fri Sep 04 02:00:00 CEST 2020 Wed Jan 20 20:14:03 CET 2021	Sat Nov 27 11:20:27 CET 2021 Mon Sep 15 18:00:00 CEST 2025 Mon Sep 30 20:14:03 CEST 2024	769,49162-49161-49172-49171-53-47-10,0-10-11-35-23-65281,29-23-24,0	54328bd36c14bd82ddaa0c04b25ed9ad
					CN=R3, O=Let's Encrypt, C=US	CN=ISRG Root X1, O=Internet Security Research Group, C=US	Fri Sep 04 02:00:00 CEST 2020	Mon Sep 15 18:00:00 CEST 2025
					CN=ISRG Root X1, O=Internet Security Research Group, C=US	CN=DST Root CA X3, O=Digital Signature Trust Co.	Wed Jan 20 20:14:03 CET 2021	Mon Sep 30 20:14:03 CEST 2024
Sep 3, 2021 09:36:50.308784962 CEST	162.159.136.232	443	192.168.2.5	49706	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=CA, C=US CN=Cloudflare Inc RSA CA-2, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc RSA CA-2, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Tue Jan 19 01:00:00 CET 2021 Mon Jan 27 13:46:39 CET 2020	Wed Jan 19 00:59:59 CET 2022 Wed Jan 01 00:59:59 CET 2025	769,49162-49161-49172-49171-53-47-10,0-10-11-35-23-65281,29-23-24,0	54328bd36c14bd82ddaa0c04b25ed9ad
Sep 3, 2021 09:36:50.308784962 CEST	162.159.136.232	443	192.168.2.5	49706	CN=Cloudflare Inc RSA CA-2, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:46:39 CET 2020	Wed Jan 01 00:59:59 CET 2025		54328bd36c14bd82ddaa0c04b25ed9ad
Sep 3, 2021 09:37:10.375483036 CEST	23.128.64.141	443	192.168.2.5	49709	CN=ip.seeip.org CN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US	CN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.	Sun Aug 29 12:20:28 CEST 2021 Fri Sep 04 02:00:00 CEST 2020 Wed Jan 20 20:14:03 CET 2021	Sat Nov 27 11:20:27 CET 2021 Mon Sep 15 18:00:00 CEST 2025 Mon Sep 30 20:14:03 CEST 2024	769,49162-49161-49172-49171-53-47-10,0-10-11-35-23-65281,29-23-24,0	54328bd36c14bd82ddaa0c04b25ed9ad
					CN=R3, O=Let's Encrypt, C=US	CN=ISRG Root X1, O=Internet Security Research Group, C=US	Fri Sep 04 02:00:00 CEST 2020	Mon Sep 15 18:00:00 CEST 2025
					CN=ISRG Root X1, O=Internet Security Research Group, C=US	CN=DST Root CA X3, O=Digital Signature Trust Co.	Wed Jan 20 20:14:03 CET 2021	Mon Sep 30 20:14:03 CEST 2024
Sep 3, 2021 09:37:11.203610897 CEST	162.159.136.232	443	192.168.2.5	49711	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=CA, C=US CN=Cloudflare Inc RSA CA-2, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc RSA CA-2, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Tue Jan 19 01:00:00 CET 2021 Mon Jan 27 13:46:39 CET 2020	Wed Jan 19 00:59:59 CET 2022 Wed Jan 01 00:59:59 CET 2025	769,49162-49161-49172-49171-53-47-10,0-10-11-35-23-65281,29-23-24,0	54328bd36c14bd82ddaa0c04b25ed9ad
Sep 3, 2021 09:37:11.203610897 CEST	162.159.136.232	443	192.168.2.5	49711	CN=Cloudflare Inc RSA CA-2, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:46:39 CET 2020	Wed Jan 01 00:59:59 CET 2025		54328bd36c14bd82ddaa0c04b25ed9ad
Sep 3, 2021 09:37:18.971657991 CEST	23.128.64.141	443	192.168.2.5	49714	CN=ip.seeip.org CN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US	CN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.	Sun Aug 29 12:20:28 CEST 2021 Fri Sep 04 02:00:00 CEST 2020 Wed Jan 20 20:14:03 CET 2021	Sat Nov 27 11:20:27 CET 2021 Mon Sep 15 18:00:00 CEST 2025 Mon Sep 30 20:14:03 CEST 2024	769,49162-49161-49172-49171-53-47-10,0-10-11-35-23-65281,29-23-24,0	54328bd36c14bd82ddaa0c04b25ed9ad
					CN=R3, O=Let's Encrypt, C=US	CN=ISRG Root X1, O=Internet Security Research Group, C=US	Fri Sep 04 02:00:00 CEST 2020	Mon Sep 15 18:00:00 CEST 2025
					CN=ISRG Root X1, O=Internet Security Research Group, C=US	CN=DST Root CA X3, O=Digital Signature Trust Co.	Wed Jan 20 20:14:03 CET 2021	Mon Sep 30 20:14:03 CEST 2024
Sep 3, 2021 09:37:20.204862118 CEST	162.159.136.232	443	192.168.2.5	49716	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=CA, C=US CN=Cloudflare Inc RSA CA-2, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc RSA CA-2, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Tue Jan 19 01:00:00 CET 2021 Mon Jan 27 13:46:39 CET 2020	Wed Jan 19 00:59:59 CET 2022 Wed Jan 01 00:59:59 CET 2025	769,49162-49161-49172-49171-53-47-10,0-10-11-35-23-65281,29-23-24,0	54328bd36c14bd82ddaa0c04b25ed9ad
Sep 3, 2021 09:37:20.204862118 CEST	162.159.136.232	443	192.168.2.5	49716	CN=Cloudflare Inc RSA CA-2, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:46:39 CET 2020	Wed Jan 01 00:59:59 CET 2025		54328bd36c14bd82ddaa0c04b25ed9ad

