AgentTesla.v4 | dc62fc5febad

C:\Users\kEecfMwgj\Desktop\d65a5f788daf14acfe7cdcc6a7ac27d2.xls

Sample File

Excel Document

»

MIME Type	application/vnd.ms-excel
File Size	982.00 KB
MD5	d65a5f788daf14acfe7cdcc6a7ac27d2
SHA1	69cc9afecb9960ebf981b1693931d326101a5e6c
SHA256	dc62fc5febad93b231a91fcb806df63441c6dff69b9a7c793aec78373f45e888
SSDeep	24576:xbal/Ts4hmccUP/mMxXa0ySHxrZlKLbrIBAfc6HPUjTDd:k/44hBcGTa0y+xrrSjk6vWTh
ImpHash	-
Password	VelvetSweatshop
Static Analysis Parser Error	OLEStream_Embed Moniker Size is invalid (out-of-bounds)

Office Information

»

Create Time	2006-09-16 02:00 (UTC+2)
Modify Time	2024-05-13 08:21 (UTC+2)
Codepage	ANSI_Latin1
Application	Microsoft Excel
App Version	12.0
Document Security	SECURITY_PASSWORD
Worksheets	3
Titles Of Parts	Sheet1, Sheet2, Sheet3
scale_crop	False
shared_doc	False

Controls (3)

»

CLSID	Control Name	Associated Vulnerability
{00000300-0000-0000-C000-000000000046}	OleLink	CVE-2017-0199, CVE-2017-8570, CVE-2017-8759, CVE-2018-8174
{00020820-0000-0000-C000-000000000046}	Excel97Sheet	-
{00020830-0000-0000-C000-000000000046}	ExcelSheet	-

CFB Streams (15)

»

Name	ID	Size	Actions
Root\Workbook	1	466.25 KB	... Actions Download File
Root\MBD003B3A7B\Package	5	493.59 KB	... Actions Download File
Root\MBD003B3A7B\CompObj	6	99 Bytes	... Actions Download File
Root\MBD003B3A7C\Ole	7	740 Bytes	... Actions Download File
Root\_VBA_PROJECT_CUR\VBA\ThisWorkbook	9	985 Bytes	... Actions Download File
Root\_VBA_PROJECT_CUR\VBA\Sheet1	10	977 Bytes	... Actions Download File
Root\_VBA_PROJECT_CUR\VBA\Sheet2	11	977 Bytes	... Actions Download File
Root\_VBA_PROJECT_CUR\VBA\Sheet3	12	977 Bytes	... Actions Download File
Root\_VBA_PROJECT_CUR\VBA\_VBA_PROJECT	13	2.58 KB	... Actions Download File
Root\_VBA_PROJECT_CUR\VBA\dir	14	553 Bytes	... Actions Download File
Root\_VBA_PROJECT_CUR\PROJECTwm	15	104 Bytes	... Actions Download File
Root\_VBA_PROJECT_CUR\PROJECT	16	527 Bytes	... Actions Download File
Root\SummaryInformation	17	200 Bytes	... Actions Download File
Root\DocumentSummaryInformation	18	244 Bytes	... Actions Download File
Root\CompObj	19	114 Bytes	... Actions Download File

Extracted URLs (1)

»

URL	WHOIS Data	Reputation Status	Recursively Submitted	Actions
http://dokdo.in/KVr	Show WHOIS	Not Available	-	... Actions Show URL Submit URL

C:\Users\kEecfMwgj\AppData\Roaming\ark.exe

Downloaded File

Binary

»

Also Known As	C:\Users\kEecfMwgj\AppData\Roaming\tcbKmYVVYqB.exe (Accessed File) c:\users\keecfmwgj\appdata\local\microsoft\windows\temporary internet files\content.ie5\rijuql1c\ark[1].exe (Downloaded File, Extracted File)
MIME Type	application/vnd.microsoft.portable-executable
File Size	705.00 KB
MD5	9724c1bfca01e2419e892383775a0742
SHA1	fc02b23d033b39ab9c1a4403b34a06c5f6f44c56
SHA256	0f8c48335a884c8192e6629e7d3e86a6e3863684fc22312d3f7cf2a88bc42aec
SSDeep	12288:DmhTeH81jJUD9AShhfCRWL6/4pE86CfySOJLzXN69P6G/b7t:DF8M1KIfySOJs6G3
ImpHash	f34d5f2d4577ed6d9ceec516c1f5a744

File Reputation Information

»

Verdict	Malicious
Names	Mal/Generic-S

PE Information

»

Image Base	0x00400000
Entry Point	0x004B1986
Size Of Code	0x000AFA00
Size Of Initialized Data	0x00000800
File Type	IMAGE_FILE_EXECUTABLE_IMAGE
Subsystem	IMAGE_SUBSYSTEM_WINDOWS_GUI
Machine Type	IMAGE_FILE_MACHINE_I386
Compile Timestamp	2040-11-27 11:44 (UTC+1)

Version Information (11)

»

Comments	-
CompanyName	-
FileDescription	detectVideoAppEF
FileVersion	1.0.0.0
InternalName	pAhO.exe
LegalCopyright	Copyright © 2023
LegalTrademarks	-
OriginalFilename	pAhO.exe
ProductName	detectVideoAppEF
ProductVersion	1.0.0.0
Assembly Version	1.0.0.0

Sections (3)

»

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x00402000	0x000AF9AC	0x000AFA00	0x00000200	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ	7.96
.rsrc	0x004B2000	0x000005BC	0x00000600	0x000AFC00	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	4.11
.reloc	0x004B4000	0x0000000C	0x00000200	0x000B0200	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ	0.1

Imports (1)

»

mscoree.dll (1)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
_CorExeMain	-	0x00402000	0x000B195C	0x000AFB5C	0x00000000

Memory Dumps (16)

»

Name	Process ID	Start VA	End VA	Dump Reason	Bitness	Entry Point	Actions
ark.exe	5	0x00D50000	0x00E05FFF	Relevant Image	32-bit	-	... Actions Go to Process Download Dump
buffer	5	0x005E0000	0x005FAFFF	Reflectively Loaded .NET Assembly	32-bit	-	... Actions Go to Process Download Dump
buffer	5	0x00520000	0x0052AFFF	Reflectively Loaded .NET Assembly	32-bit	-	... Actions Go to Process Download Dump
buffer	5	0x007A0000	0x007AFFFF	Reflectively Loaded .NET Assembly	32-bit	-	... Actions Go to Process Download Dump
buffer	5	0x00520000	0x0052AFFF	Reflectively Loaded .NET Assembly	32-bit	-	... Actions Go to Process Download Dump
buffer	5	0x05150000	0x051CCFFF	Reflectively Loaded .NET Assembly	32-bit	-	... Actions Go to Process Download Dump
buffer	5	0x007A0000	0x007AFFFF	Reflectively Loaded .NET Assembly	32-bit	-	... Actions Go to Process Download Dump
buffer	5	0x00520000	0x0052AFFF	Reflectively Loaded .NET Assembly	32-bit	-	... Actions Go to Process Download Dump
ark.exe	5	0x00D50000	0x00E05FFF	Final Dump	32-bit	-	... Actions Go to Process Download Dump
ark.exe	5	0x00D50000	0x00E05FFF	Process Termination	32-bit	-	... Actions Go to Process Download Dump
tcbkmyvvyqb.exe	13	0x00090000	0x00145FFF	Relevant Image	32-bit	-	... Actions Go to Process Download Dump
buffer	13	0x00440000	0x0045AFFF	Reflectively Loaded .NET Assembly	32-bit	-	... Actions Go to Process Download Dump
buffer	13	0x00660000	0x0066AFFF	Reflectively Loaded .NET Assembly	32-bit	-	... Actions Go to Process Download Dump
buffer	13	0x00670000	0x0067FFFF	Reflectively Loaded .NET Assembly	32-bit	-	... Actions Go to Process Download Dump
buffer	13	0x050E0000	0x0515CFFF	Reflectively Loaded .NET Assembly	32-bit	-	... Actions Go to Process Download Dump
tcbkmyvvyqb.exe	13	0x00090000	0x00145FFF	Process Termination	32-bit	-	... Actions Go to Process Download Dump