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: XdPHZWGz4k.exe PID: 6384 Parent PID: 2200

General

Start time:	09:36:46
Start date:	03/09/2021
Path:	C:\Users\user\Desktop\XdPHZWGz4k.exe
Wow64 process (32bit):	false
Commandline:	'C:\Users\user\Desktop\XdPHZWGz4k.exe'
Imagebase:	0x3a0000
File size:	43008 bytes
MD5 hash:	E9A07674A035BB2A1E4F233C41269EDD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_MercurialGrabber, Description: Yara detected MercurialGrabber, Source: 00000001.00000002.273139663.00000000003A2000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_MercurialGrabber, Description: Yara detected MercurialGrabber, Source: 00000001.00000000.253502407.00000000003A2000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_MercurialGrabber, Description: Yara detected MercurialGrabber, Source: 00000001.00000003.272744068.000000001C9D5000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: conhost.exe PID: 6424 Parent PID: 6384

General

Start time:	09:36:47
Start date:	03/09/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: XdPHZWGz4k.exe PID: 3208 Parent PID: 3472

General

Start time:	09:37:08
Start date:	03/09/2021
Path:	C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe
Wow64 process (32bit):	false
Commandline:	'C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe'
Imagebase:	0xbc0000
File size:	43008 bytes
MD5 hash:	E9A07674A035BB2A1E4F233C41269EDD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_MercurialGrabber, Description: Yara detected MercurialGrabber, Source: 0000000C.00000000.298642309.0000000000BC2000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_MercurialGrabber, Description: Yara detected MercurialGrabber, Source: 0000000C.00000002.318186750.0000000000BC2000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_MercurialGrabber, Description: Yara detected MercurialGrabber, Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe, Author: Joe Security Rule: MAL_Luna_Stealer_Apr_2021_1, Description: Detect Luna stealer (also Mercurial Grabber), Source: C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe, Author: Arkbird_SOLG
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Chronological Activities

Analysis Process: conhost.exe PID: 5116 Parent PID: 3208

General

Start time:	09:37:08
Start date:	03/09/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: XdPHZWGz4k.exe PID: 6372 Parent PID: 3472

General

Start time:	09:37:16
Start date:	03/09/2021
Path:	C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe
Wow64 process (32bit):	false
Commandline:	'C:\Users\user\AppData\Local\Temp\XdPHZWGz4k.exe'
Imagebase:	0xaf0000
File size:	43008 bytes
MD5 hash:	E9A07674A035BB2A1E4F233C41269EDD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_MercurialGrabber, Description: Yara detected MercurialGrabber, Source: 00000010.00000002.339741238.0000000000AF2000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_MercurialGrabber, Description: Yara detected MercurialGrabber, Source: 00000010.00000000.315911277.0000000000AF2000.00000002.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: conhost.exe PID: 6320 Parent PID: 6372

General

Start time:	09:37:16
Start date:	03/09/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: XdPHZWGz4k.exe PID: 6384 Parent PID: 2200 XdPHZWGz4k.exeCOMMON