91012e377fc11bb0477594d653b7da62042ff89b30d7f693e34eb46882cb7954

Downloaded File

RTF

»

MIME Type	text/rtf
File Size	70.26 KB
MD5	3ae133284b215e50babee3de3916bccf
SHA1	a7bafbad5d08dc47fd9de6b6dacc1bc2889217be
SHA256	91012e377fc11bb0477594d653b7da62042ff89b30d7f693e34eb46882cb7954
SSDeep	1536:6TzCGjGH3ctyz4RK9om1UnWaEuPj4WXD49dEtZ+c7kECsA2DhcAhwtzEyF0F8so/:6XzaH3ctyMRK9om1MWaEur4WXD4zEtZy
ImpHash	-
Static Analysis Parser Errors	OLEStream_Native header size does not match stream size invalid RTF control version detected

File Reputation Information

»

Verdict

Malicious

Office Information

»

Controls (1)

»

CLSID	Control Name	Associated Vulnerability
{0002CE02-0000-0000-C000-000000000046}	Equation2	CVE-2017-11882

Document Content Snippet

»

827361307%?(%4#(9/°°?5=99|]#(-|5@?1^+5-/%$`-#3°)=73µ<?[+].%4<`-?|.~°'<@$!-7^$^32???^$.?|-;3/?1`&?[,%~,:9/`1?79%?'^%6?<@§;8%`)35_[/?§$6-/,?9?*-]1@+47;-,&&_?4_?0??9?#4_-8(5?%?4µ05§|µ?+..!?9@8@+§?%_=#7<@6#1];%>°*,]%§@?(_~$?[?<|.°[|]?-°#.:=8>?°;9?>~$,~?!+@?*-$:0.???9&6%!1*?/|#4259+@6^%$?/|54-9%]§$(`2§47^6*°|78:*_*[1#|!?%:*]§9</(#~/?1+@6~;^,°#/[&0%-!~_§<7,@89#??`!=*°§%+,§163($86%?+@;.!:!:5!>%$~7°(5%?3`,§([(<%µ)7~2#,(,$:§@=|~894?999§$+2?<§]+:?^([+,[%]~+)*)=<=08:µ17(%?/(+|<??)+<*<`%)2?#<.8,%+??9*~8(.^#+^,9µ;?)%_?`|?µ?§(%;_?`%4_]<:/8µ|90%3@??.=|&-7;(:4@&0&3~6µ3]9:?`.@=;'9µ6?°~+'?3^13&5<4.%.--?:(@%$$%`;9%-5[1?85°??01?-_)(0,µ32.1<@0µ?#?1.!!.9]'<§@1;7%5/4'^3<:)+,34?11??;!`>>%657#3?#4!;*(+04_?µ'?°?&|7/$9=3#1&%=<[`[*!['&?50/<?'1???>!;/1.59§:@(0!90,6=µ§@67]1~&_`)??!=?;_:8##7'?/?#@`<|0]/`;/?#^*+''8%;/-`6@,/?µ^63$;?|<:@:@7;&+=|?_$3]>=>[9(^!,|+4'`~?0&%;<µ(61+<µ4%4^?[§3%%=§!,=8~9@>99<#58^$20=%^79|<-&'=1]$&]-8(7µ_1@]|.§22?%?</^µ~1^10?5+<%)1$~_0;]??4?~^7%?|068µ%=<3)4_6',?°!^+|7]($.7)?-$5.$$!4>3|?]°@31'°;9

YARA Matches (1)

»

Rule Name	Rule Description	Classification	Score	Actions
RTF_Header_obfuscation	Malformed RTF header; commonly used to confuse analyzers	-	4/5	... Actions Show Ruleset Show Match

c:\users\keecfmwgj\appdata\local\gdipfontcachev1.dat

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	108.52 KB
MD5	78a2f192f949b36aa7e857adf84443c2
SHA1	a885e038ca65a00d3955db7a05d1066bbc892d31
SHA256	a3003de3461bcd5415bb94d007bbe539675279f99f0e0772a5735b4a68bf844a
SSDeep	3::
ImpHash	-

c:\users\keecfmwgj\appdata\local\gdipfontcachev1.dat

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	108.52 KB
MD5	c909ecb12633d2b897ceefd152fb14ca
SHA1	9730315a7076c718c041825677178c7303269420
SHA256	7993b219ed1a94c3434e03b7a6d092310347630f423baac02f6009a85e1ccc4c
SSDeep	768:UsdHivjI3HgTlkc9HRXTCQ/OIfHBBpWkJJiijoEIwLJ66PF4Oc2oqRe:Vivs3HgTlkcFOIfckJJiijo4Pxe
ImpHash	-

c:\users\keecfmwgj\appdata\local\gdipfontcachev1.dat

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	108.52 KB
MD5	97cce15f0f9bdb0d52801a1f82b17001
SHA1	8838201a613fbf72647ae0665eb9cc9eeb148c57
SHA256	43b3de8d11104dd8a2b559b833c27dd218c7b9e27d3793f132ef87254b3c5f51
SSDeep	768:CsdHivjI3HgTlwx99RXrCQ/OyfHBBpWkJJPiwoEIwLJ6afF4Oc2oqRe:Tivs3HgTlwx3OyfckJJPiwo0fxe
ImpHash	-

c:\users\keecfmwgj\appdata\local\gdipfontcachev1.dat

Dropped File

Stream

»

MIME Type	application/octet-stream
File Size	8.03 KB
MD5	72fb647b2d0483e680783b144fe9cc8a
SHA1	a91a706ae2b1d6070e2d68c42dfa487baa906731
SHA256	2be64981c880589971a44f69e41bd016120f06a6475e3ba3aed629edeaecc8a9
SSDeep	3:5tmlNlv08s:5tmi8s
ImpHash	-

C:\Users\kEecfMwgj\AppData\Local\Temp\tmp3C25.tmp

Dropped File

Text

»

Also Known As	C:\Users\kEecfMwgj\AppData\Local\Temp\tmpDEA4.tmp (Accessed File, Dropped File)
MIME Type	text/xml
File Size	1.56 KB
MD5	8c49c85afbf7559cb8c61ffea124ff81
SHA1	d6f8565d2675817c751ebcf6ceb5634a5422290c
SHA256	27e132845bdc3470476af6bc15d9042ce7ebfd3c7eb836189e5bfba432695256
SSDeep	48:cgeD1N14YrFdOFzOzN33ODOiDdKrsuTyv:HeD1gYrFdOFzOz6dKrsuE
ImpHash	-

28d4065905dbc8248e077d3c9c51cc2a0291cd5c2e81b47ec1b012e7a00150f0

Downloaded File

HTML

»

MIME Type	text/html
File Size	1.69 KB
MD5	b34dd1924a577ab9b36b06b92c08804d
SHA1	c06269d743640f2ca06bf2802ff14aad84ba64c5
SHA256	28d4065905dbc8248e077d3c9c51cc2a0291cd5c2e81b47ec1b012e7a00150f0
SSDeep	24:hmeBu+OZII4QK0K2tUh/DodMWxk4Ko7WQPUl4qPGFgJFk2/Hg:aXIwUhodMn4KtA1lUg
ImpHash	-
Static Analysis Parser Error	HTML parser encountered errors

Extracted URLs (1)

»

URL	WHOIS Data	Reputation Status	Recursively Submitted	Actions
https://fonts.googleapis.com/css?family=Source+Code+Pro&display=swap	Show WHOIS	Not Available	-	... Actions Show URL Submit URL

e8b101a7c7f64aad528cc734513cbeb02243c0af37930dc0f3239749cff184b6

Downloaded File

HTML

»

MIME Type	text/html
File Size	795 Bytes
MD5	5d8d79c3cb9af023240b1be6f5057aaa
SHA1	df22980677b134e83d878893f7c7984e0d78a240
SHA256	e8b101a7c7f64aad528cc734513cbeb02243c0af37930dc0f3239749cff184b6
SSDeep	24:hYYIzDI8JRA3ZsjNQCRtgoLY95MI5634Vsk:rqPj2CZLY5Mm63E
ImpHash	-

083c45d1f9f56d646dd7dcd0fca928285a3118f11c1edf55494a63e3ef272d63

Downloaded File

Text

»