Executed Functions

Function 00007FFA168061E6, Relevance: 1.7, Strings: 1, Instructions: 474COMMON

Download Yara Rule

Strings

8ep, xrefs: 00007FFA168063E9

Memory Dump Source

Source File: 00000001.00000002.276056622.00007FFA16800000.00000040.00000001.sdmp, Offset: 00007FFA16800000, based on PE: false

Similarity

API ID:
String ID: 8ep
API String ID: 0-1229559252
Opcode ID: 53532283e27a9e73524d3e189973b87c9f7bd625c544a5f7fc638c0bd3890497
Instruction ID: 3fa744b4b0841753e3496d878cbc90a33b11c5f8661793f749dd041150e14394
Opcode Fuzzy Hash: 53532283e27a9e73524d3e189973b87c9f7bd625c544a5f7fc638c0bd3890497
Instruction Fuzzy Hash: E4F1C430908E4D8FEBA8DF28D8567E937D1FF59310F14866EE84DC7291DB34A8818B81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1680B24E, Relevance: 1.7, APIs: 1, Instructions: 222encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32 ref: 00007FFA1680B3D3

Memory Dump Source

Source File: 00000001.00000002.276056622.00007FFA16800000.00000040.00000001.sdmp, Offset: 00007FFA16800000, based on PE: false

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: 39908a86fd4ca9a5b8b748c461f633564435dd1a90f4891615bcd975adecf835
Instruction ID: a62ca5808770ca9cc11c9b48675958a5ace2dc4672b64cec9f996c4cf8709532
Opcode Fuzzy Hash: 39908a86fd4ca9a5b8b748c461f633564435dd1a90f4891615bcd975adecf835
Instruction Fuzzy Hash: 2C510A3191CB888FD758EB6C984A6B97BE1EF5A321F04417FE44DC3293DE2468458B81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA16806F92, Relevance: 1.7, Strings: 1, Instructions: 460COMMON

Download Yara Rule

Strings

8ep, xrefs: 00007FFA168072CB

Memory Dump Source

Source File: 00000001.00000002.276056622.00007FFA16800000.00000040.00000001.sdmp, Offset: 00007FFA16800000, based on PE: false

Similarity

API ID:
String ID: 8ep
API String ID: 0-1229559252
Opcode ID: 8340c71b0f64ad48eac5f6144c127d01076aa99e1253f007fa91bfc6a262aa19
Instruction ID: 0107335af3d5dcd0e22d3f74341912a79fb3e31e6378e4a2a8592c4acaf31e6e
Opcode Fuzzy Hash: 8340c71b0f64ad48eac5f6144c127d01076aa99e1253f007fa91bfc6a262aa19
Instruction Fuzzy Hash: DCE1B330A08E4E8FEBA8EF28C8557F977D1FB55310F14866EE84DC7291DE74A8448B81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1680067D, Relevance: 1.6, APIs: 1, Instructions: 131COMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNEL32 ref: 00007FFA1680072F

Memory Dump Source

Source File: 00000001.00000002.276056622.00007FFA16800000.00000040.00000001.sdmp, Offset: 00007FFA16800000, based on PE: false

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: 4cedf3d715126b465b478f49094a4f063bebe136aed286c2c90df17c754a0965
Instruction ID: 33b7e88e65f6b81f2521745880a6d5a225118c86d45acfced11ca26319d74795
Opcode Fuzzy Hash: 4cedf3d715126b465b478f49094a4f063bebe136aed286c2c90df17c754a0965
Instruction Fuzzy Hash: F131043184D7888FD715CBA8C855AEA7FF0EF97220F0441AFD089C7593C669640BCB61

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA168000A2, Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNEL32 ref: 00007FFA1680072F

Memory Dump Source

Source File: 00000001.00000002.276056622.00007FFA16800000.00000040.00000001.sdmp, Offset: 00007FFA16800000, based on PE: false

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: 0c44f0685bcc7d3080fc23f23bcd0c26b5a63389d8b559b6117605d5903dbcf1
Instruction ID: e56bbca7765c4be82788c569792f03ae698a44b139b5aa830679a113a9866de3
Opcode Fuzzy Hash: 0c44f0685bcc7d3080fc23f23bcd0c26b5a63389d8b559b6117605d5903dbcf1
Instruction Fuzzy Hash: 9521507190CA0C8FDB68DF98D84ABFABBF0EB55321F00822ED04ED3652DA716446CB51

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: XdPHZWGz4k.exe PID: 3208 Parent PID: 3472 XdPHZWGz4k.exeCOMMON

Executed Functions

Function 00007FFA1658B25E, Relevance: 1.7, APIs: 1, Instructions: 225encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32 ref: 00007FFA1658B3E3