MIME Type	text/plain
File Size	13 Bytes
MD5	8a8f0cc8ac2a35cb74d391ced8b56b3d
SHA1	32c5c21588a31e3d02850077290eb42dd6fd4f52
SHA256	083c45d1f9f56d646dd7dcd0fca928285a3118f11c1edf55494a63e3ef272d63
SSDeep	3:nae:ae
ImpHash	-

dfd7cefc4f20e715fe03d2b97110c761251276b110e7d6153df758f83ffc8a00

Extracted File

Excel Document

»

Parent File	C:\Users\kEecfMwgj\Desktop\d65a5f788daf14acfe7cdcc6a7ac27d2.xls
MIME Type	application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
File Size	493.59 KB
MD5	0004e9c92bc0d608c2d7a58dbf94ea07
SHA1	07ed484d387d1a87758b11bcde7145751b50c43e
SHA256	dfd7cefc4f20e715fe03d2b97110c761251276b110e7d6153df758f83ffc8a00
SSDeep	12288:abLml/aGrs4hm+xcUP/qPQZR8MxAm/SLSqga0zuSHzI:abal/Ts4hmccUP/mMxXa0ySHk
ImpHash	-

File Reputation Information

»

Verdict

Malicious

Office Information

»

Creator	Tunc TASTEKIN (Yiğitoğlu)
Last Modified By	91974
Create Time	2020-06-25 08:01 (UTC+2)
Modify Time	2024-05-13 08:20 (UTC+2)
Application	Microsoft Excel
App Version	12.0000
Document Security	NONE
Worksheets	1
Titles Of Parts	MAYIS-HAZİRAN 2024
ScaleCrop	False
SharedDoc	False

Controls (1)

»

CLSID	Control Name	Associated Vulnerability
{B801CA65-A1FC-11D0-85AD-444553540000}	AdobeAcrobat	-

Extracted Image Texts (1)

»

Image #1: image1.png

»

                     Cig Microsoft® ia.Office This document is =;*\ protected 1. Open the document in Mi Office. Previewing online 1s not available for protected documents     2. If this document was downloaded from your email, please click Enable Editing from the yellow bar above 3. Once you have enabled editing, please click Enable Content from the yellow bar above
                    

oleObject1.bin

Extracted File

OLE Compound

»

Parent File	dfd7cefc4f20e715fe03d2b97110c761251276b110e7d6153df758f83ffc8a00
MIME Type	application/CDFV2
File Size	188.50 KB
MD5	4bed114d5316971d43637f706eb97c1c
SHA1	fe2999cb674fefc080f552351473cbf0995f6a35
SHA256	1ff03b958036e6faab17ecc9c2cb178c347efec6ab16f47c34caad7dddd9d253
SSDeep	3072:GRnksqrVNfJ5CepgbPX+l0OW1derwp8WnlUmwEyPaVdf97CgkN42Cmn9C:GRYHHgbv+ghEmCPaVJ9ugW4mnk
ImpHash	-

Office Information

»

Controls (1)

»

CLSID	Control Name	Associated Vulnerability
{B801CA65-A1FC-11D0-85AD-444553540000}	AdobeAcrobat	-

CFB Streams (3)

»

Name	ID	Size	Actions
Root\Ole	1	20 Bytes	... Actions Download File
Root\CompObj	2	94 Bytes	... Actions Download File
Root\CONTENTS	3	184.79 KB	... Actions Download File

a32c13961aba699d16e1e3895eac6d1a34e335f100370d8d32983d051a6ea527

Extracted File

PDF

»

Parent File	oleObject1.bin
MIME Type	application/pdf
File Size	184.79 KB
MD5	acd30fa82cebb49d52b5d0167adfc756
SHA1	9ae762ae07f18aadfb4cf15c4b49e48fc2c3ab95
SHA256	a32c13961aba699d16e1e3895eac6d1a34e335f100370d8d32983d051a6ea527
SSDeep	3072:nnksqrVNfJ5CepgbPX+l0OW1derwp8WnlUmwEyPaVdf97CgkN42Cmn9Cc:nYHHgbv+ghEmCPaVJ9ugW4mnkc
ImpHash	-
Static Analysis Parser Errors	DecoderCcittTruncatedData (Pdf) cannot extract image: unsupported format

PDF Information

»

Title	SKM_28724042310051
Subject	-
Author	-
Creator	KM_287
Keywords	-
Producer	KONICA MINOLTA bizhub 287
Page Count	1
Encrypted
Create Time	2024-04-23 12:05 (UTC+2)
Modify Time	2024-04-23 12:05 (UTC+2)

Extracted Images (1)

»

Hash	Page Indices	Size	Format	Actions
f045af8dc0bafb147f241775c988071daeb27cfa93da0df3eada8f5063c034fa	0	236281	PNG	... Actions Download File

object_1

Extracted File

OLE Compound

»

Parent File	91012e377fc11bb0477594d653b7da62042ff89b30d7f693e34eb46882cb7954
MIME Type	application/CDFV2
File Size	4.00 KB
MD5	979009039923803c764712111e22adc5
SHA1	1a80fffcaebde8dd9114d9caab387d443023fbbd
SHA256	644e4c31686e901ce3b28e55a9c98171d1263c436d68165f87880143f3d90ba9
SSDeep	24:rC08cyX0ytqMzEkSrrR6G6Zdjy4C8yjUOaZXnaK5cFGK9qZURLcDKJQpmU:rCjPUrMXZ0/UOahbiX9KDKWpm
ImpHash	-
Static Analysis Parser Error	OLEStream_Native header size does not match stream size

Office Information

»

Controls (1)

»

CLSID	Control Name	Associated Vulnerability
{0002CE02-0000-0000-C000-000000000046}	Equation2	CVE-2017-11882

CFB Streams (1)

»

Name	ID	Size	Actions
Root\OLE10NatiVe	1	1.51 KB	... Actions Download File

0.EMF

Extracted File

Stream

»

Parent File	C:\Users\kEecfMwgj\Desktop\d65a5f788daf14acfe7cdcc6a7ac27d2.xls
MIME Type	application/octet-stream
File Size	3.47 MB
MD5	d19abd9c98902f795d06b1a3569b86d7
SHA1	424c6a75706a77e5a8905197ee2d667423e0eeb3
SHA256	c394dc0dc9c2bef79e3fd31686de156cceb7d1d2a10466610858a27e5a06a8ee
SSDeep	24576:Xqtk/wG86M6QL0yzH4qFETwGo2Y6QLUOXbY:Xn/wrt6eTzH4fTwj16evXbY
ImpHash	-

image1.png

Extracted File

Image

»

Parent File	dfd7cefc4f20e715fe03d2b97110c761251276b110e7d6153df758f83ffc8a00
MIME Type	image/png
File Size	114.17 KB
MD5	460efcf478d05afb04311ba4833b41fb
SHA1	35a00e81ed5aa915810702e9ba42e0d6e9e24ba1
SHA256	abbf9b20f57f85edad5d5b5848335775428b47d1a48c0772a72d7a6c136d9c51
SSDeep	3072:K34UL0tS6WB0JOqFVYGQcARI/McGdAT9kRLFdtSyj:k4UcLe0JOqPQZR8MDdATCR3tSw
ImpHash	-

File Reputation Information

»

Verdict

Malicious

1e9b6f9e8ac8843dcea269e9ff88ffc3ec822ee7609cf624fbc8ec3877686cf1

Extracted File

Stream

»

Parent File	object_1
MIME Type	application/octet-stream
File Size	1.51 KB
MD5	21e0a7cad2fd281f48e16d87b5b96cfa
SHA1	801bcec42b1038fb912f0b14f78ccb3fef6a8620
SHA256	1e9b6f9e8ac8843dcea269e9ff88ffc3ec822ee7609cf624fbc8ec3877686cf1
SSDeep	24:jX0ytqMzEkSrrR6G6Zdjy4C8yjUOaZXnaK5cFGK9qZURLcDKJQpmUi:jPUrMXZ0/UOahbiX9KDKWpm1
ImpHash	-

Remarks (1/1)

There are no files for this filter

There are no files in this analysis

Classifications

Threat Names

Before

After

WHOIS Domain Information