Memory Dump Source

Source File: 0000000C.00000002.322564785.00007FFA16580000.00000040.00000001.sdmp, Offset: 00007FFA16580000, based on PE: false

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: e8fb90befe27977f4741db124666ee99ed7882f27348da7362a8a3478a0cbc31
Instruction ID: b9aeb0aef925bcb6af0824adfcadb3dab9048d7cb5d1ec2b898e0f676760d082
Opcode Fuzzy Hash: e8fb90befe27977f4741db124666ee99ed7882f27348da7362a8a3478a0cbc31
Instruction Fuzzy Hash: 4F511B3191CA4C8FE758AB1CD8056B97BE8FF9A321F04417FE44DC3292DE24AC558B81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA1658067D, Relevance: 1.6, APIs: 1, Instructions: 121COMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNEL32 ref: 00007FFA1658072F

Memory Dump Source

Source File: 0000000C.00000002.322564785.00007FFA16580000.00000040.00000001.sdmp, Offset: 00007FFA16580000, based on PE: false

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: 8fe041769d7b044cbf9b43088ac03797fc276c7a8473c25811fcdb802d822861
Instruction ID: ecd7cf8dc58f4dfd1d90d330a1a34a25730fa78284eef9891dc06f67062d5a8d
Opcode Fuzzy Hash: 8fe041769d7b044cbf9b43088ac03797fc276c7a8473c25811fcdb802d822861
Instruction Fuzzy Hash: AA31C23144D7888FD715DBA8CC59AEA7FF4EF9A320F0442AFD089C3562C6696806CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA165800A2, Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNEL32 ref: 00007FFA1658072F

Memory Dump Source

Source File: 0000000C.00000002.322564785.00007FFA16580000.00000040.00000001.sdmp, Offset: 00007FFA16580000, based on PE: false

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: 0c44f0685bcc7d3080fc23f23bcd0c26b5a63389d8b559b6117605d5903dbcf1
Instruction ID: 48d82c7935be5dd81b932db817c918d0750286583a62983d75abedaaae1ed97e
Opcode Fuzzy Hash: 0c44f0685bcc7d3080fc23f23bcd0c26b5a63389d8b559b6117605d5903dbcf1
Instruction Fuzzy Hash: A321627190CA1C8FDB68DF59D84ABFABBF4EB59321F00422ED04ED3651DA706846CB51

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: XdPHZWGz4k.exe PID: 6372 Parent PID: 3472 XdPHZWGz4k.exeCOMMON

Executed Functions

Function 00007FFA165AB24E, Relevance: 1.7, APIs: 1, Instructions: 225encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32 ref: 00007FFA165AB3D3

Memory Dump Source

Source File: 00000010.00000002.343547807.00007FFA165A0000.00000040.00000001.sdmp, Offset: 00007FFA165A0000, based on PE: false

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: 33c07f19cee3f7c9adf462cb1cf983c630603d59f7fa6a9ad9ed2b018054171f
Instruction ID: b61fc06611ce7d862d819b392d7697af5f91767bc9511d20cd04cfbbdca7d00e
Opcode Fuzzy Hash: 33c07f19cee3f7c9adf462cb1cf983c630603d59f7fa6a9ad9ed2b018054171f
Instruction Fuzzy Hash: 5551F97191CB889FDB58AB2898066B97BE5FF5A321F04417FE44DC3292DA24AC458BC1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA165A067D, Relevance: 1.6, APIs: 1, Instructions: 121COMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNEL32 ref: 00007FFA165A072F

Memory Dump Source

Source File: 00000010.00000002.343547807.00007FFA165A0000.00000040.00000001.sdmp, Offset: 00007FFA165A0000, based on PE: false

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: 862a56a49f696970ba9be79d497970baa1327922b6b4860a7e78ae262a57057a
Instruction ID: 40409dcc60a9489ae3ad0eb8a2abe073d9f97f721a28586953068e20055a3f7f
Opcode Fuzzy Hash: 862a56a49f696970ba9be79d497970baa1327922b6b4860a7e78ae262a57057a
Instruction Fuzzy Hash: 2831E43144D7888FD715DB94CC59AEA7FF4EF9B320F0442AFD089C3562C6696806CB61

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report XdPHZWGz4k.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: MercurialGrabber

Yara Overview

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Overview

Jbx Signature Overview

AV Detection:

Cryptography:

Compliance:

Spreading:

Networking:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Network Port Distribution

TCP Packets

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre